Creates/modifies Cron job

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

Deletes itself

Enumerates active TCP sockets

Gets active TCP sockets from /proc virtual filesystem.

Executes dropped EXE

Modifies init.d

Adds/modifies system service, likely for persistence.

Unexpected DNS network traffic destination

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Writes file to shm directory

Malware can drop malicious files in the shm directory which will run directly from RAM.

Reads system network configuration

Uses contents of /proc filesystem to enumerate network settings.

Reads runtime system information

Reads data from /proc virtual filesystem.

Writes file to tmp directory

Malware often drops required files in the /tmp directory.