Edit tour

Linux Analysis Report
sora.arm

Overview

General Information

Sample Name:	sora.arm
Analysis ID:	626479
MD5:	7799db04192fa39c4d8d2986fbc472a8
SHA1:	15dbc1cc83b869cd3eab35cd02c994507d4d0604
SHA256:	600656d40c15432fe35987fec3d346cf9f34ee9b1ae1d23706925d6c8b6e57b8
Infos:

Detection

Mirai

Score:	60
Range:	0 - 100
Whitelisted:	false

Signatures

Yara detected Mirai

Multi AV Scanner detection for submitted file

Sample is packed with UPX

Sample contains only a LOAD segment without any section mappings

Uses the "uname" system call to query kernel version information (possible evasion)

Enumerates processes within the "proc" file system

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected TCP or UDP traffic on non-standard ports

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	626479
Start date and time: 14/05/202204:30:53	2022-05-14 04:30:53 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 23s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	sora.arm
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Detection:	MAL
Classification:	mal60.troj.evad.linARM@0/0@0/0

Warnings

Report size exceeded maximum capacity and may have missing network information.
TCP Packets have been reduced to 100

Runtime Messages

Command:	/tmp/sora.arm
PID:	6226
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	Connected To CNC
Standard Error:

Process Tree

system is lnxubuntu20

sora.arm (PID: 6226, Parent: 6123, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/sora.arm

sora.arm New Fork (PID: 6228, Parent: 6226)

sora.arm New Fork (PID: 6326, Parent: 6228)

sora.arm New Fork (PID: 6330, Parent: 6228)

sora.arm New Fork (PID: 6333, Parent: 6330)

sora.arm New Fork (PID: 6344, Parent: 6333)

sora.arm New Fork (PID: 6346, Parent: 6333)

sora.arm New Fork (PID: 6335, Parent: 6330)

sora.arm New Fork (PID: 6336, Parent: 6330)

sora.arm New Fork (PID: 6230, Parent: 6226)

sora.arm New Fork (PID: 6231, Parent: 6226)

sora.arm New Fork (PID: 6234, Parent: 6231)

sora.arm New Fork (PID: 6325, Parent: 6234)

sora.arm New Fork (PID: 6328, Parent: 6234)

sora.arm New Fork (PID: 6235, Parent: 6231)

sora.arm New Fork (PID: 6237, Parent: 6231)

cleanup

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Mirai_12	Yara detected Mirai	Joe Security

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: sora.arm

Virustotal: Detection: 42%

Perma Link

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Source: global traffic

TCP traffic: 192.168.2.23:45728 -> 104.131.58.204:1312

Source: /tmp/sora.arm (PID: 6228)	Socket: 0.0.0.0::0
Source: /tmp/sora.arm (PID: 6228)	Socket: 0.0.0.0::53413
Source: /tmp/sora.arm (PID: 6228)	Socket: 0.0.0.0::80
Source: /tmp/sora.arm (PID: 6228)	Socket: 0.0.0.0::37215
Source: /tmp/sora.arm (PID: 6234)	Socket: 0.0.0.0::0

