fbbd29bd9f03cf95b832bf87f46b69096548cb9a6cbd1d01c530435bec49c7e3

Resubmissions

31/05/2026, 17:12

260531-vq136ads216

31/05/2026, 17:08

260531-vnkcmac1916

Analysis

user interaction
yes
max time kernel
1s
max time network
205s
platform
ubuntu-24.04_amd64
resource
ubuntu2404-amd64-20260127-en
resource tags

arch:amd64arch:i386image:ubuntu2404-amd64-20260127-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
submitted
31/05/2026, 17:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
meow
Size 6.5MB
Sample260531-vq136ads21
SHA256 fbbd29bd9f03cf95b832bf87f46b69096548cb9a6cbd1d01c530435bec49c7e3
MD5 26eacec7d2f6d2f1a6114bb31249c8e9
SHA1 74c604fdd1dc8d25882156109c150fc860fa7c7e
SHA512 0bde34cc673c77f73b9a8e4b5d752b5a205c51b9fb776b9b0d2cc9358574fcb65359b8bec1298868d10c08ee0c6635f1a247a60702e201e01a1c6720052e62db
SSDEEP 49152:bHWtqcg6C5DbiAVKxJX2q3pzAKjAdSLweBtUDiRWeqRa2AEAo0NxXVMuKlK1KVdo:bHfc757f/9Rl2j/5fVEN
TLSH
T1F0664947FC6525E9C1AE95308A629513BB71BC494F3163D32F60F2293F76BD0AAB9340
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Enumerates running processes
Discovers information about currently running processes on the system

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/cpufreqd.service	meow

Write file to user bin folder 1 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/local/bin/cpufreqd	meow

Reads CPU attributes 1 TTPs 1 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/possible	pkill

Enumerates kernel/hardware configuration 1 TTPs 3 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	meow
File opened for reading	/sys/fs/cgroup/system.slice/agent.service/cpu.max	meow
File opened for reading	/sys/devices/system/node	pkill

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/37/ctty	pkill
File opened for reading	/proc/235/cgroup	pkill
File opened for reading	/proc/791/cmdline	pkill
File opened for reading	/proc/1019/ctty	pkill
File opened for reading	/proc/1020/cgroup	pkill
File opened for reading	/proc/1086/ctty	pkill
File opened for reading	/proc/1307/stat	pkill
File opened for reading	/proc/1759/ctty	pkill
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/27/status	pkill
File opened for reading	/proc/1420/stat	pkill
File opened for reading	/proc/24/ctty	pkill
File opened for reading	/proc/31/cmdline	pkill
File opened for reading	/proc/579/cgroup	pkill
File opened for reading	/proc/1727/stat	pkill
File opened for reading	/proc/55/status	pkill
File opened for reading	/proc/1373/ctty	pkill
File opened for reading	/proc/1435/cgroup	pkill
File opened for reading	/proc/21/stat	pkill
File opened for reading	/proc/21/ctty	pkill
File opened for reading	/proc/30/status	pkill
File opened for reading	/proc/48/ctty	pkill
File opened for reading	/proc/55/cgroup	pkill
File opened for reading	/proc/981/cmdline	pkill
File opened for reading	/proc/2428/stat	pkill
File opened for reading	/proc/1615/ctty	pkill
File opened for reading	/proc/52/ctty	pkill
File opened for reading	/proc/780/status	pkill
File opened for reading	/proc/2026/cmdline	pkill
File opened for reading	/proc/1492/stat	pkill
File opened for reading	/proc/1541/ctty	pkill
File opened for reading	/proc/1772/stat	pkill
File opened for reading	/proc/45/stat	pkill
File opened for reading	/proc/1307/ctty	pkill
File opened for reading	/proc/1438/ctty	pkill
File opened for reading	/proc/1782/ctty	pkill
File opened for reading	/proc/80/cgroup	pkill
File opened for reading	/proc/1265/stat	pkill
File opened for reading	/proc/1471/stat	pkill
File opened for reading	/proc/26/ctty	pkill
File opened for reading	/proc/45/ctty	pkill
File opened for reading	/proc/196/stat	pkill
File opened for reading	/proc/787/cgroup	pkill
File opened for reading	/proc/1482/cmdline	pkill
File opened for reading	/proc/1546/cgroup	pkill
File opened for reading	/proc/2165/cgroup	pkill
File opened for reading	/proc/15/stat	pkill
File opened for reading	/proc/135/stat	pkill
File opened for reading	/proc/1971/ctty	pkill
File opened for reading	/proc/38/cmdline	pkill
File opened for reading	/proc/47/status	pkill
File opened for reading	/proc/2/stat	pkill
File opened for reading	/proc/3/ctty	pkill
File opened for reading	/proc/39/stat	pkill
File opened for reading	/proc/131/stat	pkill
File opened for reading	/proc/1086/cmdline	pkill
File opened for reading	/proc/1747/ctty	pkill
File opened for reading	/proc/12/stat	pkill
File opened for reading	/proc/51/cgroup	pkill
File opened for reading	/proc/138/ctty	pkill
File opened for reading	/proc/1348/stat	pkill
File opened for reading	/proc/1492/cgroup	pkill
File opened for reading	/proc/2428/cgroup	pkill
File opened for reading	/proc/4/stat	pkill

/tmp/meow
/tmp/meow
1⤵
- Modifies systemd
- Write file to user bin folder
- Enumerates kernel/hardware configuration
PID:2036
- /usr/bin/systemctl
  systemctl daemon-reload
  2⤵
  PID:2041
- /usr/bin/systemctl
  systemctl daemon-reload
  2⤵
  PID:2169
- /usr/bin/systemctl
  systemctl enable cpufreqd.service
  2⤵
  PID:2299
- /usr/bin/systemctl
  systemctl restart cpufreqd.service
  2⤵
  - Reads runtime system information
  PID:2429
- /usr/bin/systemctl
  systemctl stop cpufreqd.service
  2⤵
  PID:2433
- /usr/bin/pkill
  pkill -f /usr/local/bin/cpufreqd
  2⤵
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:2435
- /usr/bin/systemctl
  systemctl start cpufreqd.service
  2⤵
  PID:2436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cpufreqd.service

Path /etc/systemd/system/cpufreqd.service
Size 226B
SHA256 c097dcefdf95e7f3b2cc5b29be29d78acbd0b1f124a10052f92cef83375bf964
MD5 93f804de587961e4893662a77c54afc4
SHA1 c84cfbfb962541c87482050ed65268b0104826c2
SHA512 4df4ed6a83ec1f792b0fbb4e0753c5264e740f812b1d86e651506a3697e252fb11922f6e403cd573e4719d9effa243dab061626caacb5ef6acfdf3c631b9150d
TLSH
T1A8D0A7926A217999CECA28A18EF367444E5061814D8AA0300FB1654A46E595755509BF
MD5 SHA1 SHA512 TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads