Extracted

• • Target
    e032afa6df636c08f476e91608f6c2ce724cbe713120cd156712f3001662f1e0
  • Size 535KB
  • SHA256 e032afa6df636c08f476e91608f6c2ce724cbe713120cd156712f3001662f1e0
  • MD5 1d2c4994ebf1fe67dcfca736cc6e51b7
  • SHA1 f39dab0b4faa4da71383f1e2e2eef9c0fc46e7de
  • SHA512 983da01351bcf25746ab63763697a3ced33e35ba360942842526e1bf58eed75cbe84d9f5e28662464f6b742c90c680d87df45ff2fd8d65fd770bee35eb6110f1
  • MD5 SHA1 SHA512

  Score

  10^/10

  discoverypersistencesuricata

  • suricata: ET MALWARE DDoS.XOR Checkin

    suricata: ET MALWARE DDoS.XOR Checkin

    suricata

  • suricata: ET MALWARE Likely Linux/Xorddos.F DDoS Attack Participation (aa.hostasa.org)

    suricata: ET MALWARE Likely Linux/Xorddos.F DDoS Attack Participation (aa.hostasa.org)

    suricata

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Writes file to system bin folder

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence

  • Modifies rc script

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence

  • Write file to user bin folder

  • Reads runtime system information

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory

    Malware often drops required files in the /tmp directory.

  behavioral1