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 104.131.58.204
Source: unknown	TCP traffic detected without corresponding DNS query: 90.142.129.13
Source: unknown	TCP traffic detected without corresponding DNS query: 112.220.25.155
Source: unknown	TCP traffic detected without corresponding DNS query: 218.116.26.13
Source: unknown	TCP traffic detected without corresponding DNS query: 41.49.140.15
Source: unknown	TCP traffic detected without corresponding DNS query: 211.14.213.103
Source: unknown	TCP traffic detected without corresponding DNS query: 221.214.104.243
Source: unknown	TCP traffic detected without corresponding DNS query: 14.27.145.200
Source: unknown	TCP traffic detected without corresponding DNS query: 89.175.35.111
Source: unknown	TCP traffic detected without corresponding DNS query: 171.15.147.154
Source: unknown	TCP traffic detected without corresponding DNS query: 221.201.182.216
Source: unknown	TCP traffic detected without corresponding DNS query: 190.174.174.34
Source: unknown	TCP traffic detected without corresponding DNS query: 78.239.7.93
Source: unknown	TCP traffic detected without corresponding DNS query: 45.15.75.43
Source: unknown	TCP traffic detected without corresponding DNS query: 194.50.244.199
Source: unknown	TCP traffic detected without corresponding DNS query: 108.77.125.24
Source: unknown	TCP traffic detected without corresponding DNS query: 253.173.219.103
Source: unknown	TCP traffic detected without corresponding DNS query: 181.156.71.179
Source: unknown	TCP traffic detected without corresponding DNS query: 181.119.86.241
Source: unknown	TCP traffic detected without corresponding DNS query: 57.103.122.74
Source: unknown	TCP traffic detected without corresponding DNS query: 86.26.239.206
Source: unknown	TCP traffic detected without corresponding DNS query: 202.102.229.41
Source: unknown	TCP traffic detected without corresponding DNS query: 146.35.195.126
Source: unknown	TCP traffic detected without corresponding DNS query: 197.108.214.179
Source: unknown	TCP traffic detected without corresponding DNS query: 243.16.11.26
Source: unknown	TCP traffic detected without corresponding DNS query: 165.168.142.144
Source: unknown	TCP traffic detected without corresponding DNS query: 162.169.120.3
Source: unknown	TCP traffic detected without corresponding DNS query: 244.165.245.90
Source: unknown	TCP traffic detected without corresponding DNS query: 62.50.50.73
Source: unknown	TCP traffic detected without corresponding DNS query: 24.56.245.123
Source: unknown	TCP traffic detected without corresponding DNS query: 169.120.116.184
Source: unknown	TCP traffic detected without corresponding DNS query: 57.177.179.33
Source: unknown	TCP traffic detected without corresponding DNS query: 219.180.250.187
Source: unknown	TCP traffic detected without corresponding DNS query: 251.71.75.190
Source: unknown	TCP traffic detected without corresponding DNS query: 156.225.109.220
Source: unknown	TCP traffic detected without corresponding DNS query: 91.65.68.150
Source: unknown	TCP traffic detected without corresponding DNS query: 188.144.215.180
Source: unknown	TCP traffic detected without corresponding DNS query: 16.130.211.183
Source: unknown	TCP traffic detected without corresponding DNS query: 14.231.82.209
Source: unknown	TCP traffic detected without corresponding DNS query: 165.114.156.179
Source: unknown	TCP traffic detected without corresponding DNS query: 146.104.86.150
Source: unknown	TCP traffic detected without corresponding DNS query: 156.67.159.142
Source: unknown	TCP traffic detected without corresponding DNS query: 162.58.175.53
Source: unknown	TCP traffic detected without corresponding DNS query: 91.209.199.175
