9c6f9d84e73cf7510e00ffd3b06295c1b303ce66264c48780ef81ba69580705c

Analysis

max time kernel
4s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
09/08/2026, 02:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9c6f9d84e73cf7510e00ffd3b06295c1b303ce66264c48780ef81ba69580705c
Size 2KB
Sample260809-c7emdagm6w
SHA256 9c6f9d84e73cf7510e00ffd3b06295c1b303ce66264c48780ef81ba69580705c
MD5 2378eeb5680b42556cf61bdc66aa3d3c
SHA1 4907db23affd1dd6f98fb18c6a8c99bf1f832c17
SHA512 1d554d5bbad9e59ed1144f670734717fdcfcc7318615e602af9389a4e4dfb82175ea6ae1775f3af645108ca46c2d65ace0622a1f40f93ba3ff5b99685e5402a4
TLSH
T1AC4162C8F834EA3E7FDCAD119C529CCAF72724EF21E27913B102562D80881D7E1515B1
MD5 SHA1 SHA512 TLSH

Score

6^/10

discovery

Malware Config

Signatures

Enumerates running processes
Discovers information about currently running processes on the system

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
743	ps

Reads CPU attributes 1 TTPs 8 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/593/cmdline	pkill
File opened for reading	/proc/74/status	pkill
File opened for reading	/proc/28/cmdline	pgrep
File opened for reading	/proc/106/status	pgrep
File opened for reading	/proc/9/cmdline	pgrep
File opened for reading	/proc/16/status	pkill
File opened for reading	/proc/139/status	pkill
File opened for reading	/proc/648/cmdline	pkill
File opened for reading	/proc/9/cmdline	pkill
File opened for reading	/proc/26/status	pkill
File opened for reading	/proc/6/status	pgrep
File opened for reading	/proc/10/cmdline	pgrep
File opened for reading	/proc/313/status	pgrep
File opened for reading	/proc/19/status	pkill
File opened for reading	/proc/592/status	pkill
File opened for reading	/proc/23/status	pkill
File opened for reading	/proc/18/cmdline	pkill
File opened for reading	/proc/105/status	pkill
File opened for reading	/proc/286/status	pkill
File opened for reading	/proc/7/status	ps
File opened for reading	/proc/283/cmdline	ps
File opened for reading	/proc/588/stat	ps
File opened for reading	/proc/103/cmdline	pkill
File opened for reading	/proc/156/status	pkill
File opened for reading	/proc/6/cmdline	ps
File opened for reading	/proc/17/cmdline	ps
File opened for reading	/proc/26/status	pkill
File opened for reading	/proc/106/cmdline	pkill
File opened for reading	/proc/19/cmdline	pkill
File opened for reading	/proc/278/cmdline	pkill
File opened for reading	/proc/671/cmdline	pgrep
File opened for reading	/proc/18/cmdline	pgrep
File opened for reading	/proc/1/status	pkill
File opened for reading	/proc/139/status	pkill
File opened for reading	/proc/sys/kernel/pid_max	ps
File opened for reading	/proc/649/cmdline	pkill
File opened for reading	/proc/313/status	pkill
File opened for reading	/proc/208/status	pgrep
File opened for reading	/proc/313/status	pgrep
File opened for reading	/proc/18/status	ps
File opened for reading	/proc/106/cmdline	ps
File opened for reading	/proc/17/cmdline	pkill
File opened for reading	/proc/106/status	pkill
File opened for reading	/proc/310/cmdline	pkill
File opened for reading	/proc/280/status	pgrep
File opened for reading	/proc/1/status	ps
File opened for reading	/proc/732/status	ps
File opened for reading	/proc/13/cmdline	pkill
File opened for reading	/proc/sys/kernel/osrelease	pgrep
File opened for reading	/proc/25/status	pgrep
File opened for reading	/proc/650/cmdline	pgrep
File opened for reading	/proc/21/stat	ps
File opened for reading	/proc/26/status	pkill
File opened for reading	/proc/136/cmdline	pkill
File opened for reading	/proc/314/cmdline	pkill
File opened for reading	/proc/27/cmdline	pkill
File opened for reading	/proc/208/cmdline	pkill
File opened for reading	/proc/585/cmdline	pkill
File opened for reading	/proc/286/stat	ps
File opened for reading	/proc/8/cmdline	pkill
File opened for reading	/proc/653/cmdline	pgrep
File opened for reading	/proc/20/status	pgrep
File opened for reading	/proc/592/cmdline	pgrep
File opened for reading	/proc/27/stat	ps

System Network Configuration Discovery 1 TTPs 5 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
696	nohup
696	python3
696	python3
696	python3
696	python3

