Extracted

• • Target

    51a3558ccba777337e5e10d96c4774ca2cefdfe9af86b99081d1b96db31c7a76

  • Size

    611KB

  • MD5

    5cfcec836e7a1bfd0cc2414b1d09f109

  • SHA1

    b170e940758582abb6efba25bc4234e734a16c95

  • SHA256

    51a3558ccba777337e5e10d96c4774ca2cefdfe9af86b99081d1b96db31c7a76

  • SHA512

    36d1cef9709a29cb25abe003b91f0443a9c28ae1e09c592de5e6f24ec821022883e756af75068da10f896e314c15b063660a8b4678407593828c46f797d6f7e8

  Score

  10^/10

  persistencesuricata

  • suricata: ET MALWARE DDoS.XOR Checkin

    suricata: ET MALWARE DDoS.XOR Checkin

    suricata

  • suricata: ET MALWARE DDoS.XOR Checkin via HTTP

    suricata: ET MALWARE DDoS.XOR Checkin via HTTP

    suricata

  • Writes file to system bin folder

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence

  • Modifies rc script

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Write file to user bin folder

  • Reads runtime system information

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory

    Malware often drops required files in the /tmp directory.

  behavioral1