Extracted

• • Target
    iuwtfnzxxw
  • Size 611KB
  • SHA256 09cdd0b6cb6e82f205f3ad4a6c098b6c5e84667d061026d3011b58c45bff335a
  • MD5 d6bc45adaed51fe171e6b9f46dbe28e6
  • SHA1 17ef90985c369629150c79608167ee758180f2df
  • SHA512 fba9e72362fd1b0c799928d8d1eb43d9135eceb9c86f8e9c9632328c944dee5eb57eb1ae2fe6e4a429ab437355be0c0e2977af0652f88649e140b313ec6e5ada
  • SSDEEP 12288:FBXOvdwV1/n/dQFhWlH/c1dHo4h9L+zNZrrUT6yF8EEP4UlUuTh1AE:FBXmkN/+Fhu/Qo4h9L+zNNUBVEBl/91t
  • MD5 SHA1 SHA512 SSDEEP

  Score

  9^/10

  antivmpersistence

  • Attempts to identify hypervisor via CPU configuration

    Checks CPU information for indicators that the system is a virtual machine.

    antivm

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

  • Executes dropped EXE

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Write file to user bin folder

  • Reads system network configuration

    Uses contents of /proc filesystem to enumerate network settings.

  • Reads runtime system information

    Reads data from /proc virtual filesystem.

  behavioral1