Extracted

• • Target
    10a111f2f7a072899bbd6f989659538a80552fe4bc07f5399edd4fe37bdba15b
  • Size 535KB
  • SHA256 10a111f2f7a072899bbd6f989659538a80552fe4bc07f5399edd4fe37bdba15b
  • MD5 c8ed653f9497063a9dc5b2b541b5d3ff
  • SHA1 d8ec37fe1d2f8b8015fe7a73b2131480dbe9ac24
  • SHA512 ddaf6c48a72b0f1e1f4fe8883ded40523ef0de422cb23d243fd448467711d904ecf0f10609b79dbc04ecb123e6299e27c9ed1cb5a897fa0573a00581da8f8ad8
  • MD5 SHA1 SHA512

  Score

  10^/10

  persistencesuricata

  • suricata: ET MALWARE DDoS.XOR Checkin

    suricata: ET MALWARE DDoS.XOR Checkin

    suricata

  • suricata: ET MALWARE Likely Linux/Xorddos.F DDoS Attack Participation (aa.hostasa.org)

    suricata: ET MALWARE Likely Linux/Xorddos.F DDoS Attack Participation (aa.hostasa.org)

    suricata

  • Writes file to system bin folder

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence

  • Modifies rc script

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence

  • Write file to user bin folder

  • Reads runtime system information

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory

    Malware often drops required files in the /tmp directory.

  behavioral1