Extracted

• • Target
    Hilix.x86
  • Size 52KB
  • SHA256 582d3b1ae44863bd9d19005c05e50aceb2162439c9bc3066ce59c4df89f39683
  • MD5 e7b5fed8049e2f631770fcda6281e3e6
  • SHA1 9b9a17aadff3d46736b172bece9d260202c4f2c5
  • SHA512 04ab64a2889bb79ba98b6a31a7f6f4a55adddceec27c64449eb3df82c4fd58f231f04a8519f85672a88013e58c6020c71dba54282535686e5e0a64f8bd4d5bb2
  • SSDEEP 1536:u8OP6OftfvJfrJf0hJeVVMlrZ778tjGIxhBYcPnYvPGGgvSU:/OfVxfrJfAJ2Vg1UtjGIxhBRnYvuP
  • TLSH
    T10A333BC5A743DEF1ED1207B53077EB338B76E47A206AF9C7E3D5A527A841A01920329D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  defense_evasiondiscovery

  • Contacts a large (375761) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

    discovery

  • Enumerates running processes

    Discovers information about currently running processes on the system

  behavioral1