Extracted

• • Target

    Hilix.mips.elf

  • Size

    118KB

  • MD5

    0499b1559073a3eb9cf690c1316f47d8

  • SHA1

    57ebb8b0d5794569cdd25009a77b575e21d20423

  • SHA256

    0a817038e6aafc2f37501bc81bc5adfd0b843985d31123f5eaf53080c1d362ff

  • SHA512

    3b23b472368d7d32902098b10b57c48c71b73239b439d3fc7968954b629f476373b66629691352b4e58f905bd3545abdaae0ddcf0cac1b383a52fb97210d0cca

  • SSDEEP

    1536:49cndLoEbYk9e/kFl/gh3GaKt6nDuEBj8V60R0DEewO1R94fITqB/1MDpIEQ:49mLpEkU/3l26nrBe60e71D4TBm9Q

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (313787) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  behavioral1