Extracted

• • Target

    5d013d8f8f12a88ed93079214b6dd6f552a94939cc96cac5bd07344acd6df146

  • Size

    611KB

  • MD5

    534b0f37c748f8becec065e54c308e6e

  • SHA1

    21f715087d0d959c0fb62851a85e32ff0a6d4f93

  • SHA256

    5d013d8f8f12a88ed93079214b6dd6f552a94939cc96cac5bd07344acd6df146

  • SHA512

    da2024455da4e8d8a73b9e51db030ff8493708127776611f8463046571d28690bb0718f7cb9b0d419b5ffe6f9c948abd21c4a54e692c950e7fbb1b0f47396126

  Score

  10^/10

  persistencesuricata

  • suricata: ET MALWARE DDoS.XOR Checkin

    suricata: ET MALWARE DDoS.XOR Checkin

    suricata

  • Writes file to system bin folder

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence

  • Modifies rc script

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence

  • Write file to user bin folder

  • Reads runtime system information

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory

    Malware often drops required files in the /tmp directory.

  behavioral1