Source: unknown	TCP traffic detected without corresponding DNS query: 128.1.51.63
Source: unknown	TCP traffic detected without corresponding DNS query: 62.128.207.203
Source: unknown	TCP traffic detected without corresponding DNS query: 207.21.144.165
Source: unknown	TCP traffic detected without corresponding DNS query: 13.193.175.91

Source: sora.arm

String found in binary or memory: http://upx.sf.net

Source: LOAD without section mappings

Program segment: 0x8000

Source: /tmp/sora.arm (PID: 6228)	SIGKILL sent: pid: 936, result: successful
Source: /tmp/sora.arm (PID: 6234)	SIGKILL sent: pid: 936, result: successful

Source: classification engine

Classification label: mal60.troj.evad.linARM@0/0@0/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Source: /tmp/sora.arm (PID: 6234)	File opened: /proc/491/fd
Source: /tmp/sora.arm (PID: 6234)	File opened: /proc/793/fd
Source: /tmp/sora.arm (PID: 6234)	File opened: /proc/772/fd
Source: /tmp/sora.arm (PID: 6234)	File opened: /proc/796/fd
Source: /tmp/sora.arm (PID: 6234)	File opened: /proc/774/fd
Source: /tmp/sora.arm (PID: 6234)	File opened: /proc/797/fd
Source: /tmp/sora.arm (PID: 6234)	File opened: /proc/777/fd
Source: /tmp/sora.arm (PID: 6234)	File opened: /proc/799/fd
Source: /tmp/sora.arm (PID: 6234)	File opened: /proc/658/fd
Source: /tmp/sora.arm (PID: 6234)	File opened: /proc/912/fd
Source: /tmp/sora.arm (PID: 6234)	File opened: /proc/759/fd
Source: /tmp/sora.arm (PID: 6234)	File opened: /proc/936/fd
Source: /tmp/sora.arm (PID: 6234)	File opened: /proc/918/fd
Source: /tmp/sora.arm (PID: 6234)	File opened: /proc/1/fd
Source: /tmp/sora.arm (PID: 6234)	File opened: /proc/761/fd
Source: /tmp/sora.arm (PID: 6234)	File opened: /proc/785/fd
Source: /tmp/sora.arm (PID: 6234)	File opened: /proc/884/fd
Source: /tmp/sora.arm (PID: 6234)	File opened: /proc/720/fd
Source: /tmp/sora.arm (PID: 6234)	File opened: /proc/721/fd
Source: /tmp/sora.arm (PID: 6234)	File opened: /proc/788/fd
Source: /tmp/sora.arm (PID: 6234)	File opened: /proc/789/fd
Source: /tmp/sora.arm (PID: 6234)	File opened: /proc/800/fd
Source: /tmp/sora.arm (PID: 6234)	File opened: /proc/801/fd
Source: /tmp/sora.arm (PID: 6234)	File opened: /proc/847/fd
Source: /tmp/sora.arm (PID: 6234)	File opened: /proc/904/fd
Source: /tmp/sora.arm (PID: 6228)	File opened: /proc/491/fd
Source: /tmp/sora.arm (PID: 6228)	File opened: /proc/793/fd
Source: /tmp/sora.arm (PID: 6228)	File opened: /proc/772/fd
Source: /tmp/sora.arm (PID: 6228)	File opened: /proc/796/fd
Source: /tmp/sora.arm (PID: 6228)	File opened: /proc/774/fd
Source: /tmp/sora.arm (PID: 6228)	File opened: /proc/797/fd
Source: /tmp/sora.arm (PID: 6228)	File opened: /proc/777/fd
Source: /tmp/sora.arm (PID: 6228)	File opened: /proc/799/fd
Source: /tmp/sora.arm (PID: 6228)	File opened: /proc/658/fd
Source: /tmp/sora.arm (PID: 6228)	File opened: /proc/912/fd
Source: /tmp/sora.arm (PID: 6228)	File opened: /proc/759/fd
Source: /tmp/sora.arm (PID: 6228)	File opened: /proc/936/fd
Source: /tmp/sora.arm (PID: 6228)	File opened: /proc/918/fd
Source: /tmp/sora.arm (PID: 6228)	File opened: /proc/1/fd
Source: /tmp/sora.arm (PID: 6228)	File opened: /proc/761/fd
Source: /tmp/sora.arm (PID: 6228)	File opened: /proc/785/fd
Source: /tmp/sora.arm (PID: 6228)	File opened: /proc/884/fd
Source: /tmp/sora.arm (PID: 6228)	File opened: /proc/720/fd
Source: /tmp/sora.arm (PID: 6228)	File opened: /proc/721/fd
Source: /tmp/sora.arm (PID: 6228)	File opened: /proc/788/fd
Source: /tmp/sora.arm (PID: 6228)	File opened: /proc/789/fd
Source: /tmp/sora.arm (PID: 6228)	File opened: /proc/800/fd
Source: /tmp/sora.arm (PID: 6228)	File opened: /proc/801/fd
Source: /tmp/sora.arm (PID: 6228)	File opened: /proc/847/fd
Source: /tmp/sora.arm (PID: 6228)	File opened: /proc/904/fd

