Deletes itself

Modifies Watchdog functionality

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Attempts to change immutable files

Modifies inode attributes on the filesystem to allow changing of immutable files.

Creates/modifies Cron job

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

Modifies systemd

Adds/ modifies systemd service files. Likely to achieve persistence.

Write file to user bin folder