Extracted

• • Target

    75694a4057d255c4305c9d53e46bb2cbda0adcb26c525b5f184a4f0710d52585

  • Size

    611KB

  • MD5

    59b68b7af8cce8c7b3783f9253154b6b

  • SHA1

    d35a2bf4a80d0f1d908f876c70b9f21f90f24f78

  • SHA256

    75694a4057d255c4305c9d53e46bb2cbda0adcb26c525b5f184a4f0710d52585

  • SHA512

    689be2bce9ea42e3c0e93c33069abfbf857655a9d5bd734b7d899395bbd168515fd413b9870a5a7170d10753ac29c4ccc84c07a7c315832b476824b64bcee34d

  Score

  10^/10

  persistencesuricata

  • suricata: ET MALWARE DDoS.XOR Checkin

    suricata: ET MALWARE DDoS.XOR Checkin

    suricata

  • Writes file to system bin folder

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence

  • Modifies rc script

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence

  • Write file to user bin folder

  • Reads runtime system information

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory

    Malware often drops required files in the /tmp directory.

  behavioral1