d5732d498ebf72b115e6fb6a8ddb0de33df4f0919ed6f54324e943c5e2aeb04a

Analysis

max time kernel
0s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
09/08/2026, 02:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d5732d498ebf72b115e6fb6a8ddb0de33df4f0919ed6f54324e943c5e2aeb04a
Size 3KB
Sample260809-c7c4jsgm51
SHA256 d5732d498ebf72b115e6fb6a8ddb0de33df4f0919ed6f54324e943c5e2aeb04a
MD5 332dc90cb68f062ad6879f0c8b8dbc04
SHA1 1f0e11a3c13344c7a6e03c54663ff50b6353d359
SHA512 1491f156f9322a3cc7aa26bd359cffb1487b8aed6ed3f78e41cf9b6e359f61e53fdc1137ef4011ffca43b7b94dae6dfd6c1db7d226c6d159254de25de7a48706
TLSH
T1F86111D07755D033F3F5B88A8091B23AE3B16C9F9283F95574AE86888F0838DD9585F4
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1502	chmod

Creates/modifies environment variables 1 TTPs 1 IoCs

Creating/modifying environment variables is a common persistence mechanism.

persistence privilege_escalation defense_evasion

Path Interception by PATH Environment Variable

T1574.007

description	ioc	Process
File opened for modification	/root/.bashrc	d5732d498ebf72b115e6fb6a8ddb0de33df4f0919ed6f54324e943c5e2aeb04a

Modifies Bash startup script 2 TTPs 1 IoCs

persistence

Boot or Logon Autostart Execution

T1547

Unix Shell Configuration Modification

T1546.004

description	ioc	Process
File opened for modification	/root/.bashrc	d5732d498ebf72b115e6fb6a8ddb0de33df4f0919ed6f54324e943c5e2aeb04a

Reads runtime system information 3 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	ls

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/sh-thd.zo1cqX	d5732d498ebf72b115e6fb6a8ddb0de33df4f0919ed6f54324e943c5e2aeb04a
File opened for modification	/tmp/sh-thd.lBd7Q0	d5732d498ebf72b115e6fb6a8ddb0de33df4f0919ed6f54324e943c5e2aeb04a

/tmp/d5732d498ebf72b115e6fb6a8ddb0de33df4f0919ed6f54324e943c5e2aeb04a
/tmp/d5732d498ebf72b115e6fb6a8ddb0de33df4f0919ed6f54324e943c5e2aeb04a
1⤵
- Creates/modifies environment variables
- Modifies Bash startup script
- Writes file to tmp directory
PID:1492
- /bin/ln
  ln -sfn /opt/meownet /root/meownet
  2⤵
  PID:1493
- /bin/ln
  ln -sfn /opt/meownet/bins /root/bins
  2⤵
  PID:1494
- /bin/ln
  ln -sfn /opt/meownet/exploits /root/exploits
  2⤵
  PID:1495
- /bin/ln
  ln -sfn /opt/meownet/lists /root/lists
  2⤵
  PID:1496
- /bin/ln
  ln -sfn /opt/meownet/logs /root/logs
  2⤵
  PID:1497
- /bin/cp
  cp -f /opt/meownet/cnc.sh /root/cnc.sh
  2⤵
  - Reads runtime system information
  PID:1498
- /bin/cp
  cp -f /opt/meownet/start_loaders.sh /root/start_loaders.sh
  2⤵
  - Reads runtime system information
  PID:1501
- /bin/chmod
  chmod +x /root/cnc.sh /root/start_loaders.sh /opt/meownet/cnc.sh /opt/meownet/start_loaders.sh
  2⤵
  - File and Directory Permissions Modification
  PID:1502
- /bin/cat
  cat
  2⤵
  PID:1503
- /bin/grep
  grep -q MeowNet /root/.bashrc
  2⤵
  PID:1504
- /bin/cat
  cat
  2⤵
  PID:1505
- /usr/bin/head
  head -40
  2⤵
  PID:1507
- /bin/ls
  ls -la /root/
  2⤵
  - Reads runtime system information
  PID:1506

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

T1574.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

T1574.007

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

T1574.007

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sh-thd.zo1cqX

Path /tmp/sh-thd.zo1cqX
Size 2KB
SHA256 92239ed71c305a0d5f6557f02678ee0ce320d1f25b14d8fd2bd923df0f098cfd
MD5 233d8147c7394234ded36f53440c4ff6
SHA1 ce32c2dc2ee849cd59f54b9b457cb846b574e2a0
SHA512 557c36d99b657ea2fbb1a9253bff72d62d53865c3af2ea8916cfccad6e1aba6a8ed81d147cf4483c3076f3408617da42e7a52b0ae68cc4674b6586491324d3e8
TLSH
T145410FD02659D073A3E6E98FC081723AE3707D97E392BC1574DF82D48B0935A9A586F4
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads