Extracted

• • Target

    Hilix.mips.elf

  • Size

    75KB

  • MD5

    dd307c473227b29f08eca8dd1807339f

  • SHA1

    a61c1ca4701ccc2ad616d2c6f7f0426201088fb7

  • SHA256

    76d92c57b9f5973608133c5f13e71e4756cfb47663d3b8bc7b2dd23ebac76284

  • SHA512

    d75431f47d4d5e5ad05e95a0fbb8f4f5ccb8d1eacbcd4031191f546c0442202bcfb654bf8eaea8945f6cbcbf97e2545fb7c55de28bf180b6559031f871308a96

  • SSDEEP

    1536:pVNzbOfVDFzxJXilJHbj90OproByEALurtTgF8S1z3bwUz1:pVdbSTXibbj90OproBeEtTgFl1z71

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (350612) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  behavioral1