Extracted

• • Target
    4f02cc4d5426b63e3eca3ada3c9a8a111a952c0e373c5500519ea8eea5ade853
  • Size 549KB
  • SHA256 4f02cc4d5426b63e3eca3ada3c9a8a111a952c0e373c5500519ea8eea5ade853
  • MD5 63d6cd74a7cd01bf3a3921c36e90237f
  • SHA1 f697783da228c7787cf1c6a67a10a8c065d6aaa7
  • SHA512 51b1aef53c8277b8700630b144f15c9a41df358a43d71ef0b9352bbdf71c8777774f1ef1e361c8c95930143b54fcde590885242df3da60dce5b1a1d3761e2db3
  • SSDEEP 12288:VeRvuKqiVZ4En5drNK0pPEfJKlHZ8mG97Qxee6yzmx:VIv/qiVNHNDEfJKHZ8mG9QeeO
  • MD5 SHA1 SHA512 SSDEEP

  Score

  9^/10

  persistence

  • Writes file to system bin folder

  • Modifies rc script

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence

  • Writes file to shm directory

    Malware can drop malicious files in the shm directory which will run directly from RAM.

  • Writes file to tmp directory

    Malware often drops required files in the /tmp directory.

  behavioral1