Analysis
- max time kernel
13s - platform
debian-9_armhf - resource
debian9-armhf-20260513-en - resource tags
arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem - submitted
09/08/2026, 02:37
Static task
static1
Behavioral task
behavioral1
Sample
a89fe2fe1b82414092e03435ed4158dc5951cd593d6cec7c639b1c36d49b38ff
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
a89fe2fe1b82414092e03435ed4158dc5951cd593d6cec7c639b1c36d49b38ff
Resource
debian9-armhf-20260513-en
debian-9-armhf
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
a89fe2fe1b82414092e03435ed4158dc5951cd593d6cec7c639b1c36d49b38ff
Resource
debian9-mipsbe-20260513-en
debian-9-mips
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
a89fe2fe1b82414092e03435ed4158dc5951cd593d6cec7c639b1c36d49b38ff
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
0 signatures
150 seconds
General
- Target a89fe2fe1b82414092e03435ed4158dc5951cd593d6cec7c639b1c36d49b38ff
- Size 728B
- Sample260809-c38pnagl8s
- SHA256 a89fe2fe1b82414092e03435ed4158dc5951cd593d6cec7c639b1c36d49b38ff
- MD5 f3768f459bb477e5f3eafc6bddeb9877
- SHA1 6253e7408598a84efe356ce3df123e073a932c2f
- SHA512 46896f7a60747a1f1364a4b19adbf25ce973dcb17452bc071e14bfd17018a4c35b6c5c965ca7ad014c6d170859edcae7377df85ad8fd896ad574a1373ecdf59f
- TLSH T1ED01928823C9FE797FD9A18D68971067E89CFD37E0701C6F23E69FD0156A90C890E925
- MD5 SHA1 SHA512 TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Reads CPU attributes 1 TTPs 1 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online pgrep -
description ioc Process File opened for reading /proc/75/stat killall File opened for reading /proc/313/stat killall File opened for reading /proc/634/cmdline killall File opened for reading /proc/3/cmdline pgrep File opened for reading /proc/583/cmdline pgrep File opened for reading /proc/640/status pgrep File opened for reading /proc/11/stat killall File opened for reading /proc/645/stat killall File opened for reading /proc/6/status pgrep File opened for reading /proc/23/status pgrep File opened for reading /proc/158/cmdline pgrep File opened for reading /proc/564/cmdline pgrep File opened for reading /proc/297/stat killall File opened for reading /proc/7/cmdline pgrep File opened for reading /proc/8/status pgrep File opened for reading /proc/279/cmdline pgrep File opened for reading /proc/3/stat killall File opened for reading /proc/149/cmdline killall File opened for reading /proc/156/stat killall File opened for reading /proc/645/cmdline killall File opened for reading /proc/22/status pgrep File opened for reading /proc/26/cmdline pgrep File opened for reading /proc/28/status pgrep File opened for reading /proc/107/status pgrep File opened for reading /proc/26/stat killall File opened for reading /proc/8/cmdline pgrep File opened for reading /proc/139/status pgrep File opened for reading /proc/149/status pgrep File opened for reading /proc/300/status pgrep File opened for reading /proc/326/status pgrep File opened for reading /proc/579/cmdline pgrep File opened for reading /proc/10/stat killall File opened for reading /proc/282/stat killall File opened for reading /proc/635/stat killall File opened for reading /proc/13/status pgrep File opened for reading /proc/24/cmdline pgrep File opened for reading /proc/642/status pgrep File opened for reading /proc/24/stat killall File opened for reading /proc/10/status pgrep File opened for reading /proc/21/cmdline pgrep File opened for reading /proc/652/status pgrep File opened for reading /proc/760/cmdline pgrep File opened for reading /proc/filesystems killall File opened for reading /proc/564/stat killall File opened for reading /proc/4/status pgrep File opened for reading /proc/166/cmdline pgrep File opened for reading /proc/294/cmdline pgrep File opened for reading /proc/641/status pgrep File opened for reading /proc/21/stat killall File opened for reading /proc/97/stat killall File opened for reading /proc/577/stat killall File opened for reading /proc/642/stat killall File opened for reading /proc/17/status pgrep File opened for reading /proc/18/cmdline pgrep File opened for reading /proc/20/status pgrep File opened for reading /proc/138/cmdline pgrep File opened for reading /proc/28/stat killall File opened for reading /proc/4/cmdline pgrep File opened for reading /proc/5/status pgrep File opened for reading /proc/27/status pgrep File opened for reading /proc/279/status pgrep File opened for reading /proc/297/cmdline pgrep File opened for reading /proc/313/cmdline pgrep File opened for reading /proc/635/status pgrep - Writes file to tmp directory 7 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/logs/m4.log a89fe2fe1b82414092e03435ed4158dc5951cd593d6cec7c639b1c36d49b38ff File opened for modification /tmp/logs/m5.log a89fe2fe1b82414092e03435ed4158dc5951cd593d6cec7c639b1c36d49b38ff File opened for modification /tmp/logs/m6.log a89fe2fe1b82414092e03435ed4158dc5951cd593d6cec7c639b1c36d49b38ff File opened for modification /tmp/logs/m7.log a89fe2fe1b82414092e03435ed4158dc5951cd593d6cec7c639b1c36d49b38ff File opened for modification /tmp/logs/m1.log a89fe2fe1b82414092e03435ed4158dc5951cd593d6cec7c639b1c36d49b38ff File opened for modification /tmp/logs/m2.log a89fe2fe1b82414092e03435ed4158dc5951cd593d6cec7c639b1c36d49b38ff File opened for modification /tmp/logs/m3.log a89fe2fe1b82414092e03435ed4158dc5951cd593d6cec7c639b1c36d49b38ff
Processes
-
/tmp/a89fe2fe1b82414092e03435ed4158dc5951cd593d6cec7c639b1c36d49b38ff/tmp/a89fe2fe1b82414092e03435ed4158dc5951cd593d6cec7c639b1c36d49b38ff1⤵
- Writes file to tmp directory
PID:642 -
/usr/bin/killallkillall -9 meow_master.py2⤵
- Reads runtime system information
PID:648
-
-
/bin/sleepsleep 22⤵PID:655
-
-
/bin/sleepsleep 12⤵PID:716
-
-
/bin/sleepsleep 12⤵PID:729
-
-
/bin/sleepsleep 12⤵PID:751
-
-
/bin/sleepsleep 12⤵PID:753
-
-
/bin/sleepsleep 12⤵PID:755
-
-
/bin/sleepsleep 12⤵PID:757
-
-
/bin/sleepsleep 52⤵PID:759
-
-
/usr/bin/pgreppgrep -fc meow_master2⤵
- Reads CPU attributes
- Reads runtime system information
PID:760
-