Source: /tmp/sora.arm (PID: 6226)

Queries kernel information via 'uname':

Source: sora.arm, 6226.1.00000000a25b81b1.00000000ff87532e.rw-.sdmp, sora.arm, 6228.1.00000000a25b81b1.00000000ff87532e.rw-.sdmp, sora.arm, 6326.1.00000000a25b81b1.00000000ff87532e.rw-.sdmp, sora.arm, 6344.1.00000000a25b81b1.00000000ff87532e.rw-.sdmp, sora.arm, 6335.1.00000000a25b81b1.00000000ff87532e.rw-.sdmp, sora.arm, 6230.1.00000000a25b81b1.00000000ff87532e.rw-.sdmp, sora.arm, 6325.1.00000000a25b81b1.00000000ff87532e.rw-.sdmp, sora.arm, 6235.1.00000000a25b81b1.00000000ff87532e.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: sora.arm, 6226.1.00000000d4f1622b.00000000bf8ca384.rw-.sdmp, sora.arm, 6228.1.00000000d4f1622b.00000000bf8ca384.rw-.sdmp, sora.arm, 6326.1.00000000d4f1622b.00000000bf8ca384.rw-.sdmp, sora.arm, 6344.1.00000000d4f1622b.00000000bf8ca384.rw-.sdmp, sora.arm, 6335.1.00000000d4f1622b.00000000bf8ca384.rw-.sdmp, sora.arm, 6230.1.00000000d4f1622b.00000000bf8ca384.rw-.sdmp, sora.arm, 6325.1.00000000d4f1622b.00000000bf8ca384.rw-.sdmp, sora.arm, 6235.1.00000000d4f1622b.00000000bf8ca384.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/sora.armSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/sora.arm
Source: sora.arm, 6226.1.00000000a25b81b1.00000000ff87532e.rw-.sdmp, sora.arm, 6228.1.00000000a25b81b1.00000000ff87532e.rw-.sdmp, sora.arm, 6326.1.00000000a25b81b1.00000000ff87532e.rw-.sdmp, sora.arm, 6344.1.00000000a25b81b1.00000000ff87532e.rw-.sdmp, sora.arm, 6335.1.00000000a25b81b1.00000000ff87532e.rw-.sdmp, sora.arm, 6230.1.00000000a25b81b1.00000000ff87532e.rw-.sdmp, sora.arm, 6325.1.00000000a25b81b1.00000000ff87532e.rw-.sdmp, sora.arm, 6235.1.00000000a25b81b1.00000000ff87532e.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: sora.arm, 6226.1.00000000d4f1622b.00000000bf8ca384.rw-.sdmp, sora.arm, 6228.1.00000000d4f1622b.00000000bf8ca384.rw-.sdmp, sora.arm, 6326.1.00000000d4f1622b.00000000bf8ca384.rw-.sdmp, sora.arm, 6344.1.00000000d4f1622b.00000000bf8ca384.rw-.sdmp, sora.arm, 6335.1.00000000d4f1622b.00000000bf8ca384.rw-.sdmp, sora.arm, 6230.1.00000000d4f1622b.00000000bf8ca384.rw-.sdmp, sora.arm, 6325.1.00000000d4f1622b.00000000bf8ca384.rw-.sdmp, sora.arm, 6235.1.00000000d4f1622b.00000000bf8ca384.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match

