General
- Target lilin.sh
- Size 2KB
- Sample260822-che7lsvsft
- SHA256 90e2b0b4e29cf7906f43e7eb275e4b03a44dc060821b873fc507ca9292c9cc5f
- MD5 444465a3e2a2e6441cc6afc2ce69dc5a
- SHA1 9ca86d429c9a738c19a3e11f33adffb021fe71b8
- SHA512 02f252580cf07885350cd8e01befa8772c90d9373254e40c9d58b56cbeaac664f26fba52c93d815ae8afa16fad9372e8c1b4f3958d61229ca1864784e229c403
- TLSH T162512CEE31F46EA1C2819E1C327F9E8C7461CDA236814BB9D54F7436D58ECA0B536E48
- MD5 SHA1 SHA512 TLSH
Static task
static1
Behavioral task
behavioral1
Sample
lilin.sh
Resource
ubuntu1804-amd64-20260513-en
Behavioral task
behavioral2
Sample
lilin.sh
Resource
debian9-armhf-20260513-en
Behavioral task
behavioral3
Sample
lilin.sh
Resource
debian9-mipsbe-20260513-en
Behavioral task
behavioral4
Sample
lilin.sh
Resource
debian9-mipsel-20260513-en
Malware Config
Targets
-
- Target lilin.sh
- Size 2KB
- SHA256 90e2b0b4e29cf7906f43e7eb275e4b03a44dc060821b873fc507ca9292c9cc5f
- MD5 444465a3e2a2e6441cc6afc2ce69dc5a
- SHA1 9ca86d429c9a738c19a3e11f33adffb021fe71b8
- SHA512 02f252580cf07885350cd8e01befa8772c90d9373254e40c9d58b56cbeaac664f26fba52c93d815ae8afa16fad9372e8c1b4f3958d61229ca1864784e229c403
- TLSH T162512CEE31F46EA1C2819E1C327F9E8C7461CDA236814BB9D54F7436D58ECA0B536E48
- MD5 SHA1 SHA512 TLSH
Score7/10-
File and Directory Permissions Modification
Adversaries may modify file or directory permissions to evade defenses.
-
Executes dropped EXE
-
Modifies Watchdog functionality
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Write file to user bin folder
MITRE ATT&CK Enterprise v16
Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Impair Defenses
1Virtualization/Sandbox Evasion
1System Checks
1