Creates/modifies Cron job

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

Modifies rc script

Adding/modifying system rc scripts is a common persistence mechanism.

Unexpected DNS network traffic destination

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Write file to user bin folder

Reads runtime system information

Reads data from /proc virtual filesystem.

Writes file to tmp directory

Malware often drops required files in the /tmp directory.