e78bc0ed5328a2f3eb204e8717a2ea8ba839bee32b4780f9dd248fbac11a0773

Analysis

max time kernel
3s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
09/08/2026, 02:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e78bc0ed5328a2f3eb204e8717a2ea8ba839bee32b4780f9dd248fbac11a0773
Size 4KB
Sample260809-c7b69agm5z
SHA256 e78bc0ed5328a2f3eb204e8717a2ea8ba839bee32b4780f9dd248fbac11a0773
MD5 aef54f2b399603800d665a10126a64d5
SHA1 4f1ce843c3e725b250b3cfd0bf5ab6971729cb53
SHA512 0a4d707ceb8d865cef582bb7ba9c206ed3e6bfda4f2c6cd9492d5f951f9ca0e97616ccf541fd8bac34d6ec2d3ac24f82eb61e1ec5aa4b4b89f3067e50f272f98
SSDEEP 96:oBuOBp+G1SU5Zb5PQPOjRNLXwVRa1PeycgeXyB3rYlk7GiQQEOJ5OtYuUvnUB:oBuOBp+GYUBIyVXwVRpelotY1u
TLSH
T1749122C07A6994B3F5FED5459184A5B5F3846C8F8743BE5C302F86AC5B883C8E09D1E0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 4 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
733	chmod
736	chmod
738	chmod
731	chmod

Creates/modifies environment variables 1 TTPs 1 IoCs

Creating/modifying environment variables is a common persistence mechanism.

persistence privilege_escalation defense_evasion

Path Interception by PATH Environment Variable

T1574.007

description	ioc	Process
File opened for modification	/root/.bashrc	e78bc0ed5328a2f3eb204e8717a2ea8ba839bee32b4780f9dd248fbac11a0773

Enumerates running processes
Discovers information about currently running processes on the system

Modifies Bash startup script 2 TTPs 1 IoCs

persistence

Boot or Logon Autostart Execution

T1547

Unix Shell Configuration Modification

T1546.004

description	ioc	Process
File opened for modification	/root/.bashrc	e78bc0ed5328a2f3eb204e8717a2ea8ba839bee32b4780f9dd248fbac11a0773

Reads CPU attributes 1 TTPs 2 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/331/cmdline	pgrep
File opened for reading	/proc/29/cmdline	pgrep
File opened for reading	/proc/641/status	pgrep
File opened for reading	/proc/317/cmdline	pgrep
File opened for reading	/proc/593/status	pgrep
File opened for reading	/proc/639/cmdline	pgrep
File opened for reading	/proc/12/status	pgrep
File opened for reading	/proc/16/status	pgrep
File opened for reading	/proc/143/cmdline	pgrep
File opened for reading	/proc/636/cmdline	pgrep
File opened for reading	/proc/6/status	pgrep
File opened for reading	/proc/288/cmdline	pgrep
File opened for reading	/proc/594/cmdline	pgrep
File opened for reading	/proc/141/status	pgrep
File opened for reading	/proc/24/status	pgrep
File opened for reading	/proc/28/status	pgrep
File opened for reading	/proc/163/cmdline	pgrep
File opened for reading	/proc/226/status	pgrep
File opened for reading	/proc/317/status	pgrep
File opened for reading	/proc/7/cmdline	pgrep
File opened for reading	/proc/639/cmdline	pgrep
File opened for reading	/proc/646/cmdline	pgrep
File opened for reading	/proc/sys/kernel/osrelease	pgrep
File opened for reading	/proc/103/status	pgrep
File opened for reading	/proc/315/status	pgrep
File opened for reading	/proc/103/status	pgrep
File opened for reading	/proc/636/cmdline	pgrep
File opened for reading	/proc/113/status	pgrep
File opened for reading	/proc/147/status	pgrep
File opened for reading	/proc/15/cmdline	pgrep
File opened for reading	/proc/41/cmdline	pgrep
File opened for reading	/proc/4/status	pgrep
File opened for reading	/proc/19/cmdline	pgrep
File opened for reading	/proc/308/cmdline	pgrep
File opened for reading	/proc/7/status	pgrep
File opened for reading	/proc/11/status	pgrep
File opened for reading	/proc/584/status	pgrep
File opened for reading	/proc/593/status	pgrep
File opened for reading	/proc/8/cmdline	pgrep
File opened for reading	/proc/16/status	pgrep
File opened for reading	/proc/sys/kernel/osrelease	pgrep
File opened for reading	/proc/288/status	pgrep
File opened for reading	/proc/24/cmdline	pgrep
File opened for reading	/proc/81/status	pgrep
File opened for reading	/proc/19/cmdline	pgrep
File opened for reading	/proc/27/status	pgrep
File opened for reading	/proc/19/status	pgrep
File opened for reading	/proc/7/cmdline	pgrep
File opened for reading	/proc/27/cmdline	pgrep
File opened for reading	/proc/25/status	pgrep
File opened for reading	/proc/319/status	pgrep
File opened for reading	/proc/8/status	pgrep
File opened for reading	/proc/647/cmdline	pgrep
File opened for reading	/proc/651/status	pgrep
File opened for reading	/proc/2/status	pgrep
File opened for reading	/proc/43/status	pgrep
File opened for reading	/proc/3/cmdline	pgrep
File opened for reading	/proc/9/cmdline	pgrep
File opened for reading	/proc/22/status	pgrep
File opened for reading	/proc/645/cmdline	pgrep
File opened for reading	/proc/3/status	pgrep
File opened for reading	/proc/324/status	pgrep
File opened for reading	/proc/2/status	pgrep
File opened for reading	/proc/10/status	pgrep

