Extracted

• • Target

    4307f6183996648a699e8ceb71427c0aeb6cbc9b054344022578659e7bd89f6c

  • Size

    535KB

  • MD5

    e2fb88db7d32254572010baad88f8bfb

  • SHA1

    6cbbe3ea21235b74584da8af51abd19dd26e3598

  • SHA256

    4307f6183996648a699e8ceb71427c0aeb6cbc9b054344022578659e7bd89f6c

  • SHA512

    ac4089b9fe3e84e7c1fb4c10a8be26e7ddded4ffcc5f793a38c622c6bb1c81bc6165f9a4e4c0801f891fd59725e8557295593ebf6783e4b01e78657a477653db

  Score

  10^/10

  persistencesuricata

  • suricata: ET MALWARE DDoS.XOR Checkin

    suricata: ET MALWARE DDoS.XOR Checkin

    suricata

  • suricata: ET MALWARE Likely Linux/Xorddos.F DDoS Attack Participation (aa.hostasa.org)

    suricata: ET MALWARE Likely Linux/Xorddos.F DDoS Attack Participation (aa.hostasa.org)

    suricata

  • Writes file to system bin folder

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence

  • Modifies rc script

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence

  • Write file to user bin folder

  • Reads runtime system information

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory

    Malware often drops required files in the /tmp directory.

  behavioral1