File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Mirai

Source: Yara match

File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Obfuscated Files or Information	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
sora.arm	43%	Virustotal		Browse

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	sora.arm	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
192.132.79.178	unknown	United States	367	DNIC-ASBLK-00306-00371US	false
17.88.248.1	unknown	United States	714	APPLE-ENGINEERINGUS	false
108.34.195.20	unknown	United States	701	UUNETUS	false
85.158.231.141	unknown	Austria	8692	BRZAT	false
197.166.142.74	unknown	Egypt	24863	LINKdotNET-ASEG	false
243.142.109.8	unknown	Reserved	unknown	unknown	false
154.28.148.110	unknown	United States	174	COGENT-174US	false
223.110.109.215	unknown	China	56046	CMNET-JIANGSU-APChinaMobilecommunicationscorporationCN	false
242.105.215.220	unknown	Reserved	unknown	unknown	false
89.3.43.196	unknown	France	21502	ASN-NUMERICABLEFR	false
248.65.0.12	unknown	Reserved	unknown	unknown	false
16.46.151.36	unknown	United States	unknown	unknown	false
45.140.216.1	unknown	Switzerland	62075	LANNERTDE	false
147.24.192.227	unknown	United States	10796	TWC-10796-MIDWESTUS	false
135.148.11.249	unknown	United States	18676	AVAYAUS	false
253.179.7.5	unknown	Reserved	unknown	unknown	false
187.247.165.44	unknown	Mexico	13999	MegaCableSAdeCVMX	false
37.90.202.181	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
161.53.142.82	unknown	Croatia (LOCAL Name: Hrvatska)	2108	CARNET-ASJMarohnica510000ZagrebHR	false
201.173.227.169	unknown	Mexico	11888	TelevisionInternacionalSAdeCVMX	false
126.89.187.159	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
133.124.154.5	unknown	Japan	2522	PPP-EXPJapanNetworkInformationCenterJP	false
13.165.162.234	unknown	United States	7018	ATT-INTERNET4US	false
218.235.146.189	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
250.183.216.13	unknown	Reserved	unknown	unknown	false
48.6.146.179	unknown	United States	2686	ATGS-MMD-ASUS	false
105.179.193.81	unknown	unknown	37228	Olleh-Rwanda-NetworksRW	false
243.114.158.2	unknown	Reserved	unknown	unknown	false
223.184.95.212	unknown	India	45609	BHARTI-MOBILITY-AS-APBhartiAirtelLtdASforGPRSService	false
108.103.78.32	unknown	United States	10507	SPCSUS	false
75.43.169.89	unknown	United States	7018	ATT-INTERNET4US	false
99.2.51.118	unknown	United States	7018	ATT-INTERNET4US	false
99.188.69.140	unknown	United States	7018	ATT-INTERNET4US	false
160.224.24.100	unknown	Angola	11259	ANGOLATELECOMAO	false
124.54.163.211	unknown	Korea Republic of	17858	POWERVIS-AS-KRLGPOWERCOMMKR	false
198.217.52.158	unknown	United States	3354	THENET-AS-3354US	false
46.109.74.153	unknown	Latvia	12578	APOLLO-ASLatviaLV	false
23.254.189.224	unknown	United States	54290	HOSTWINDSUS	false
197.13.57.208	unknown	Tunisia	37504	MeninxTN	false
83.191.157.210	unknown	Sweden	39651	COMHEM-SWEDENSE	false
156.191.147.95	unknown	Egypt	36992	ETISALAT-MISREG	false
95.120.78.125	unknown	Spain	3352	TELEFONICA_DE_ESPANAES	false
141.231.140.12	unknown	United Kingdom	12701	BARCAPLondonGB	false
66.74.196.104	unknown	United States	20001	TWC-20001-PACWESTUS	false
242.47.204.113	unknown	Reserved	unknown	unknown	false
88.0.190.253	unknown	Spain	3352	TELEFONICA_DE_ESPANAES	false
222.4.209.248	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
101.98.223.235	unknown	New Zealand	9790	VOCUSGROUPNZVocusGroupNZ	false
246.182.65.69	unknown	Reserved	unknown	unknown	false
197.32.129.167	unknown	Egypt	8452	TE-ASTE-ASEG	false
45.48.194.60	unknown	United States	20001	TWC-20001-PACWESTUS	false
43.145.165.142	unknown	Japan	4249	LILLY-ASUS	false
246.118.168.83	unknown	Reserved	unknown	unknown	false
24.115.243.251	unknown	United States	3737	AS-PTDUS	false
35.63.96.23	unknown	United States	397797	CITYOFMARSHALL-01US	false
195.199.39.146	unknown	Hungary	1955	HBONE-ASHUNGARNETHU	false
36.107.69.251	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
194.14.131.55	unknown	Sweden	35041	NET-BINERO-STHLM1SE	false
70.96.75.254	unknown	United States	7385	ALLSTREAMUS	false
247.246.7.44	unknown	Reserved	unknown	unknown	false
246.104.145.143	unknown	Reserved	unknown	unknown	false
68.179.33.30	unknown	Canada	20161	TRGOCA	false
109.219.227.142	unknown	France	3215	FranceTelecom-OrangeFR	false
104.208.173.193	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
187.204.147.54	unknown	Mexico	8151	UninetSAdeCVMX	false
48.16.103.121	unknown	United States	2686	ATGS-MMD-ASUS	false
251.189.114.109	unknown	Reserved	unknown	unknown	false
40.61.159.230	unknown	United States	4249	LILLY-ASUS	false
140.207.43.149	unknown	China	17621	CNCGROUP-SHChinaUnicomShanghainetworkCN	false
219.29.178.11	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
39.115.115.171	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
78.79.205.44	unknown	Sweden	3301	TELIANET-SWEDENTeliaCompanySE	false
101.13.247.74	unknown	Taiwan; Republic of China (ROC)	24158	TAIWANMOBILE-ASTaiwanMobileCoLtdTW	false
8.173.77.185	unknown	Singapore	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
180.15.127.156	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
108.143.162.126	unknown	United States	16509	AMAZON-02US	false
178.188.243.188	unknown	Austria	8447	TELEKOM-ATA1TelekomAustriaAGAT	false
86.82.71.136	unknown	Netherlands	1136	KPNKPNNationalEU	false
19.76.79.165	unknown	United States	3	MIT-GATEWAYSUS	false
106.250.8.227	unknown	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	false
180.114.49.216	unknown	China	137702	CHINATELECOM-JIANGSU-NANJING-IDCNanjingJiangsuProvince	false
159.247.172.170	unknown	United States	3481	STOFCT-DOITUS	false
149.9.143.181	unknown	United States	14987	RETHEMHOSTINGUS	false
220.24.38.227	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
95.177.81.60	unknown	United Kingdom	8190	MDNXGB	false
82.184.182.41	unknown	Italy	3269	ASN-IBSNAZIT	false
85.71.236.132	unknown	Czech Republic	5610	O2-CZECH-REPUBLICCZ	false
240.117.204.14	unknown	Reserved	unknown	unknown	false
24.31.202.210	unknown	United States	11426	TWC-11426-CAROLINASUS	false
37.186.50.105	unknown	Qatar	48728	VODAFONEQATARQA	false
210.212.47.194	unknown	India	9829	BSNL-NIBNationalInternetBackboneIN	false
145.225.247.175	unknown	Germany	25039	ASN-LINDEKlosterhofstrasse1DE	false
195.122.185.77	unknown	United Kingdom	3356	LEVEL3US	false
220.219.163.179	unknown	Japan	2510	INFOWEBFUJITSULIMITEDJP	false
16.85.23.211	unknown	United States	unknown	unknown	false
183.19.172.132	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
158.26.60.160	unknown	United States	1766	ASN-EXXONMOBIL-US	false
59.3.178.43	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
221.213.227.182	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
94.38.206.221	unknown	Italy	8612	TISCALI-IT	false

