Extracted

• • Target

    Hilix.mpsl.elf

  • Size

    120KB

  • MD5

    8f1a8e180eb2f262e934fbccab0f30d0

  • SHA1

    44dd6484fcb1fbbec6fd644b527caaf4607a3cb4

  • SHA256

    21a08c254876b02d97fda71a5039d8d224c009f6e98eeeff6655ca0f9ac590d8

  • SHA512

    5df18cedf4a305c72bd6ce19fc1c9ed354001e56558e5d639ac7da511a92a8d1c513782c911bdb5439913afd415513ade8dbd90b6e8dcb25ae8d36c926fc7d70

  • SSDEEP

    1536:hlxlDLoF1fvWlum3RkYwCANQLTNDkwfKExqfXsDN+1rITqPYzr6EQ:hlxlvoF1fulu2RS0ef8DNAfUDQ

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (180572) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1