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/meow.log	9c6f9d84e73cf7510e00ffd3b06295c1b303ce66264c48780ef81ba69580705c

/tmp/9c6f9d84e73cf7510e00ffd3b06295c1b303ce66264c48780ef81ba69580705c
/tmp/9c6f9d84e73cf7510e00ffd3b06295c1b303ce66264c48780ef81ba69580705c
1⤵
- Writes file to tmp directory
PID:650
- /bin/mkdir
  mkdir -p /opt/meownet/logs /opt/meownet/lists /opt/meownet/exploits
  2⤵
  PID:656
- /usr/bin/pkill
  pkill -f yarn_loader.py
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:660
- /usr/bin/pkill
  pkill -f adb_loader.py
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:669
- /usr/bin/pkill
  pkill -f telnet_loader.py
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:676
- /usr/bin/pkill
  pkill -f hadoop_meow
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:680
- /usr/bin/pkill
  pkill -f aggressive_exploit.py
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:682
- /bin/sleep
  sleep 1
  2⤵
  PID:683
- /usr/bin/pgrep
  pgrep -f /opt/meownet/server
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:685
- /usr/bin/pgrep
  pgrep -f payload-server
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:689
- /usr/bin/nohup
  nohup /opt/meownet/server
  2⤵
  PID:688
- /opt/meownet/server
  /opt/meownet/server
  2⤵
  PID:688
- /usr/bin/nohup
  nohup /opt/meownet/payload-server /opt/meownet/bins 80
  2⤵
  PID:692
- /opt/meownet/payload-server
  /opt/meownet/payload-server /opt/meownet/bins 80
  2⤵
  PID:692
- /usr/bin/nohup
  nohup python3 /opt/meownet/exploits/yarn_loader.py /opt/meownet/lists/yarn_all_ips.txt
  2⤵
  - System Network Configuration Discovery
  PID:696
- /usr/local/sbin/python3
  python3 /opt/meownet/exploits/yarn_loader.py /opt/meownet/lists/yarn_all_ips.txt
  2⤵
  - System Network Configuration Discovery
  PID:696
- /usr/local/bin/python3
  python3 /opt/meownet/exploits/yarn_loader.py /opt/meownet/lists/yarn_all_ips.txt
  2⤵
  - System Network Configuration Discovery
  PID:696
- /usr/sbin/python3
  python3 /opt/meownet/exploits/yarn_loader.py /opt/meownet/lists/yarn_all_ips.txt
  2⤵
  - System Network Configuration Discovery
  PID:696
- /usr/bin/nohup
  nohup python3 /opt/meownet/exploits/adb_loader.py /opt/meownet/lists/adb_list.txt
  2⤵
  PID:700
- /usr/bin/nohup
  nohup python3 /opt/meownet/exploits/telnet_loader.py random 100000
  2⤵
  PID:701
- /usr/bin/python3
  python3 /opt/meownet/exploits/yarn_loader.py /opt/meownet/lists/yarn_all_ips.txt
  2⤵
  - System Network Configuration Discovery
  PID:696
- /usr/bin/nohup
  nohup python3 /opt/meownet/exploits/aggressive_exploit.py 250
  2⤵
  PID:702
- /bin/sleep
  sleep 2
  2⤵
  PID:703
- /usr/local/sbin/python3
  python3 /opt/meownet/exploits/adb_loader.py /opt/meownet/lists/adb_list.txt
  2⤵
  PID:700
- /usr/local/bin/python3
  python3 /opt/meownet/exploits/adb_loader.py /opt/meownet/lists/adb_list.txt
  2⤵
  PID:700
- /usr/sbin/python3
  python3 /opt/meownet/exploits/adb_loader.py /opt/meownet/lists/adb_list.txt
  2⤵
  PID:700
- /usr/local/sbin/python3
  python3 /opt/meownet/exploits/telnet_loader.py random 100000
  2⤵
  PID:701
- /usr/local/bin/python3
  python3 /opt/meownet/exploits/telnet_loader.py random 100000
  2⤵
  PID:701
- /usr/sbin/python3
  python3 /opt/meownet/exploits/telnet_loader.py random 100000
  2⤵
  PID:701
- /usr/bin/python3
  python3 /opt/meownet/exploits/adb_loader.py /opt/meownet/lists/adb_list.txt
  2⤵
  PID:700
- /usr/local/sbin/python3
  python3 /opt/meownet/exploits/aggressive_exploit.py 250
  2⤵
  PID:702
- /usr/local/bin/python3
  python3 /opt/meownet/exploits/aggressive_exploit.py 250
  2⤵
  PID:702
- /usr/sbin/python3
  python3 /opt/meownet/exploits/aggressive_exploit.py 250
  2⤵
  PID:702
- /usr/bin/python3
  python3 /opt/meownet/exploits/telnet_loader.py random 100000
  2⤵
  PID:701
- /usr/bin/python3
  python3 /opt/meownet/exploits/aggressive_exploit.py 250
  2⤵
  PID:702
- /bin/grep
  grep -E "yarn_loader|adb_loader|telnet_loader|hadoop_meow|aggressive_exploit|meownet/server|payload-server"
  2⤵
  PID:744
- /bin/grep
  grep -v grep
  2⤵
  PID:745
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:743

