AVL Code
All cases
#014 · Sample Analysis

In-Depth Analysis of the Yayaya Mining Trojan and Its Kernel Rootkit

To thoroughly analyze a Linux mining-trojan threat, analysts drove AVL Code with a single natural-language instruction, fanning out three parallel sub-agents to close the loop from malicious sample to a complete analysis report.

Built with AVL Code + the Landi model

Mining TrojanLKM RootkitDiamorphineLinux SecurityMITRE ATT&CK

Overview

Facing a Linux mining trojan built on a Diamorphine-family LKM rootkit variant, analysts drove AVL Code with one natural-language instruction, splitting the work across three parallel sub-agents — static features, dynamic behavior and threat correlation — to reverse-engineer the 18.8KB Bash deployment script in depth. It automatically identified the 5-stage malicious deployment flow, the three kernel-level rootkit hiding mechanisms, the iptables backdoor and the 6-tier fallback C2 channel, mapped everything to MITRE ATT&CK, and in about 10 minutes produced an in-depth report — complete IOC list, YARA rules and a detection-and-response plan — classifying the threat as Critical.

Key results

  • Fully reverse-engineered the 18.8KB Bash deployment script, reconstructing the 5-stage deployment flow and the kernel-level hiding mechanisms of the Diamorphine-variant LKM rootkit
  • Extracted a complete IOC list (3 domains, 1 C2 IP, 9 competitor-cleanup IP ranges, 16 file paths) and generated deployment-ready YARA detection rules
  • Completed 18 MITRE ATT&CK technique mappings and produced a full response plan spanning detection rules through incident response
  • One instruction, three parallel sub-agents, full analysis in about 10 minutes — classified as a Critical-severity threat

Technical highlights

Multi-sub-agent parallel analysis (static / dynamic / threat correlation)Kernel-level LKM rootkit capability identificationReconstruction of the three-level hiding (file / process / module)6-tier fallback C2 channel analysisiptables backdoor and competitor-cleanup detectionMITRE ATT&CK mapping with automated YARA rule generation

Practical value

Helps security operations rapidly identify and respond to Linux server mining threats, provides end-to-end guidance from detection to remediation, strengthens detection and handling of kernel-level malware, protects server compute resources from hijacking, and contributes reusable detection rules and IOC data to the threat-intelligence library.

Artifacts

View session Download session import into your workspace for full detail View report

Session replays & reports are original records in Simplified Chinese · Built with AVL Code + the Landi model