Extracted

• • Target

    3064fd7b352acb87d8e201799fe72cb5a41ce66eebb2562245b74c5db74152f3

  • Size

    611KB

  • MD5

    4a15b3a3f78a6013afcf925f13489a57

  • SHA1

    08a2e8c4d1bfb4e0bde346e47911b96d474b49bf

  • SHA256

    3064fd7b352acb87d8e201799fe72cb5a41ce66eebb2562245b74c5db74152f3

  • SHA512

    9f58dc915ee899f28d93ae47c06fef34bbee9b0559eb2c16b8f63a85134b120a0bcf61c66e09171d07027209bb2cf3974560fd5d81ca25264cb3661b27142ee8

  Score

  10^/10

  persistencesuricata

  • suricata: ET MALWARE DDoS.XOR Checkin

    suricata: ET MALWARE DDoS.XOR Checkin

    suricata

  • suricata: ET MALWARE DDoS.XOR Checkin via HTTP

    suricata: ET MALWARE DDoS.XOR Checkin via HTTP

    suricata

  • Writes file to system bin folder

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence

  • Modifies rc script

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Write file to user bin folder

  • Reads runtime system information

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory

    Malware often drops required files in the /tmp directory.

  behavioral1