Dropper writes binary to /tmp then opens outbound C2 connection

Arnold Chan@slaz

•updated 27 days ago•0•0•2

Detects the creation of files in the /tmp/ directory by common command-line tools (curl, wget, sh, bash), followed shortly by a successful external network connection by the same process from the same device, excluding known benign domains.