Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

Hilix.arm

ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped

initial sample

Details

Filetype:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
Entropy:	6.095639721571195
Filename:	Hilix.arm
Filesize:	62456
MD5:	9653f94dca32a23046c21ffeea172dd6
SHA1:	a7037a2353ddf06c10144563b077c906b92ebbfa
SHA256:	dcd35159cd640f9b66aad91d5dc7d1e81fffd2478c1e44e0f3184db70285040f
SHA512:	eee662344819192c92fbc4fd428442c7702055a1f9eaa44edac679ba861d3062bd4297605038e87efa32897be286ce460daca7defcd911e5f225bef917ecdd6e
SSDEEP:	1536:UyW869O3GXz/z8a5OI2s/9M53e53mc0PKwl5p/a+53m:Uyx6EK3wRs/+5ORmhCwl5Ml
Preview:	.ELF...a..........(.........4...h.......4. ...(.....................................................(...............Q.td..................................-...L."....6..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Sample tries to kill many processes (SIGKILL)	System Summary
Uses the "uname" system call to query kernel version information (possible evasion)	Malware Analysis System Evasion
Enumerates processes within the "proc" file system	Persistence and Installation Behavior	OS Credential Dumping
Sample listens on a socket	Networking
Sample tries to kill a process (SIGKILL)	System Summary
Found detection on Joe Sandbox Cloud Basic with higher score	System Summary
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
URLs found in memory or binary data	Networking

/proc/5290/oom_score_adj

ASCII text

dropped

Details

File:	/proc/5290/oom_score_adj
Category:	dropped
Dump:	oom_score_adj.22.dr
ID:	dr_0
Target ID:	22
Process:	/usr/sbin/sshd
Type:	ASCII text
Entropy:	1.7924812503605778
Encrypted:	false
Ssdeep:	3:ptn:Dn
Size:	6
Whitelisted:	false
Reputation:	high

/proc/5405/oom_score_adj

ASCII text

dropped

Details

File:	/proc/5405/oom_score_adj
Category:	dropped
Dump:	oom_score_adj.28.dr
ID:	dr_2
Target ID:	28
Process:	/usr/sbin/sshd
Type:	ASCII text
Entropy:	1.7924812503605778
Encrypted:	false
Ssdeep:	3:ptn:Dn
Size:	6
Whitelisted:	false
Reputation:	high

/proc/5409/oom_score_adj

ASCII text

dropped

Details

File:	/proc/5409/oom_score_adj
Category:	dropped
Dump:	oom_score_adj.32.dr
ID:	dr_4
Target ID:	32
Process:	/usr/sbin/sshd
Type:	ASCII text
Entropy:	1.7924812503605778
Encrypted:	false
Ssdeep:	3:ptn:Dn
Size:	6
Whitelisted:	false
Reputation:	high

/run/sshd.pid

ASCII text

dropped

Details

File:	/run/sshd.pid
Category:	dropped
Dump:	sshd.pid.32.dr
ID:	dr_5
Target ID:	32
Process:	/usr/sbin/sshd
Type:	ASCII text
Entropy:	2.321928094887362
Encrypted:	false
Ssdeep:	3:E2v:EI
Size:	5
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

/tmp/Hilix.arm

n/a

/tmp/Hilix.arm

n/a

/tmp/Hilix.arm

n/a

/tmp/Hilix.arm

n/a

/tmp/Hilix.arm

n/a

/tmp/Hilix.arm

n/a

/tmp/Hilix.arm

n/a

/tmp/Hilix.arm

n/a

/usr/lib/systemd/systemd

n/a

/usr/sbin/sshd

/usr/sbin/sshd -t

/usr/lib/systemd/systemd

n/a

/usr/sbin/sshd

/usr/sbin/sshd -D

/usr/lib/systemd/systemd

n/a

/usr/sbin/sshd

/usr/sbin/sshd -t

/usr/lib/systemd/systemd

n/a

/usr/sbin/sshd

/usr/sbin/sshd -D

/usr/lib/systemd/systemd

n/a

/usr/sbin/sshd

/usr/sbin/sshd -t

/usr/lib/systemd/systemd

n/a

/usr/sbin/sshd

/usr/sbin/sshd -D

There are 11 hidden processes, click here to show them.

URLs

Name

Malicious

http://127.0.0.1:52869/picdesc.xml

91.78.98.43

Details

Name:	http://127.0.0.1:52869/picdesc.xml
IP:	91.78.98.43
TargetID:	-1
From Memory:	false
Source:	network

Signature Hits	Behavior Group	Mitre Attack
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)	Networking

http://37.0.9.202/bins/Hilix.mips

unknown

Details

Name:	http://37.0.9.202/bins/Hilix.mips
TargetID:	21060
From Memory:	true
Source:	Hilix.arm, 5244.1.00000000faa5f514.000000004dd08095.r-x.sdmp

Signature Hits	Behavior Group	Mitre Attack
Antivirus detection for URL or domain	AV Detection
Multi AV Scanner detection for domain / URL	AV Detection
Posts data to webserver	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

http://127.0.0.1:52869/wanipcn.xml

91.78.98.43

Details

Name:	http://127.0.0.1:52869/wanipcn.xml
IP:	91.78.98.43
TargetID:	-1
From Memory:	false
Source:	network

Signature Hits	Behavior Group	Mitre Attack
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)	Networking

http://schemas.xmlsoap.org/soap/encoding/

unknown

Details

Name:	http://schemas.xmlsoap.org/soap/encoding/
TargetID:	21060
From Memory:	true
Source:	Hilix.arm, 5244.1.00000000faa5f514.000000004dd08095.r-x.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
HTTP GET or POST without a user agent	Networking
Posts data to webserver	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

http://schemas.xmlsoap.org/soap/envelope/

unknown

Details

Name:	http://schemas.xmlsoap.org/soap/envelope/
TargetID:	21060
From Memory:	true
Source:	Hilix.arm, 5244.1.00000000faa5f514.000000004dd08095.r-x.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
HTTP GET or POST without a user agent	Networking
Posts data to webserver	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

45.104.67.34

unknown

Egypt

185.119.218.5

unknown

Czech Republic

91.52.65.178

unknown

Germany

45.128.22.52

unknown

Denmark

219.56.220.39

unknown

Japan

156.49.160.17

unknown

Sweden

17.30.215.164

unknown

United States

156.254.70.171

unknown

Seychelles

38.206.46.24

unknown

United States

91.19.165.50

unknown

Germany

91.75.212.117

unknown

United Arab Emirates

91.120.152.33

unknown

Hungary

90.70.5.162

unknown

France

141.150.163.18

unknown

United States

95.156.176.206

unknown

Bosnia and Herzegowina

185.106.143.34

unknown

Serbia

38.181.75.64

unknown

United States

91.30.56.29

unknown

Germany

91.54.122.242

unknown

Germany

45.206.28.0

unknown

Seychelles

59.1.188.143

unknown

Korea Republic of

77.110.64.247

unknown

Lebanon

45.9.143.74

unknown

Russian Federation

45.18.215.62

unknown

United States

185.75.12.212

unknown

Spain

91.74.73.94

unknown

United Arab Emirates

185.38.220.169

unknown

Poland

185.23.188.242

unknown

France

45.63.53.230

unknown

United States

45.237.157.87

unknown

Brazil

185.35.202.71

unknown

Norway

185.169.213.42

unknown

Germany

79.103.170.140

unknown

Greece

176.196.62.156

unknown

Russian Federation

194.28.179.238

unknown

Ukraine

45.185.140.128

unknown

Brazil

185.149.161.42

unknown

Russian Federation

142.166.65.28

unknown

Canada

189.172.103.25

unknown

Mexico

59.27.2.25

unknown

Korea Republic of

45.50.54.63

unknown

United States

185.19.109.133

unknown

United Kingdom

190.94.7.150

unknown

Dominican Republic

41.239.218.36

unknown

Egypt

89.67.99.56

unknown

Poland

45.199.228.211

unknown

Seychelles

45.126.216.220

unknown

Hong Kong

99.56.5.185

unknown

United States

197.164.175.168

unknown

Egypt

45.9.143.98

unknown

Russian Federation

45.52.96.195

unknown

United States

185.124.199.108

unknown

Germany

41.17.0.118

unknown

South Africa

173.70.19.34

unknown

United States

185.15.150.55

unknown

Spain

45.55.195.228

unknown

United States

185.187.222.120

unknown

Italy

154.82.151.120

unknown

Seychelles

17.112.167.99

unknown

United States

2.41.35.61

unknown

Italy

91.13.61.237

unknown

Germany

194.253.157.141

unknown

European Union

113.51.241.67

unknown

China

173.184.189.173

unknown

United States

185.192.230.56

unknown

United Kingdom

156.158.248.174

unknown

Tanzania United Republic of

41.45.223.165

unknown

Egypt

36.118.160.38

unknown

China

41.17.127.1

unknown

South Africa

5.218.125.60

unknown

Iran (ISLAMIC Republic Of)

45.145.30.193

unknown

Turkey

90.255.143.236

unknown

United Kingdom

45.1.177.234

unknown

United States

53.82.186.160

unknown

Germany

143.10.148.65

unknown

United States

59.218.207.68

unknown

China

222.202.165.36

unknown

China

91.90.138.39

unknown

Israel

197.173.155.25

unknown

South Africa

68.97.175.155

unknown

United States

37.155.189.38

unknown

Turkey

45.197.137.128

unknown

Seychelles

96.151.55.151

unknown

United States

91.74.182.121

unknown

United Arab Emirates

91.60.221.230

unknown

Germany

91.235.70.182

unknown

Ukraine

91.5.97.3

unknown

Germany

57.159.196.85

unknown

Belgium

45.18.240.22

unknown

United States

41.77.181.171

unknown

Algeria

45.122.192.3

unknown

China

91.67.33.158

unknown

Germany

179.77.43.231

unknown

Brazil

173.12.201.233

unknown

United States

45.130.62.123

unknown

Israel

185.21.99.54

unknown

Austria

185.70.118.221

unknown

Italy

41.80.99.57

unknown

Kenya

45.242.108.39

unknown

Egypt

91.18.128.111

unknown

Germany

There are 90 hidden IPs, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report

Files

Processes

URLs

IPs