Extracted

• • Target
    4235a1cc672e7107e15c796dde98ce62d965ecf90f390c08db5b2d0cc4d100d2
  • Size 611KB
  • SHA256 4235a1cc672e7107e15c796dde98ce62d965ecf90f390c08db5b2d0cc4d100d2
  • MD5 46dce1e4a92eaab92b79ddae319c011a
  • SHA1 2ad5643c3b1ec27e89c934a94df1c0e10d7c13d0
  • SHA512 b9d5efafeb61e79e788502821ba97f96a2b843f4b8c6d237135bb63c82efd1ebade8294d1f0cb6830b338f500ac1ef9b8cc6518fe3030f5905fab31378213015
  • MD5 SHA1 SHA512

  Score

  10^/10

  persistencesuricata

  • suricata: ET MALWARE DDoS.XOR Checkin

    suricata: ET MALWARE DDoS.XOR Checkin

    suricata

  • Writes file to system bin folder

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Modifies rc script

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence

  • Write file to user bin folder

  • Reads runtime system information

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory

    Malware often drops required files in the /tmp directory.

  behavioral1