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

adb_loader.pid

Path /opt/meownet/logs/adb_loader.pid
Size 4B
SHA256 74c3cc29c8e42455948aca1dcc545d258f9d33c51dfd5e90d6cfa6ed5c9da357
MD5 03f846cd4d7de65ac5f80d87d45f183e
SHA1 dd70ba95d8f756aa84b347a981f1545727f1ccb6
SHA512 8c40f4e0d0bfc11cf4a27b1e57d319d3d703b4a37cfe34ad66b90e7f49847b44efb671a0d6f6b43b6f9f1b8a6e9958487e27ad5528094c8618ff7a7411211471
MD5 SHA1 SHA512

Submit Download

aggressive.pid

Path /opt/meownet/logs/aggressive.pid
Size 4B
SHA256 73445aa688fddf09cf8b39ab9ddfc5b006c62e19403dd96825ad2deed8c4a76c
MD5 ef2a0b437dfc14c517768aa8385e72ea
SHA1 3eb8c0938c84ecb497892524591090a1c1b38212
SHA512 6b6f4c4816cf1815290092b639862bcce33ac09cf5c4c54ad564c4b8f63ed3208a5f8f98e375ad8558114eb294a014e72f2f266c09ded6c598b307fd4fcea652
MD5 SHA1 SHA512

Submit Download

payload.log

Path /opt/meownet/logs/payload.log
Size 86B
SHA256 2ff61e748694650c199a711b6649e3da77c8bba4638f85a2da0e913d0ff2563b
MD5 41c2dd14d093f23eb6d43b358db1303f
SHA1 43d0511fb2e6f7b75116521dfa99849faa319f3e
SHA512 13b88d1973c884ad6867c9a7fff6af5a3048a01c74d7c024851f4c61ce16c105c6028278248a8a8026bc04839ceb4747a61ad5bcd0bc6736f80a88931805aca1
TLSH
T1C4A0121389C8701974D1400003C4E9214509060F230C60210220150FB8200F161C94C1
MD5 SHA1 SHA512 TLSH

Submit Download

telnet_loader.pid

Path /opt/meownet/logs/telnet_loader.pid
Size 4B
SHA256 829b4a6ccfd1f37671734b229ecc5a75190996d9e076b2a2271333857472cd56
MD5 2286fab8e79a6b0cc69fef97b81f7191
SHA1 1d4b2cf9690e5875d4a7521ac48802a83361015a
SHA512 063fa1a4f6dffffcaa8eed40e69f4744c655bef5bfbb8fa1b5d292a5c9e0a4b1cac51ddfb1d85d7c13b6caa68c9dbb0c66d3da29acbc1b7b1134f52186770956
MD5 SHA1 SHA512

Submit Download

yarn_loader.pid

Path /opt/meownet/logs/yarn_loader.pid
Size 4B
SHA256 6eb53cfba18d14520e4088356415aa6830438a7ea400fa20662a59a5be731072
MD5 46a7cca16366fc9d6a92ee77d0f2ee9c
SHA1 60219847f031cc8e677ecc73c78afafef1a24647
SHA512 d9a6584b241b4bfb4f02269c1caa44a1a103c9aa8b60b12b06ec95290e77ffdc16c76afa40ba2de254fc95cb274b67d01e49692dd15fcfdb4850f07f51254d08
MD5 SHA1 SHA512

Submit Download

meow.log

Path /tmp/meow.log
Size 78B
SHA256 e1ddd398e2c2f69acae6283b32e5ed4b38a2ef0aa77e8ccfdad080298c246c93
MD5 b22b81d2301b30d9d3fa7149174acc86
SHA1 5bfb1637e8265925215710828bd46482decf9432
SHA512 1016dc80c808b870180a92032e4c35e4f714071172f849e3b0a463ece258df39dd34b79755a02f5f91de6c811f48fdbf1234059a865f8b34f0813dcbd4212019
TLSH
T1C7A022232ECC300EB0E2080003C8EA328A080B8F030C303202383A0FBC300F0A2CE0C2
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads