Extracted

• • Target

    nklx86.elf

  • Size

    44KB

  • MD5

    b86fcff19aa2eb96af0022fe7c82ae11

  • SHA1

    f89a5e4d9a2be46a1a4a480fc07a1cc2d90e8701

  • SHA256

    28258ec6651cd368d10a1ad7798ffa7347d12316387c05194f7937ee4e2c40a8

  • SHA512

    d8be78539b34b6fab9b75ef8c0e128b6cc7844856783e5b816ad91bdd1acdc5233cda8cbf354454205b1fa2c4640a916edc1fbf1d1620dc0ca781872441c87cc

  • SSDEEP

    768:c4ZMC05W0RIWPIfWWYrREwZXt+k6ck8qXs4xhQ8Xeun/e8g:c4ZMC05W0RIWQ/YrREKURhxtXeu/e8

  Score

  9^/10

  discoveryrootkit

  • Contacts a large (183487) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Loads a kernel module

    Loads a Linux kernel module, potentially to achieve persistence

    rootkit

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  behavioral1