Extracted

• • Target

    4f02cc4d5426b63e3eca3ada3c9a8a111a952c0e373c5500519ea8eea5ade853

  • Size

    549KB

  • MD5

    63d6cd74a7cd01bf3a3921c36e90237f

  • SHA1

    f697783da228c7787cf1c6a67a10a8c065d6aaa7

  • SHA256

    4f02cc4d5426b63e3eca3ada3c9a8a111a952c0e373c5500519ea8eea5ade853

  • SHA512

    51b1aef53c8277b8700630b144f15c9a41df358a43d71ef0b9352bbdf71c8777774f1ef1e361c8c95930143b54fcde590885242df3da60dce5b1a1d3761e2db3

  • SSDEEP

    12288:VeRvuKqiVZ4En5drNK0pPEfJKlHZ8mG97Qxee6yzmx:VIv/qiVNHNDEfJKHZ8mG9QeeO

  Score

  9^/10

  persistence

  • Writes file to system bin folder

  • Modifies rc script

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence

  • Writes file to shm directory

    Malware can drop malicious files in the shm directory which will run directly from RAM.

  • Writes file to tmp directory

    Malware often drops required files in the /tmp directory.

  behavioral1