Analysis
- max time kernel
1s - platform
debian-9_armhf - resource
debian9-armhf-20260513-en - resource tags
arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem - submitted
09/08/2026, 02:42
Static task
static1
Behavioral task
behavioral1
Sample
095f94d00e98369b361f32f883164f6e6ee07d71da489efbfdd328e76c2e9def
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
095f94d00e98369b361f32f883164f6e6ee07d71da489efbfdd328e76c2e9def
Resource
debian9-armhf-20260513-en
debian-9-armhf
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
095f94d00e98369b361f32f883164f6e6ee07d71da489efbfdd328e76c2e9def
Resource
debian9-mipsbe-20260513-en
debian-9-mips
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
095f94d00e98369b361f32f883164f6e6ee07d71da489efbfdd328e76c2e9def
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
0 signatures
150 seconds
General
- Target 095f94d00e98369b361f32f883164f6e6ee07d71da489efbfdd328e76c2e9def
- Size 207B
- Sample260809-c685lagm5w
- SHA256 095f94d00e98369b361f32f883164f6e6ee07d71da489efbfdd328e76c2e9def
- MD5 135704368ab3ec3efa4fe662d01a4e06
- SHA1 8e00df8abdb1162d89089f6ef8d721ccaf193915
- SHA512 8098997676ffc801b783090879aadf38d17413effc6f5217d463b4fd9fab06f93df0d64713205886da847193507c21e38bb2afaeb4412e00b2d233ca47609431
- TLSH T17FD022C0B4C4A43BFAEC70452A05FAAB430B2C2F2B10828022614C22F84C2EC30C79A1
- MD5 SHA1 SHA512 TLSH
Score
7/10
Malware Config
Signatures
- File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 671 chmod - Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp fuser - Enumerates running processes
Discovers information about currently running processes on the system
- Reads process memory 1 TTPs 64 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/279/maps fuser File opened for reading /proc/42/maps fuser File opened for reading /proc/294/maps fuser File opened for reading /proc/642/maps fuser File opened for reading /proc/137/maps fuser File opened for reading /proc/138/maps fuser File opened for reading /proc/632/maps fuser File opened for reading /proc/11/maps fuser File opened for reading /proc/18/maps fuser File opened for reading /proc/641/maps fuser File opened for reading /proc/12/maps fuser File opened for reading /proc/13/maps fuser File opened for reading /proc/19/maps fuser File opened for reading /proc/6/maps fuser File opened for reading /proc/22/maps fuser File opened for reading /proc/24/maps fuser File opened for reading /proc/27/maps fuser File opened for reading /proc/580/maps fuser File opened for reading /proc/634/maps fuser File opened for reading /proc/9/maps fuser File opened for reading /proc/10/maps fuser File opened for reading /proc/26/maps fuser File opened for reading /proc/303/maps fuser File opened for reading /proc/639/maps fuser File opened for reading /proc/1/maps fuser File opened for reading /proc/21/maps fuser File opened for reading /proc/29/maps fuser File opened for reading /proc/584/maps fuser File opened for reading /proc/649/maps fuser File opened for reading /proc/25/maps fuser File opened for reading /proc/73/maps fuser File opened for reading /proc/272/maps fuser File opened for reading /proc/275/maps fuser File opened for reading /proc/28/maps fuser File opened for reading /proc/135/maps fuser File opened for reading /proc/655/maps fuser File opened for reading /proc/103/maps fuser File opened for reading /proc/167/maps fuser File opened for reading /proc/320/maps fuser File opened for reading /proc/626/maps fuser File opened for reading /proc/645/maps fuser File opened for reading /proc/15/maps fuser File opened for reading /proc/94/maps fuser File opened for reading /proc/325/maps fuser File opened for reading /proc/578/maps fuser File opened for reading /proc/16/maps fuser File opened for reading /proc/209/maps fuser File opened for reading /proc/17/maps fuser File opened for reading /proc/23/maps fuser File opened for reading /proc/41/maps fuser File opened for reading /proc/305/maps fuser File opened for reading /proc/309/maps fuser File opened for reading /proc/640/maps fuser File opened for reading /proc/2/maps fuser File opened for reading /proc/5/maps fuser File opened for reading /proc/105/maps fuser File opened for reading /proc/585/maps fuser File opened for reading /proc/650/maps fuser File opened for reading /proc/3/maps fuser File opened for reading /proc/20/maps fuser File opened for reading /proc/156/maps fuser File opened for reading /proc/565/maps fuser File opened for reading /proc/4/maps fuser File opened for reading /proc/7/maps fuser - Reads system network configuration 1 TTPs 3 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/unix fuser File opened for reading /proc/net/tcp fuser File opened for reading /proc/net/tcp6 fuser -
