Extracted

• • Target

    Hilix.mips.elf

  • Size

    75KB

  • MD5

    c5ac66527e3fd9e5c9c55163f889929c

  • SHA1

    f08d582d98bbe284f891e4a56b0f84e1e0b8cf45

  • SHA256

    24837881c5f0661e5f248f5d7b6e4f92b48f1ca54cd267855a78d7335adf8cb5

  • SHA512

    edd2ac9809fb84325122d2d30b7979190bfb19d6fb8980075ba7d6652509ba3e5b6859fb72119aed263bde4017621408dc3fad4cae1af95db93249da6684f558

  • SSDEEP

    1536:DVNTbO/1DFTxp3iFJncDG0ux7ohykALOpfAhcnJf8b5TS+:DV9byz3ibcDG0ux7oh+6fAhIJ0g+

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (180605) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1