Writes file to tmp directory 7 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/sh-thd.KjNG1s	e78bc0ed5328a2f3eb204e8717a2ea8ba839bee32b4780f9dd248fbac11a0773
File opened for modification	/tmp/sh-thd.cLNTRx	e78bc0ed5328a2f3eb204e8717a2ea8ba839bee32b4780f9dd248fbac11a0773
File opened for modification	/tmp/sh-thd.nFzyrC	e78bc0ed5328a2f3eb204e8717a2ea8ba839bee32b4780f9dd248fbac11a0773
File opened for modification	/tmp/sh-thd.xdG8hH	e78bc0ed5328a2f3eb204e8717a2ea8ba839bee32b4780f9dd248fbac11a0773
File opened for modification	/tmp/sh-thd.SJAbQN	e78bc0ed5328a2f3eb204e8717a2ea8ba839bee32b4780f9dd248fbac11a0773
File opened for modification	/tmp/sh-thd.0KyrwR	e78bc0ed5328a2f3eb204e8717a2ea8ba839bee32b4780f9dd248fbac11a0773
File opened for modification	/tmp/sh-thd.s1UbYo	e78bc0ed5328a2f3eb204e8717a2ea8ba839bee32b4780f9dd248fbac11a0773

/tmp/e78bc0ed5328a2f3eb204e8717a2ea8ba839bee32b4780f9dd248fbac11a0773
/tmp/e78bc0ed5328a2f3eb204e8717a2ea8ba839bee32b4780f9dd248fbac11a0773
1⤵
- Creates/modifies environment variables
- Modifies Bash startup script
- Writes file to tmp directory
PID:649
- /usr/bin/pgrep
  pgrep -f /opt/meownet/server
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:655
- /bin/sleep
  sleep 1
  2⤵
  PID:667
- /usr/bin/pgrep
  pgrep -f /opt/meownet/payload-server
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:678
- /bin/sleep
  sleep 1
  2⤵
  PID:680
- /bin/ln
  ln -sfn /opt/meownet /root/meownet
  2⤵
  PID:721
- /bin/ln
  ln -sfn /opt/meownet/exploits /root/exploits
  2⤵
  PID:723
- /bin/ln
  ln -sfn /opt/meownet/bins /root/bins
  2⤵
  PID:725
- /bin/ln
  ln -sfn /opt/meownet/logs /root/logs
  2⤵
  PID:727
- /bin/ln
  ln -sfn /opt/meownet/lists /root/lists
  2⤵
  PID:728
- /bin/cat
  cat
  2⤵
  PID:730
- /bin/chmod
  chmod +x /root/cnc
  2⤵
  - File and Directory Permissions Modification
  PID:731
- /bin/cat
  cat
  2⤵
  PID:732
- /bin/chmod
  chmod +x /root/status
  2⤵
  - File and Directory Permissions Modification
  PID:733
- /bin/cat
  cat
  2⤵
  PID:734
- /bin/chmod
  chmod +x /root/start_loaders
  2⤵
  - File and Directory Permissions Modification
  PID:736
- /bin/cat
  cat
  2⤵
  PID:737
- /bin/chmod
  chmod +x /root/stop_loaders
  2⤵
  - File and Directory Permissions Modification
  PID:738
- /bin/cat
  cat
  2⤵
  PID:739
- /bin/cat
  cat
  2⤵
  PID:740
- /bin/grep
  grep -q MeowNet /root/.bashrc
  2⤵
  PID:741
- /bin/cat
  cat
  2⤵
  PID:742
- /bin/ls
  ls -la /root/
  2⤵
  PID:743
- /usr/bin/head
  head -40
  2⤵
  PID:744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

