Extracted

• • Target

    Hilix.mpsl.elf

  • Size

    78KB

  • MD5

    2da89f94f16a8c234cba9691534dcbbf

  • SHA1

    c7276f208f5cb14e989028b2922b1f630a5f7616

  • SHA256

    f3ac60a83004f943f1f8e9fdc4300e39755cab155f826c4852eedbb1abe17753

  • SHA512

    a670cd76432afe0558c8d78dc5d004e860903360b6e06a70a66a83aee56afa6fe925d149e5e2bcc090078e2a616672a793b32e0f17dc894791e985568f318c46

  • SSDEEP

    1536:aqJw3YsMzgJzUflVYbBSsZjZyDZXxhaGACUzD:aqJesMJzUPEyDUD

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (454601) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  behavioral1