Extracted

• • Target

    iuwtfnzxxw

  • Size

    611KB

  • MD5

    d6bc45adaed51fe171e6b9f46dbe28e6

  • SHA1

    17ef90985c369629150c79608167ee758180f2df

  • SHA256

    09cdd0b6cb6e82f205f3ad4a6c098b6c5e84667d061026d3011b58c45bff335a

  • SHA512

    fba9e72362fd1b0c799928d8d1eb43d9135eceb9c86f8e9c9632328c944dee5eb57eb1ae2fe6e4a429ab437355be0c0e2977af0652f88649e140b313ec6e5ada

  • SSDEEP

    12288:FBXOvdwV1/n/dQFhWlH/c1dHo4h9L+zNZrrUT6yF8EEP4UlUuTh1AE:FBXmkN/+Fhu/Qo4h9L+zNNUBVEBl/91t

  Score

  9^/10

  antivmpersistence

  • Attempts to identify hypervisor via CPU configuration

    Checks CPU information for indicators that the system is a virtual machine.

    antivm

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    persistence

  • Enumerates active TCP sockets

    Gets active TCP sockets from /proc virtual filesystem.

  • Executes dropped EXE

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Write file to user bin folder

  • Reads system network configuration

    Uses contents of /proc filesystem to enumerate network settings.

  • Reads runtime system information

    Reads data from /proc virtual filesystem.

  behavioral1