AVL Code
All cases
#014 · Sample Analysis

Case study · Sample Analysis

In-Depth Analysis of the Yayaya Mining Trojan and Its Kernel Rootkit

A security operations analyst hands AVL Code a mining-trojan lead that contains only an MD5. A single natural-language instruction splits the work — per the pre-planned steps — into three parallel sub-agents for static traits, dynamic behavior and threat correlation, and about 10 minutes later a Critical-rated full analysis report lands: the Diamorphine-variant Rootkit behind an 18,801-byte Bash deployment script, three levels of kernel hiding, a 6-tier fallback C2 and comprehensive anti-forensics, all on record.

AVL Code · Landi N2.5 (provided by AVL-Zero)· Linux · 18,801-byte Bash deployment script (accepted on an MD5 alone)· Static / dynamic / threat-correlation — three sub-agents in parallel· IOCs: 3 domains · 1 C2 IP · 9 competitor-cleanup IP ranges · 16 file paths · 18 ATT&CK items· About 10 minutes · threat level Critical

View session Download session archive Import into your AVL Code workspace to replay the full conversation View report

Session replays & reports are original records in Simplified Chinese · Built with AVL Code + the Landi model

Overview

  1. 01

    Intake and first probe — an 18,801-byte plaintext script reveals four malicious deployment stages

    You hand AVL Code a hash lead with only an MD5: locate the sample, probe type and entropy, extract all strings and IOCs, and after reading the script in full the malicious skeleton surfaces (clean competitors / replace iptables / install an LKM Rootkit / download a payload).

  2. 02

    Three parallel tracks — sub-agents dig separately, and a dead threat-intel channel does not stop the job

    AVL Code dispatches the static, dynamic and threat-correlation sub-agents in parallel per the plan written into your instruction; when the threat-intel lookup is unavailable it falls back to information already in hand rather than stalling.

  3. 03

    Integrate and deliver — Critical verdict + five key findings on record

    The three tracks merge into a core-conclusion table and a key-findings list; the report is written to 报告_<MD5>.md — Diamorphine-variant Rootkit, three-level hiding, the 6-tier fallback C2, competitor cleanup and anti-forensics all archived.

Task for AVL Code

Analyze the file with hash 52952154ab2f34686e295f3177d15d07 and produce a complete security analysis report covering threat detection, behavior traits and static attributes
Plan: ① first split the work into three sub-tasks: static trait extraction (file type, compile info, import table, etc.), dynamic behavior simulation (API call sequences, network behavior, file operations), threat-indicator correlation (sandbox/threat-intel lookups, known-signature matching) → ② dispatch 3 sub-agents in parallel: sub-agent 1 for static analysis, sub-agent 2 for dynamic analysis, sub-agent 3 for threat correlation → ③ integrate the three sub-agents’ results into a structured analysis report for my review

Prerequisites: The sample file samples/<MD5> is already in the workspace; AVL Code is logged in. The threat-intel lookup was unavailable during the session; whether that channel is available on replay does not affect the main flow

Reproduction materials at the end of this article Try it yourself ↓

First Probe of the Sample

The first question in any mining-alert triage is always "what is it and how did it get in". You hand AVL Code the hash and the pre-planned steps in one pass; instead of rushing to dispatch agents, it sees through the sample first:

You type → AVL Code 
Analyze the file with hash 52952154ab2f34686e295f3177d15d07 and produce a complete security analysis report covering threat detection, behavior traits and static attributes
Plan: ① first split the work into three sub-tasks: static trait extraction (file type, compile info, import table, etc.), dynamic behavior simulation (API call sequences, network behavior, file operations), threat-indicator correlation (sandbox/threat-intel lookups, known-signature matching) → ② dispatch 3 sub-agents in parallel: sub-agent 1 for static analysis, sub-agent 2 for dynamic analysis, sub-agent 3 for threat correlation → ③ integrate the three sub-agents’ results into a structured analysis report for my review
AVL Code runs → you see
Locates the sample by hash (18,801 bytes) → first probe: Bash script · entropy ~5.0
→ First strings mention "removing XMRig miner files"
→ Extracts all strings and IOCs, reads the script in full
→ Malicious skeleton fixed: clean XMRig traces → replace iptables → compile and install an LKM Rootkit → download and execute a payload

Three Parallel Tracks

Step ② of the plan comes due. AVL Code first tries to add independent threat-intel corroboration, and when it hits a wall it does not sit and retry:

You type → AVL Code 
② Dispatch 3 sub-agents in parallel: sub-agent 1 for static analysis, sub-agent 2 for dynamic analysis, sub-agent 3 for threat correlation
AVL Code runs → you see
Threat-intel lookup first
→ Query unavailable
→ "No problem, I already have enough information" — degrades and continues without interruption
Now three sub-agents are dispatched in parallel
Sub-agent 1 static · sub-agent 2 dynamic · sub-agent 3 threat correlation
All three sub-agents have finished their analysis

Integrate and Deliver

The three tracks meet at step ③ of the plan, and what you review is a report that can go straight into a ticket:

You type → AVL Code 
③ Integrate the three sub-agents’ results into a structured analysis report for my review
AVL Code runs → you see
Integrates the three tracks → writes the full analysis report 报告_5295….md
Core verdict: threat level Critical · classification Linux multi-stage loader + LKM Rootkit + cryptojacking miner dropper
→ Rootkit: Diamorphine variant · final payload XMRig Monero miner · kernel compatibility 2.6.x ~ 5.7+
→ Key findings: hooked getdents/getdents64/kill syscalls make processes/files/modules fully invisible · 3 signal backdoors (one grants root) · 6-tier fallback download mechanism · competitor-miner cleanup · full anti-forensics

Try it yourself

Reproducing this case takes one instruction: import the session into your workspace to replay it, or paste the following into your AVL Code (swap in your own hash, with the sample under samples/<MD5>):

View session Download session archive Import into your AVL Code workspace to replay the full conversation View report 
› Analyze the file with hash <sample MD5> and produce a complete security analysis report covering threat detection, behavior traits and static attributes
  Plan: ① first split the work into three sub-tasks: static trait extraction, dynamic behavior simulation, threat-indicator correlation → ② dispatch 3 sub-agents in parallel → ③ integrate the three sub-agents’ results into a structured analysis report for my review
  • The three plan steps can be pasted as-is, or you can send only the first line and let AVL Code plan on its own — part of this case’s value is an instruction that carries its own division of labor. The threat-intel lookup was unavailable in the session and the "threat correlation" track degraded to what the main agent already knew; if that channel is available on replay, you can add a lane of independent intel corroboration. Full IOC details (3 domains / 1 C2 IP / 9 IP ranges / 16 file paths) and the YARA rule text live in the case report PDF.

Next question: With the report in hand, what comes next naturally: turn the 9 competitor-cleanup IP ranges, 16 file paths and YARA rules into a host-triage checklist and IDS/EDR detection entries, and perform kernel-module-level cleanup on already-infected machines?