description ioc Process File opened for reading /proc/2/fd fuser File opened for reading /proc/167/fd fuser File opened for reading /proc/mounts fuser File opened for reading /proc/73/fd fuser File opened for reading /proc/640/fd fuser File opened for reading /proc/10/fd fuser File opened for reading /proc/22/fd fuser File opened for reading /proc/41/fd fuser File opened for reading /proc/42/fd fuser File opened for reading /proc/294/fd fuser File opened for reading /proc/303/fd fuser File opened for reading /proc/309/fd fuser File opened for reading /proc/634/fd fuser File opened for reading /proc/3/fd fuser File opened for reading /proc/11/fd fuser File opened for reading /proc/25/fd fuser File opened for reading /proc/105/fd fuser File opened for reading /proc/5/fd fuser File opened for reading /proc/14/fd fuser File opened for reading /proc/17/fd fuser File opened for reading /proc/138/fd fuser File opened for reading /proc/16/fd fuser File opened for reading /proc/21/fd fuser File opened for reading /proc/23/fd fuser File opened for reading /proc/24/fd fuser File opened for reading /proc/632/fd fuser File opened for reading /proc/15/fd fuser File opened for reading /proc/28/fd fuser File opened for reading /proc/137/fd fuser File opened for reading /proc/272/fd fuser File opened for reading /proc/578/fd fuser File opened for reading /proc/580/fd fuser File opened for reading /proc/6/fd fuser File opened for reading /proc/19/fd fuser File opened for reading /proc/43/fd fuser File opened for reading /proc/655/fd fuser File opened for reading /proc/8/fd fuser File opened for reading /proc/13/fd fuser File opened for reading /proc/106/fd fuser File opened for reading /proc/585/fd fuser File opened for reading /proc/20/fd fuser File opened for reading /proc/209/fd fuser File opened for reading /proc/275/fd fuser File opened for reading /proc/565/fd fuser File opened for reading /proc/639/fd fuser File opened for reading /proc/swaps fuser File opened for reading /proc/self/mountinfo fuser File opened for reading /proc/626/fd fuser File opened for reading /proc/649/fd fuser File opened for reading /proc/9/fd fuser File opened for reading /proc/27/fd fuser File opened for reading /proc/279/fd fuser File opened for reading /proc/305/fd fuser File opened for reading /proc/642/fd fuser File opened for reading /proc/fs/nfs/exports fuser File opened for reading /proc/7/fd fuser File opened for reading /proc/103/fd fuser File opened for reading /proc/584/fd fuser File opened for reading /proc/4/fd fuser File opened for reading /proc/156/fd fuser File opened for reading /proc/320/fd fuser File opened for reading /proc/641/fd fuser File opened for reading /proc/650/fd fuser File opened for reading /proc/18/fd fuser - Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/httpd.log 095f94d00e98369b361f32f883164f6e6ee07d71da489efbfdd328e76c2e9def
Processes
-
/tmp/095f94d00e98369b361f32f883164f6e6ee07d71da489efbfdd328e76c2e9def/tmp/095f94d00e98369b361f32f883164f6e6ee07d71da489efbfdd328e76c2e9def1⤵
- Writes file to tmp directory
PID:642 -
/bin/fuserfuser -k 80/tcp2⤵
- Enumerates active TCP sockets
- Reads process memory
- Reads system network configuration
- Reads runtime system information
PID:647
-
-
/bin/sleepsleep 12⤵PID:663
-
-
/bin/chmodchmod +x /opt/meownet/payload-server2⤵
- File and Directory Permissions Modification
PID:671
-
-
/usr/bin/nohupnohup /opt/meownet/payload-server /opt/meownet/bins 801⤵PID:672
-
/opt/meownet/payload-server/opt/meownet/payload-server /opt/meownet/bins 801⤵PID:672
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /tmp/httpd.log
- Size 86B
- SHA256 2ff61e748694650c199a711b6649e3da77c8bba4638f85a2da0e913d0ff2563b
- MD5 41c2dd14d093f23eb6d43b358db1303f
- SHA1 43d0511fb2e6f7b75116521dfa99849faa319f3e
- SHA512 13b88d1973c884ad6867c9a7fff6af5a3048a01c74d7c024851f4c61ce16c105c6028278248a8a8026bc04839ceb4747a61ad5bcd0bc6736f80a88931805aca1
- TLSH T1C4A0121389C8701974D1400003C4E9214509060F230C60210220150FB8200F161C94C1
- MD5 SHA1 SHA512 TLSH