Analysis
- max time kernel
6s - platform
debian-9_armhf - resource
debian9-armhf-20260513-en - resource tags
arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem - submitted
09/08/2026, 02:37
Static task
static1
Behavioral task
behavioral1
Sample
48cc5348aa55e605bcd1c6cb3a48859c0dd75ab9bb7632fe545c491789039b0c
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
48cc5348aa55e605bcd1c6cb3a48859c0dd75ab9bb7632fe545c491789039b0c
Resource
debian9-armhf-20260513-en
debian-9-armhf
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
48cc5348aa55e605bcd1c6cb3a48859c0dd75ab9bb7632fe545c491789039b0c
Resource
debian9-mipsbe-20260513-en
debian-9-mips
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
48cc5348aa55e605bcd1c6cb3a48859c0dd75ab9bb7632fe545c491789039b0c
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
0 signatures
150 seconds
General
- Target 48cc5348aa55e605bcd1c6cb3a48859c0dd75ab9bb7632fe545c491789039b0c
- Size 671B
- Sample260809-c39xqagl8v
- SHA256 48cc5348aa55e605bcd1c6cb3a48859c0dd75ab9bb7632fe545c491789039b0c
- MD5 f3bfd33c0805c4acbf6602e6face8be7
- SHA1 51a01efd33f99b3912e9f9323a277a8c55af297a
- SHA512 394b4725940ee453dfd4004b06ff4167202e94141dead99fa2682367156b227ad6660ad3fe960293ae870bbee71f8c8ff846637abaf409ae945d66668b3f4646
- TLSH T1F001CBC87298FCB13BCC966C8D5A2473F0899B2BD0741D2B23E30FA0A90D244A229820
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo curl - Reads CPU attributes 1 TTPs 1 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online pgrep -
description ioc Process File opened for reading /proc/43/stat killall File opened for reading /proc/41/stat killall File opened for reading /proc/95/cmdline pgrep File opened for reading /proc/6/status pgrep File opened for reading /proc/42/stat killall File opened for reading /proc/323/stat killall File opened for reading /proc/19/stat killall File opened for reading /proc/588/stat killall File opened for reading /proc/651/stat killall File opened for reading /proc/651/cmdline killall File opened for reading /proc/13/stat killall File opened for reading /proc/11/stat killall File opened for reading /proc/18/stat killall File opened for reading /proc/16/stat killall File opened for reading /proc/103/status pgrep File opened for reading /proc/278/cmdline pgrep File opened for reading /proc/585/status pgrep File opened for reading /proc/592/status pgrep File opened for reading /proc/106/stat killall File opened for reading /proc/5/stat killall File opened for reading /proc/24/stat killall File opened for reading /proc/7/cmdline pgrep File opened for reading /proc/11/cmdline pgrep File opened for reading /proc/593/status pgrep File opened for reading /proc/95/stat killall File opened for reading /proc/105/stat killall File opened for reading /proc/638/stat killall File opened for reading /proc/134/cmdline pgrep File opened for reading /proc/280/cmdline pgrep File opened for reading /proc/653/cmdline killall File opened for reading /proc/156/stat killall File opened for reading /proc/22/status pgrep File opened for reading /proc/12/stat killall File opened for reading /proc/25/stat killall File opened for reading /proc/8/cmdline pgrep File opened for reading /proc/20/status pgrep File opened for reading /proc/22/cmdline pgrep File opened for reading /proc/139/status pgrep File opened for reading /proc/286/status pgrep File opened for reading /proc/585/stat killall File opened for reading /proc/18/status pgrep File opened for reading /proc/286/cmdline pgrep File opened for reading /proc/573/cmdline pgrep File opened for reading /proc/136/stat killall File opened for reading /proc/23/stat killall File opened for reading /proc/5/status pgrep File opened for reading /proc/74/cmdline pgrep File opened for reading /proc/142/stat killall File opened for reading /proc/280/stat killall File opened for reading /proc/653/stat killall File opened for reading /proc/13/status pgrep File opened for reading /proc/24/cmdline pgrep File opened for reading /proc/208/status pgrep File opened for reading /proc/9/cmdline pgrep File opened for reading /proc/649/cmdline pgrep File opened for reading /proc/671/cmdline pgrep File opened for reading /proc/26/stat killall File opened for reading /proc/136/cmdline pgrep File opened for reading /proc/325/status pgrep File opened for reading /proc/325/cmdline pgrep File opened for reading /proc/588/cmdline pgrep File opened for reading /proc/3/status pgrep File opened for reading /proc/12/cmdline pgrep File opened for reading /proc/6/stat killall - Writes file to tmp directory 20 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/logs/mass_brute_1.log 48cc5348aa55e605bcd1c6cb3a48859c0dd75ab9bb7632fe545c491789039b0c File opened for modification /tmp/logs/mass_yarn_5.log 48cc5348aa55e605bcd1c6cb3a48859c0dd75ab9bb7632fe545c491789039b0c File opened for modification /tmp/logs/mass_yarn_8.log 48cc5348aa55e605bcd1c6cb3a48859c0dd75ab9bb7632fe545c491789039b0c File opened for modification /tmp/logs/mass_ips_1.log 48cc5348aa55e605bcd1c6cb3a48859c0dd75ab9bb7632fe545c491789039b0c File opened for modification /tmp/logs/mass_ips_5.log 48cc5348aa55e605bcd1c6cb3a48859c0dd75ab9bb7632fe545c491789039b0c File opened for modification /tmp/logs/mass_brute_4.log 48cc5348aa55e605bcd1c6cb3a48859c0dd75ab9bb7632fe545c491789039b0c File opened for modification /tmp/logs/mass_yarn_1.log 48cc5348aa55e605bcd1c6cb3a48859c0dd75ab9bb7632fe545c491789039b0c File opened for modification /tmp/logs/mass_yarn_2.log 48cc5348aa55e605bcd1c6cb3a48859c0dd75ab9bb7632fe545c491789039b0c File opened for modification /tmp/logs/mass_yarn_3.log 48cc5348aa55e605bcd1c6cb3a48859c0dd75ab9bb7632fe545c491789039b0c File opened for modification /tmp/logs/mass_yarn_6.log 48cc5348aa55e605bcd1c6cb3a48859c0dd75ab9bb7632fe545c491789039b0c File opened for modification /tmp/logs/mass_ips_3.log 48cc5348aa55e605bcd1c6cb3a48859c0dd75ab9bb7632fe545c491789039b0c File opened for modification /tmp/logs/mass_ips_4.log 48cc5348aa55e605bcd1c6cb3a48859c0dd75ab9bb7632fe545c491789039b0c File opened for modification /tmp/logs/mass_ips_8.log 48cc5348aa55e605bcd1c6cb3a48859c0dd75ab9bb7632fe545c491789039b0c File opened for modification /tmp/logs/mass_brute_2.log 48cc5348aa55e605bcd1c6cb3a48859c0dd75ab9bb7632fe545c491789039b0c File opened for modification /tmp/logs/mass_yarn_4.log 48cc5348aa55e605bcd1c6cb3a48859c0dd75ab9bb7632fe545c491789039b0c File opened for modification /tmp/logs/mass_ips_2.log 48cc5348aa55e605bcd1c6cb3a48859c0dd75ab9bb7632fe545c491789039b0c File opened for modification /tmp/logs/mass_brute_3.log 48cc5348aa55e605bcd1c6cb3a48859c0dd75ab9bb7632fe545c491789039b0c File opened for modification /tmp/logs/mass_yarn_7.log 48cc5348aa55e605bcd1c6cb3a48859c0dd75ab9bb7632fe545c491789039b0c File opened for modification /tmp/logs/mass_ips_6.log 48cc5348aa55e605bcd1c6cb3a48859c0dd75ab9bb7632fe545c491789039b0c File opened for modification /tmp/logs/mass_ips_7.log 48cc5348aa55e605bcd1c6cb3a48859c0dd75ab9bb7632fe545c491789039b0c
Processes
-
/tmp/48cc5348aa55e605bcd1c6cb3a48859c0dd75ab9bb7632fe545c491789039b0c/tmp/48cc5348aa55e605bcd1c6cb3a48859c0dd75ab9bb7632fe545c491789039b0c1⤵
- Writes file to tmp directory
PID:651 -
/usr/bin/killallkillall -9 meow_master.py2⤵
- Reads runtime system information
PID:657
-
-
/usr/bin/killallkillall -9 exploit_loop.py2⤵
- Reads runtime system information
PID:663
-
-
/bin/sleepsleep 22⤵PID:668
-
-
/usr/bin/seqseq 1 82⤵PID:723
-
-
/usr/bin/seqseq 1 82⤵PID:733
-
-
/usr/bin/seqseq 1 42⤵PID:742
-
-
/bin/sleepsleep 42⤵PID:747
-
-
/usr/bin/pgreppgrep -fc meow_master2⤵
- Reads CPU attributes
- Reads runtime system information
PID:780
-
-
/usr/bin/curlcurl -s http://127.0.0.1:9090/api/stats2⤵
- Checks CPU configuration
PID:781
-