Extracted

• • Target

    atrdadsrcc

  • Size

    659KB

  • MD5

    1d79488a09ef56ae2e60e1985b18e7a2

  • SHA1

    0b25e8f36a9738bb4d2dd2cd711f1aa7213db517

  • SHA256

    4aaa0b0d1ccb91b090df97a47b15536157f6f141cdce67867d339d0f01b3981d

  • SHA512

    b77fda07473e8f3e7ff2a1e25bb556164e3fddb40fe791a0b96538dfcc766f96c6e15082dccc77e79fff73f34497d0c43643134a633ff8740bbc4a287ec0c91b

  • SSDEEP

    12288:aBo9ETRNT9Wn1J0OhS18tDm8PCExfLZ9JCCpyvOH36ybCQ7YLVN1/lFkThVArw:aBo9ANo70OE8A8PCExfLZ/CTvQrKLd/Q

  Score

  7^/10

  persistence

  • Modifies rc script

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Write file to user bin folder

  • Reads runtime system information

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory

    Malware often drops required files in the /tmp directory.

  behavioral1