Extracted

• • Target
    3b830b34e47fe9ed33a2b8c3c5ca90602819927330a47806bb749f23f04c5437
  • Size 611KB
  • SHA256 3b830b34e47fe9ed33a2b8c3c5ca90602819927330a47806bb749f23f04c5437
  • MD5 1c0d11325276488a3506632a997f7625
  • SHA1 30ced396120f6b1a33826e35f898290e423b98ed
  • SHA512 c14eb28e075fe981047d28b06ea20b487e99ebf51480f777324605a6d78ca32bca26400742c368e3abf15c1b0ab73bf00b3c4b9fcbee5e673751758051022571
  • MD5 SHA1 SHA512

  Score

  10^/10

  persistencesuricata

  • suricata: ET MALWARE DDoS.XOR Checkin

    suricata: ET MALWARE DDoS.XOR Checkin

    suricata

  • Writes file to system bin folder

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence

  • Modifies rc script

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence

  • Write file to user bin folder

  • Reads runtime system information

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory

    Malware often drops required files in the /tmp directory.

  behavioral1