Analysis
- max time kernel
1s - max time network
130s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
09/08/2026, 02:42
Static task
static1
Behavioral task
behavioral1
Sample
095f94d00e98369b361f32f883164f6e6ee07d71da489efbfdd328e76c2e9def
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
095f94d00e98369b361f32f883164f6e6ee07d71da489efbfdd328e76c2e9def
Resource
debian9-armhf-20260513-en
debian-9-armhf
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
095f94d00e98369b361f32f883164f6e6ee07d71da489efbfdd328e76c2e9def
Resource
debian9-mipsbe-20260513-en
debian-9-mips
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
095f94d00e98369b361f32f883164f6e6ee07d71da489efbfdd328e76c2e9def
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
0 signatures
150 seconds
General
- Target 095f94d00e98369b361f32f883164f6e6ee07d71da489efbfdd328e76c2e9def
- Size 207B
- Sample260809-c685lagm5w
- SHA256 095f94d00e98369b361f32f883164f6e6ee07d71da489efbfdd328e76c2e9def
- MD5 135704368ab3ec3efa4fe662d01a4e06
- SHA1 8e00df8abdb1162d89089f6ef8d721ccaf193915
- SHA512 8098997676ffc801b783090879aadf38d17413effc6f5217d463b4fd9fab06f93df0d64713205886da847193507c21e38bb2afaeb4412e00b2d233ca47609431
- TLSH T17FD022C0B4C4A43BFAEC70452A05FAAB430B2C2F2B10828022614C22F84C2EC30C79A1
- MD5 SHA1 SHA512 TLSH
Score
7/10
Malware Config
Signatures
- File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 1552 chmod - Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp fuser - Enumerates running processes
Discovers information about currently running processes on the system
- Reads process memory 1 TTPs 64 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/15/maps fuser File opened for reading /proc/957/maps fuser File opened for reading /proc/323/maps fuser File opened for reading /proc/500/maps fuser File opened for reading /proc/24/maps fuser File opened for reading /proc/82/maps fuser File opened for reading /proc/172/maps fuser File opened for reading /proc/184/maps fuser File opened for reading /proc/998/maps fuser File opened for reading /proc/176/maps fuser File opened for reading /proc/530/maps fuser File opened for reading /proc/79/maps fuser File opened for reading /proc/1/maps fuser File opened for reading /proc/81/maps fuser File opened for reading /proc/173/maps fuser File opened for reading /proc/23/maps fuser File opened for reading /proc/32/maps fuser File opened for reading /proc/496/maps fuser File opened for reading /proc/582/maps fuser File opened for reading /proc/910/maps fuser File opened for reading /proc/9/maps fuser File opened for reading /proc/212/maps fuser File opened for reading /proc/915/maps fuser File opened for reading /proc/932/maps fuser File opened for reading /proc/4/maps fuser File opened for reading /proc/10/maps fuser File opened for reading /proc/532/maps fuser File opened for reading /proc/658/maps fuser File opened for reading /proc/29/maps fuser File opened for reading /proc/137/maps fuser File opened for reading /proc/470/maps fuser File opened for reading /proc/719/maps fuser File opened for reading /proc/13/maps fuser File opened for reading /proc/490/maps fuser File opened for reading /proc/505/maps fuser File opened for reading /proc/937/maps fuser File opened for reading /proc/984/maps fuser File opened for reading /proc/6/maps fuser File opened for reading /proc/179/maps fuser File opened for reading /proc/482/maps fuser File opened for reading /proc/908/maps fuser File opened for reading /proc/918/maps fuser File opened for reading /proc/994/maps fuser File opened for reading /proc/84/maps fuser File opened for reading /proc/497/maps fuser File opened for reading /proc/666/maps fuser File opened for reading /proc/3/maps fuser File opened for reading /proc/18/maps fuser File opened for reading /proc/22/maps fuser File opened for reading /proc/8/maps fuser File opened for reading /proc/25/maps fuser File opened for reading /proc/169/maps fuser File opened for reading /proc/486/maps fuser File opened for reading /proc/541/maps fuser File opened for reading /proc/550/maps fuser File opened for reading /proc/672/maps fuser File opened for reading /proc/684/maps fuser File opened for reading /proc/16/maps fuser File opened for reading /proc/21/maps fuser File opened for reading /proc/182/maps fuser File opened for reading /proc/977/maps fuser File opened for reading /proc/27/maps fuser File opened for reading /proc/174/maps fuser File opened for reading /proc/177/maps fuser - Reads system network configuration 1 TTPs 3 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/unix fuser File opened for reading /proc/net/tcp fuser File opened for reading /proc/net/tcp6 fuser -
description ioc Process File opened for reading /proc/78/fd fuser File opened for reading /proc/175/fd fuser File opened for reading /proc/684/fd fuser File opened for reading /proc/1422/maps fuser File opened for reading /proc/4/fd fuser File opened for reading /proc/23/fd fuser File opened for reading /proc/613/fd fuser File opened for reading /proc/672/fd fuser File opened for reading /proc/1007/fd fuser File opened for reading /proc/1537/maps fuser File opened for reading /proc/6/fd fuser File opened for reading /proc/29/fd fuser File opened for reading /proc/32/fd fuser File opened for reading /proc/172/fd fuser File opened for reading /proc/173/fd fuser File opened for reading /proc/470/fd fuser File opened for reading /proc/977/fd fuser File opened for reading /proc/115/fd fuser File opened for reading /proc/1022/maps fuser File opened for reading /proc/1027/fd fuser File opened for reading /proc/1047/maps fuser File opened for reading /proc/1094/fd fuser File opened for reading /proc/22/fd fuser File opened for reading /proc/1057/fd fuser File opened for reading /proc/1075/fd fuser File opened for reading /proc/1096/fd fuser File opened for reading /proc/1201/maps fuser File opened for reading /proc/932/fd fuser File opened for reading /proc/17/fd fuser File opened for reading /proc/79/fd fuser File opened for reading /proc/169/fd fuser File opened for reading /proc/464/fd fuser File opened for reading /proc/1039/maps fuser File opened for reading /proc/1062/maps fuser File opened for reading /proc/1259/fd fuser File opened for reading /proc/664/fd fuser File opened for reading /proc/908/fd fuser File opened for reading /proc/24/fd fuser File opened for reading /proc/86/fd fuser File opened for reading /proc/177/fd fuser File opened for reading /proc/979/fd fuser File opened for reading /proc/1254/fd fuser File opened for reading /proc/1318/fd fuser File opened for reading /proc/719/fd fuser File opened for reading /proc/1/fd fuser File opened for reading /proc/500/fd fuser File opened for reading /proc/566/fd fuser File opened for reading /proc/582/fd fuser File opened for reading /proc/658/fd fuser File opened for reading /proc/1047/fd fuser File opened for reading /proc/1057/maps fuser File opened for reading /proc/83/fd fuser File opened for reading /proc/98/fd fuser File opened for reading /proc/530/fd fuser File opened for reading /proc/1060/fd fuser File opened for reading /proc/1091/maps fuser File opened for reading /proc/1171/fd fuser File opened for reading /proc/1317/maps fuser File opened for reading /proc/1318/maps fuser File opened for reading /proc/3/fd fuser File opened for reading /proc/11/fd fuser File opened for reading /proc/974/fd fuser File opened for reading /proc/1184/fd fuser File opened for reading /proc/1349/maps fuser - Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/httpd.log 095f94d00e98369b361f32f883164f6e6ee07d71da489efbfdd328e76c2e9def
Processes
-
/tmp/095f94d00e98369b361f32f883164f6e6ee07d71da489efbfdd328e76c2e9def/tmp/095f94d00e98369b361f32f883164f6e6ee07d71da489efbfdd328e76c2e9def1⤵
- Writes file to tmp directory
PID:1540 -
/bin/fuserfuser -k 80/tcp2⤵
- Enumerates active TCP sockets
- Reads process memory
- Reads system network configuration
- Reads runtime system information
PID:1541
-
-
/bin/sleepsleep 12⤵PID:1547
-
-
/bin/chmodchmod +x /opt/meownet/payload-server2⤵
- File and Directory Permissions Modification
PID:1552
-
-
/usr/bin/nohupnohup /opt/meownet/payload-server /opt/meownet/bins 801⤵PID:1553
-
/opt/meownet/payload-server/opt/meownet/payload-server /opt/meownet/bins 801⤵PID:1553
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /tmp/httpd.log
- Size 86B
- SHA256 2ff61e748694650c199a711b6649e3da77c8bba4638f85a2da0e913d0ff2563b
- MD5 41c2dd14d093f23eb6d43b358db1303f
- SHA1 43d0511fb2e6f7b75116521dfa99849faa319f3e
- SHA512 13b88d1973c884ad6867c9a7fff6af5a3048a01c74d7c024851f4c61ce16c105c6028278248a8a8026bc04839ceb4747a61ad5bcd0bc6736f80a88931805aca1
- TLSH T1C4A0121389C8701974D1400003C4E9214509060F230C60210220150FB8200F161C94C1
- MD5 SHA1 SHA512 TLSH