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
Entropy (8bit):	7.930945027439013
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	sora.arm
File size:	24648
MD5:	7799db04192fa39c4d8d2986fbc472a8
SHA1:	15dbc1cc83b869cd3eab35cd02c994507d4d0604
SHA256:	600656d40c15432fe35987fec3d346cf9f34ee9b1ae1d23706925d6c8b6e57b8
SHA512:	11058cc551c7ee141b26b66edaf5ef3f01e3ca6aaf3af8fef5b0edd556213f92695922f52735ffa8c5062cd119c0d51aca5598217f35c9980fec36bf3128b678
SSDEEP:	768:y9MhmNhHXqPpY5IpXetXpsIifmqrs3UozV:y9QmNhHXqxRpXgXpUfwzV
TLSH:	90B2E01179AC5DE2E5748C739F5C8383A30713BAD0DD654015265E289DCE83B21F7AAF
File Content Preview:	.ELF...a..........(.........4...........4. ...(.....................__..__..............t[..t...t...................Q.td..............................CvUPX!....................Q..........?.E.h;.}...^..........enQ.e........j......3......w..q@5.rN.>^.(.W...

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0xcdb0
Flags:	0x202
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	0
Section Header Size:	40
Number of Section Headers:	0
Header String Table Index:	0

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0x8000	0x8000	0x5f5f	0x5f5f	4.0313	0x5	R E	0x8000
LOAD	0x5b74	0x1db74	0x1db74	0x0	0x0	0.0000	0x6	RW	0x8000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 14, 2022 04:31:40.247756004 CEST	42836	443	192.168.2.23	91.189.91.43
May 14, 2022 04:31:41.015907049 CEST	42516	80	192.168.2.23	109.202.202.202
May 14, 2022 04:31:42.384011984 CEST	45728	1312	192.168.2.23	104.131.58.204
May 14, 2022 04:31:42.419465065 CEST	65442	23	192.168.2.23	90.142.129.13
May 14, 2022 04:31:42.419512033 CEST	65442	23	192.168.2.23	112.220.25.155
May 14, 2022 04:31:42.419519901 CEST	65442	23	192.168.2.23	218.116.26.13
May 14, 2022 04:31:42.419528008 CEST	65442	23	192.168.2.23	41.49.140.15
May 14, 2022 04:31:42.419564962 CEST	65442	23	192.168.2.23	211.14.213.103
May 14, 2022 04:31:42.419575930 CEST	65442	23	192.168.2.23	221.214.104.243
May 14, 2022 04:31:42.419576883 CEST	65442	23	192.168.2.23	14.27.145.200
May 14, 2022 04:31:42.419579029 CEST	65442	23	192.168.2.23	89.175.35.111
May 14, 2022 04:31:42.419589043 CEST	65442	23	192.168.2.23	171.15.147.154
May 14, 2022 04:31:42.419594049 CEST	65442	23	192.168.2.23	221.201.182.216
May 14, 2022 04:31:42.419611931 CEST	65442	23	192.168.2.23	190.174.174.34
May 14, 2022 04:31:42.419619083 CEST	65442	23	192.168.2.23	78.239.7.93
May 14, 2022 04:31:42.419639111 CEST	65442	23	192.168.2.23	45.15.75.43
May 14, 2022 04:31:42.419647932 CEST	65442	23	192.168.2.23	194.50.244.199
May 14, 2022 04:31:42.419657946 CEST	65442	23	192.168.2.23	108.77.125.24
May 14, 2022 04:31:42.419677973 CEST	65442	23	192.168.2.23	253.173.219.103
May 14, 2022 04:31:42.419681072 CEST	65442	23	192.168.2.23	181.156.71.179
May 14, 2022 04:31:42.419682026 CEST	65442	23	192.168.2.23	181.119.86.241
May 14, 2022 04:31:42.419683933 CEST	65442	23	192.168.2.23	57.103.122.74
May 14, 2022 04:31:42.419686079 CEST	65442	23	192.168.2.23	86.26.239.206
May 14, 2022 04:31:42.419703007 CEST	65442	23	192.168.2.23	202.102.229.41
May 14, 2022 04:31:42.419703960 CEST	65442	23	192.168.2.23	146.35.195.126
May 14, 2022 04:31:42.419709921 CEST	65442	23	192.168.2.23	197.108.214.179
May 14, 2022 04:31:42.419712067 CEST	65442	23	192.168.2.23	243.16.11.26
May 14, 2022 04:31:42.419718981 CEST	65442	23	192.168.2.23	165.168.142.144
May 14, 2022 04:31:42.419723034 CEST	65442	23	192.168.2.23	162.169.120.3
May 14, 2022 04:31:42.419724941 CEST	65442	23	192.168.2.23	243.110.1.243
May 14, 2022 04:31:42.419735909 CEST	65442	23	192.168.2.23	244.165.245.90
May 14, 2022 04:31:42.419744968 CEST	65442	23	192.168.2.23	62.50.50.73
May 14, 2022 04:31:42.419751883 CEST	65442	23	192.168.2.23	24.56.245.123
May 14, 2022 04:31:42.419786930 CEST	65442	23	192.168.2.23	169.120.116.184
May 14, 2022 04:31:42.419835091 CEST	65442	23	192.168.2.23	57.177.179.33
May 14, 2022 04:31:42.419842005 CEST	65442	23	192.168.2.23	219.180.250.187
May 14, 2022 04:31:42.419843912 CEST	65442	23	192.168.2.23	37.10.187.105
May 14, 2022 04:31:42.419847012 CEST	65442	23	192.168.2.23	251.71.75.190
May 14, 2022 04:31:42.419847965 CEST	65442	23	192.168.2.23	156.225.109.220
May 14, 2022 04:31:42.419884920 CEST	65442	23	192.168.2.23	91.65.68.150
May 14, 2022 04:31:42.419903994 CEST	65442	23	192.168.2.23	188.144.215.180
