Extracted

• • Target

    57a8760d34df8bbd38b983aa98499896e1b6f6960d6fd959e02ea6aebe656fb5

  • Size

    611KB

  • MD5

    a0695d2cc9967a15170e12302041686d

  • SHA1

    1b87ed917efe5500b7f7bce7c93987ea7f442528

  • SHA256

    57a8760d34df8bbd38b983aa98499896e1b6f6960d6fd959e02ea6aebe656fb5

  • SHA512

    ea5911876382898f8bb47cb7e4e91a85adfe3469e69d939d1ce48b98e53d45c646638ae5b86995ecff6adb4e302c3ddc57e76554073a2472cb6894764738f6a2

  Score

  10^/10

  persistencesuricata

  • suricata: ET MALWARE DDoS.XOR Checkin

    suricata: ET MALWARE DDoS.XOR Checkin

    suricata

  • suricata: ET MALWARE DDoS.XOR Checkin via HTTP

    suricata: ET MALWARE DDoS.XOR Checkin via HTTP

    suricata

  • Writes file to system bin folder

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence

  • Modifies rc script

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence

  • Write file to user bin folder

  • Reads runtime system information

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory

    Malware often drops required files in the /tmp directory.

  behavioral1