Extracted

• • Target

    678b6a591939e73648082897170b62e711a4b0f0b0dbab5fb1dce1a347c166ba

  • Size

    611KB

  • MD5

    42074955ac089af53b6505d47e59ce14

  • SHA1

    77a71bdb943af64c9b2b8e6dbb39e0fc4d0231e2

  • SHA256

    678b6a591939e73648082897170b62e711a4b0f0b0dbab5fb1dce1a347c166ba

  • SHA512

    2431f327cfdfce133d14a98919f04560f6f366c5ef2d645b9fcbc0cb15ac667cb51d2915210efc89694555b77077acfc71640cf05dad45e328dca5077c3bb4c9

  Score

  10^/10

  persistencesuricata

  • suricata: ET MALWARE DDoS.XOR Checkin

    suricata: ET MALWARE DDoS.XOR Checkin

    suricata

  • suricata: ET MALWARE DDoS.XOR Checkin via HTTP

    suricata: ET MALWARE DDoS.XOR Checkin via HTTP

    suricata

  • Writes file to system bin folder

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence

  • Modifies rc script

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence

  • Write file to user bin folder

  • Reads runtime system information

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory

    Malware often drops required files in the /tmp directory.

  behavioral1