May 14, 2022 04:31:42.419903994 CEST	65442	23	192.168.2.23	16.130.211.183
May 14, 2022 04:31:42.419908047 CEST	65442	23	192.168.2.23	14.231.82.209
May 14, 2022 04:31:42.419924021 CEST	65442	23	192.168.2.23	176.110.106.36
May 14, 2022 04:31:42.419925928 CEST	65442	23	192.168.2.23	165.114.156.179
May 14, 2022 04:31:42.419926882 CEST	65442	23	192.168.2.23	146.104.86.150
May 14, 2022 04:31:42.419928074 CEST	65442	23	192.168.2.23	156.67.159.142
May 14, 2022 04:31:42.419929028 CEST	65442	23	192.168.2.23	162.58.175.53
May 14, 2022 04:31:42.419941902 CEST	65442	23	192.168.2.23	91.209.199.175
May 14, 2022 04:31:42.419950008 CEST	65442	23	192.168.2.23	128.1.51.63
May 14, 2022 04:31:42.419954062 CEST	65442	23	192.168.2.23	62.128.207.203
May 14, 2022 04:31:42.419955015 CEST	65442	23	192.168.2.23	207.21.144.165
May 14, 2022 04:31:42.419966936 CEST	65442	23	192.168.2.23	13.193.175.91
May 14, 2022 04:31:42.419974089 CEST	65442	23	192.168.2.23	242.94.113.8
May 14, 2022 04:31:42.419976950 CEST	65442	23	192.168.2.23	172.125.179.188
May 14, 2022 04:31:42.419986010 CEST	65442	23	192.168.2.23	160.200.219.109
May 14, 2022 04:31:42.419996977 CEST	65442	23	192.168.2.23	66.105.57.76
May 14, 2022 04:31:42.419998884 CEST	65442	23	192.168.2.23	210.123.47.121
May 14, 2022 04:31:42.420013905 CEST	65442	23	192.168.2.23	118.192.66.18
May 14, 2022 04:31:42.420022011 CEST	65442	23	192.168.2.23	23.27.73.7
May 14, 2022 04:31:42.420025110 CEST	65442	23	192.168.2.23	197.215.148.177
May 14, 2022 04:31:42.420032978 CEST	65442	23	192.168.2.23	152.155.22.40
May 14, 2022 04:31:42.420039892 CEST	65442	23	192.168.2.23	190.123.221.187
May 14, 2022 04:31:42.420042038 CEST	65442	23	192.168.2.23	174.117.211.69
May 14, 2022 04:31:42.420058966 CEST	65442	23	192.168.2.23	160.80.205.14
May 14, 2022 04:31:42.420061111 CEST	65442	23	192.168.2.23	203.240.57.218
May 14, 2022 04:31:42.420066118 CEST	65442	23	192.168.2.23	138.254.140.64
May 14, 2022 04:31:42.420077085 CEST	65442	23	192.168.2.23	210.19.137.5
May 14, 2022 04:31:42.420084000 CEST	65442	23	192.168.2.23	133.80.235.121
May 14, 2022 04:31:42.420094967 CEST	65442	23	192.168.2.23	136.139.0.68
May 14, 2022 04:31:42.420105934 CEST	65442	23	192.168.2.23	123.135.115.187
May 14, 2022 04:31:42.420109034 CEST	65442	23	192.168.2.23	190.110.52.31
May 14, 2022 04:31:42.420141935 CEST	65442	23	192.168.2.23	209.30.172.95
May 14, 2022 04:31:42.420175076 CEST	65442	23	192.168.2.23	187.221.133.246
May 14, 2022 04:31:42.420187950 CEST	65442	23	192.168.2.23	87.69.121.30
May 14, 2022 04:31:42.420238972 CEST	65442	23	192.168.2.23	145.57.166.148
May 14, 2022 04:31:42.420249939 CEST	65442	23	192.168.2.23	24.217.90.24
May 14, 2022 04:31:42.420250893 CEST	65442	23	192.168.2.23	92.116.81.211
May 14, 2022 04:31:42.420250893 CEST	65442	23	192.168.2.23	252.91.224.207
May 14, 2022 04:31:42.420254946 CEST	65442	23	192.168.2.23	23.182.46.40
May 14, 2022 04:31:42.420259953 CEST	65442	23	192.168.2.23	209.14.137.153
May 14, 2022 04:31:42.420264959 CEST	65442	23	192.168.2.23	34.214.13.34
May 14, 2022 04:31:42.420322895 CEST	65442	23	192.168.2.23	171.33.98.247
May 14, 2022 04:31:42.420325041 CEST	65442	23	192.168.2.23	13.153.210.248
May 14, 2022 04:31:42.420336962 CEST	65442	23	192.168.2.23	17.143.55.231
May 14, 2022 04:31:42.420347929 CEST	65442	23	192.168.2.23	158.119.197.103
May 14, 2022 04:31:42.420347929 CEST	65442	23	192.168.2.23	194.18.60.221
May 14, 2022 04:31:42.420350075 CEST	65442	23	192.168.2.23	70.30.234.181
May 14, 2022 04:31:42.420351028 CEST	65442	23	192.168.2.23	154.163.157.53
May 14, 2022 04:31:42.420351028 CEST	65442	23	192.168.2.23	53.179.20.228
May 14, 2022 04:31:42.420358896 CEST	65442	23	192.168.2.23	167.255.126.235
May 14, 2022 04:31:42.420370102 CEST	65442	23	192.168.2.23	126.189.149.40
May 14, 2022 04:31:42.420376062 CEST	65442	23	192.168.2.23	221.250.101.27
May 14, 2022 04:31:42.420387030 CEST	65442	23	192.168.2.23	154.50.159.209
May 14, 2022 04:31:42.420401096 CEST	65442	23	192.168.2.23	16.70.221.213
May 14, 2022 04:31:42.420402050 CEST	65442	23	192.168.2.23	141.47.225.111
May 14, 2022 04:31:42.420402050 CEST	65442	23	192.168.2.23	130.213.220.68
May 14, 2022 04:31:42.420413971 CEST	65442	23	192.168.2.23	53.136.2.206
May 14, 2022 04:31:42.420418978 CEST	65442	23	192.168.2.23	188.20.235.80
May 14, 2022 04:31:42.420433998 CEST	65442	23	192.168.2.23	102.186.58.117

System Behavior

Analysis Process: sora.arm PID: 6226, Parent PID: 6123

General

Start time:	04:31:41
Start date:	14/05/2022
Path:	/tmp/sora.arm
Arguments:	/tmp/sora.arm
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: sora.arm PID: 6228, Parent PID: 6226

General

Start time:	04:31:41
Start date:	14/05/2022
Path:	/tmp/sora.arm
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: sora.arm PID: 6326, Parent PID: 6228

General

Start time:	04:34:32
Start date:	14/05/2022
Path:	/tmp/sora.arm
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: sora.arm PID: 6330, Parent PID: 6228

General

Start time:	04:34:32
Start date:	14/05/2022
Path:	/tmp/sora.arm
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: sora.arm PID: 6333, Parent PID: 6330

General

Start time:	04:34:32
Start date:	14/05/2022
Path:	/tmp/sora.arm
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: sora.arm PID: 6344, Parent PID: 6333

General

Start time:	04:34:37
Start date:	14/05/2022
Path:	/tmp/sora.arm
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: sora.arm PID: 6346, Parent PID: 6333

General

Start time:	04:34:37
Start date:	14/05/2022
Path:	/tmp/sora.arm
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: sora.arm PID: 6335, Parent PID: 6330

General

Start time:	04:34:32
Start date:	14/05/2022
Path:	/tmp/sora.arm
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: sora.arm PID: 6336, Parent PID: 6330

General

Start time:	04:34:32
Start date:	14/05/2022
Path:	/tmp/sora.arm
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: sora.arm PID: 6230, Parent PID: 6226

General

Start time:	04:31:41
Start date:	14/05/2022
Path:	/tmp/sora.arm
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: sora.arm PID: 6231, Parent PID: 6226

General

Start time:	04:31:41
Start date:	14/05/2022
Path:	/tmp/sora.arm
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: sora.arm PID: 6234, Parent PID: 6231

General

Start time:	04:31:41
Start date:	14/05/2022
Path:	/tmp/sora.arm
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: sora.arm PID: 6325, Parent PID: 6234

General

Start time:	04:34:32
Start date:	14/05/2022
Path:	/tmp/sora.arm
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: sora.arm PID: 6328, Parent PID: 6234

General

Start time:	04:34:32
Start date:	14/05/2022
Path:	/tmp/sora.arm
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: sora.arm PID: 6235, Parent PID: 6231

General

Start time:	04:31:41
Start date:	14/05/2022
Path:	/tmp/sora.arm
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: sora.arm PID: 6237, Parent PID: 6231

General

Start time:	04:31:41
Start date:	14/05/2022
Path:	/tmp/sora.arm
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report sora.arm

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

PCAP (Network Traffic)

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: sora.arm PID: 6226, Parent PID: 6123

General

Analysis Process: sora.arm PID: 6228, Parent PID: 6226

General

Analysis Process: sora.arm PID: 6326, Parent PID: 6228

General

Analysis Process: sora.arm PID: 6330, Parent PID: 6228

General

Analysis Process: sora.arm PID: 6333, Parent PID: 6330

General

Analysis Process: sora.arm PID: 6344, Parent PID: 6333

General

Analysis Process: sora.arm PID: 6346, Parent PID: 6333

General

Analysis Process: sora.arm PID: 6335, Parent PID: 6330

General

Analysis Process: sora.arm PID: 6336, Parent PID: 6330

General

Analysis Process: sora.arm PID: 6230, Parent PID: 6226

General

Analysis Process: sora.arm PID: 6231, Parent PID: 6226

Linux Analysis Report
sora.arm