Extracted

• • Target

    f04799a3524bbed8e3777524ec0269a03c294db6701ab539a9350c076a209994

  • Size

    535KB

  • MD5

    5ce7f3c28bc34ef951d9f797e8ec680b

  • SHA1

    9809bd542e7ffb1d8b124c1e65135c45e8277907

  • SHA256

    f04799a3524bbed8e3777524ec0269a03c294db6701ab539a9350c076a209994

  • SHA512

    9bf19e515bbe63e0d3dd0b19f93bc1a0a704eb156505b19e15eb381d86ef0f71fb36a7fecad760a618724e54251c60249bc50a5d1762dd7ab46ecdeaa448c660

  Score

  9^/10

  discoverypersistence

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Writes file to system bin folder

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence

  • Modifies rc script

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence

  • Write file to user bin folder

  • Reads runtime system information

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory

    Malware often drops required files in the /tmp directory.

  behavioral1