Deletes Audit logs

Deletes logs related to the Linux Audit framework.

Deletes itself

Deletes journal logs

Deletes systemd journal logs. Likely to evade detection.

Modifies Watchdog functionality

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Creates a large amount of network flows

This may indicate a network scan to discover remotely running services.

Writes file to system bin folder