Creates Raw socket

Creates a socket that captures raw packets at the device level

Deletes itself

Executes dropped EXE

Loads a kernel module

Loads a Linux kernel module, potentially to achieve persistence

OS Credential Dumping

Adversaries may attempt to dump credentials to use it in password cracking.

Traces itself

Traces itself to prevent debugging attempts

Unexpected DNS network traffic destination

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Checks SCSI settings

Checks list of SCSI devices which may be used to detect VMware or VirtualBox.

Creates/modifies Cron job

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

Enumerates active TCP sockets

Gets active TCP sockets from /proc virtual filesystem.

Enumerates running processes

Discovers information about currently running processes on the system

Modifies init.d

Adds/modifies system service, likely for persistence.

Reads MAC address of network interface

Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.

Reads list of loaded kernel modules

Reads the list of currently loaded kernel modules, possibly to detect virtual environments.

Reads network interface configuration

Fetches information about one or more active network interfaces.

Reads system routing table

Gets active network interfaces from /proc virtual filesystem.

Write file to user bin folder

Writes file to system bin folder