Extracted

• • Target
    f0d1d8b331bc00bc941f7e3a63b45c744d59d35e20c40d6b92e4cc74517e7e3b
  • Size 596KB
  • SHA256 f0d1d8b331bc00bc941f7e3a63b45c744d59d35e20c40d6b92e4cc74517e7e3b
  • MD5 2c14ea1226a99955301402e9e8e62f21
  • SHA1 c0738dd90a7b094bf224e1bc0457293cd836f63e
  • SHA512 bbb41842771d2c11690219084d295b74fe98dadfe0feee1aa0939a84caaf382d25009ed6668985ac852dbdaf3317c5361de4eff8c15ba16c575cdf07227da1a6
  • MD5 SHA1 SHA512

  Score

  9^/10

  persistence

  • Writes file to system bin folder

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence

  • Modifies rc script

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence

  • Write file to user bin folder

  • Reads runtime system information

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory

    Malware often drops required files in the /tmp directory.

  behavioral1