T1574.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

T1574.007

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

T1574.007

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BOTS.txt

Path /root/BOTS.txt
Size 1KB
SHA256 dd90be80089968316e6c88e64dbe3c3674f5bf3eba0e6f6570a5a8a349ee36e1
MD5 d8a4e396f1fd782eaca9380adb3b6bbe
SHA1 b217be7fed366339e384d59a34d2714513c2da55
SHA512 d22e5d08292bd058a1b566333cb43c254049a8fc1bae1b85a780812f4d84b2bb0adf5630f2ab32f5e1715c6ae782cc2b7532d930ccf5048a37de26f6825e1e7b
TLSH
T11921C0645E086593DAF1CA968285DDD1FBC4118EA340AE94B44FC3503B0E3EBD09E550
MD5 SHA1 SHA512 TLSH

Submit Download

README_PUTTY.txt

Path /root/README_PUTTY.txt
Size 724B
SHA256 2b1b47d158a6b426566597e2c1fea7d429b60fd064bdea8e3a15e31bf6185dea
MD5 fca16377742d0acd61687339ac9cc73d
SHA1 082424c1cde34eea9e99a58cba02deaafa4d2fa3
SHA512 5dbd94ebda40902dcf76a4e8f3b3fb41f47ce228f31e3c08ec91f5405f9e9d286876afd7fe3402de0a44304c50e5baebfd54edc9bd662b9bb487d796a7284bc0
TLSH
T1AA01CB8121E48A3DF29FD50CD241A1B18660BF63D681FCAC30ECC39853EB8D2E10A4F8
MD5 SHA1 SHA512 TLSH

Submit Download

start_loaders

Path /root/start_loaders
Size 47B
SHA256 4e8d6a3618a09abd4bc55f8ddd1b8be4cee2d5139dbb1e72a92f0ecb296a5b81
MD5 990a525f16f63b23361c764c2bf123b5
SHA1 dbb7094f8fae6ea17e0d09511de579cf3dababc1
SHA512 862583ca705c4907dba48b4c4a45d3f44e451bb22829bd31ca70ff4521ff59d7704751fdbb4419f5ac7530fb40aa0922bbdf2c402bbb1fdecdd8f063f6717c76
MD5 SHA1 SHA512

Submit Download

status

Path /root/status
Size 595B
SHA256 4425561fe7f6e379653f43a34ccc89e6dfed4ede533d44da2717892854572c0b
MD5 78f119cac038cfffa1720088b63d1205
SHA1 b667f4149e087f3af811f249b499ab739f9a10b5
SHA512 b74dee911d8e6a07a086a663d8873d41d015b2a3697db721612885dcee20e47fbfa5c359628928e92ea71d6d39cbfe1ce1bb5d52d2ea2a721d5639fad7c7a257
TLSH
T11BF024E53298B8B274EC5A36ACD0A937B3485C4B465A1F1D8013A97D86C83C834BE264
MD5 SHA1 SHA512 TLSH

Submit Download

stop_loaders

Path /root/stop_loaders
Size 241B
SHA256 96a4c6e6e3b13cebb53d5afa5e04bcd2dca70e5be9c7edc0f1f20b4dc611716a
MD5 2ac887c8db47d50083bc023d32199f52
SHA1 363542e6b513097e1917a6ddcf02461ec1ebee1b
SHA512 e862db58bf0cf1bc9808b02987216ba0b2b7a0ece99743a0ebbb3c9c612ebbb1666c94ef30bec6b45d716bafb9c0426747ef0820c1b8a426074269e21c210a56
TLSH
T125D0A7CDB435CCB129D8945978A01364F78018AFC1973659C7395A2E87CC3D89B5A3A9
MD5 SHA1 SHA512 TLSH

Submit Download

sh-thd.s1UbYo

Path /tmp/sh-thd.s1UbYo
Size 363B
SHA256 197231c33d180b550618ebb3a2ef350066376d319129d3066d55355ed15b6be2
MD5 817b235b570a2126c6f5dd148a3b7877
SHA1 c7f61167732c27fca1991f790eaf1c85b4717c1c
SHA512 3e4b3b0f4c7a3950a9c210dad1ededdaee18aa3e14bc23e46e1fd6d185f4c25025c301ae2e1fe4a4304511930d60d77bcc9f79a1a82f9737ca8d21592427641d
TLSH
T1CBE068C8321C372382CBCA201C7040F0F24305FF14410E3C201A89F745142C571AE253
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads