Extracted

• • Target

    Hilix.x86.elf

  • Size

    52KB

  • MD5

    2749d7293c6f90673309d9e75396c750

  • SHA1

    ff10e43ea2f7e951fb8e3aa3dc62f012f74217ca

  • SHA256

    f17cfd0b79debb63fc16522833b3fdd72ff5f6c2c7e2c932a8940e8115dd40f5

  • SHA512

    7c400dce85c9ecbb8ad0c48982215e26b80d85cc8a267c1a4be8e2163d2cf9d8f302420f692081e856b3ac19a3acfb5a6674ed2a1a6b783789026b5e87a2519f

  • SSDEEP

    1536:u8OP6OftfvJfrJf0hJeVVMlrZ778tjGIxhBYcPnYvPGGgv7U:/OfVxfrJfAJ2Vg1UtjGIxhBRnYvuP

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (326625) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1