7fc9a0c72dc02009b9f74dff03bd6655d103e1ebe58f1355080cacbf2dd2a7e1

Sharing

Copy URL Twitter E-mail

General

Target
Meltype-1.3.0-linux-arm64.zip
Size 20.1MB
Sample261029-2sl6cagy2p
SHA256 7fc9a0c72dc02009b9f74dff03bd6655d103e1ebe58f1355080cacbf2dd2a7e1
MD5 2add32b1dd1845177e66f405cee8116f
SHA1 d7e9083ec5bec9eb8dfbf089208bc64894552fa7
SHA512 6e08b9b515fcf1faa0bfd4275242499b489061264552683cf1b1b046af94c1be6a5da0439b6632476c0f79ca364945a5bb6b74e2361a002249f41ad1fd46dca8
SSDEEP 393216:qrjhMqCO+DEpDXh5LhQpBximIBRWGFvF90MvuSeXVHXFrlO3OI4QsI:OhMhMXh5LhwuWGFT0MmhXXI4y
TLSH
T1922733AD6BA052F697F0D540B6E39C6D8DD93C1051826C7729E3932E419A3C0DBA8F3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Meltype-linux/__pycache__/ibus-engine-meltypecpython-312.pyc
- Size 30KB
- SHA256 ae401520b5783eb6afe2176867ae845c3d38968481a343c1dbbbb23142d97e80
- MD5 2340805bd137fc19c92dca7c1dbca11e
- SHA1 b40a5c61da998749028baae0031b7c99586ebf2a
- SHA512 003f6abd2dcf88537dcb711797370b53fae1153c957d78789a961a335fe2e065a479c82c8da0eaaeb111d99ab944157d88847b4fd3b5792714f8d0a663d34c0e
- SSDEEP 384:6EMtYwSJ83yL+D8iru1toAJdnrDxb9FlZulpe98mf8PzDKtyvMIa/z6la9kp3k:niytRpflZwmfqzDKtyvMIa/Oq
- TLSH
  T1D2D2B5C5B2A7C477FCD4B6B54421235EB32984A1F641C72B62BF90392D872D6EC08ADD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  Meltype-linux/fcitx5/meltype.so
- Size 82KB
- SHA256 e43291eb7100b62841b90c6480fb9925feae34ad06db57c4c93eaf51fa042b80
- MD5 490bf8b80031e01d8a9702b2df859984
- SHA1 09644ad9e3394a7e76b04433fdf4e38ad5c8af47
- SHA512 87be21c672fe4501e99cf00b365dede1ea65cf8cd73afdf91dd08335623a9ea3ef47a12cdd8e6ff64394e53712f8783892e47e4407ee1d2b14a695e054f017c1
- SSDEEP 768:DMPbbjPaYpvEXqjZt19ZiQBJlop2gEJ8IZKiW7eoQdy:APbX7vZt19ZiQ/lW+JmOoQdy
- TLSH
  T153830931BE1FDC26EDCE6B3D5BEB1656F63A5C24D22582731548850C4EC2BCA8B2B744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4 behavioral5 behavioral6
- Target
  Meltype-linux/ibus-engine-meltype
- Size 24KB
- SHA256 0aaf9064f3100a9b3470f088eb83fd254076d2d0b928124d3a42b348dd6a93af
- MD5 a7a24063f3e512c1f5465db09349c64e
- SHA1 d3d3dc61b90dfc900ed545afb00a5188e12672de
- SHA512 d06b3997c8e573c8c2ca1ef00588380cd483fedab835ca2f6ffefdbe50a68b4dd07ab3de37041c17f72d5fdec6851e56590a76651294e66265de0db693d3bfd4
- SSDEEP 384:ieTz3+1+T5XkRt8zhXeugZ+Zgrl1UlGmz92VR0z3AB5KnJc4lbfhqIeMMM75o:ieTiLtqxREUQB5KLDMIeC75o
- TLSH
  T13BB298FDA59A9C2187478A569852A453730E7C47E8481B387CFD8034BF695AED0E0FF8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral7 behavioral8 behavioral9
- Target
  Meltype-linux/install.sh
- Size 4KB
- SHA256 0055c26a181520f12ba0083fd836cd31a62fc27b7cc150ba4f4e543eb83ee803
- MD5 11a999efb8f7e619e2bf1f03071d9028
- SHA1 1a55544045ed86d8dd4bfc8aeb5ff47513e0300f
- SHA512 afb2cb3d3a8a494cb7d22e50ba4340079bdf95e75988960a8e7a2bc8113ab81a5e75fdf7e392bc6c49c42dbc868dbe543085876c665f1e97bccb0b590e36487d
- SSDEEP 48:tE+boG7y8t5CeBy9zG5O3OIQEkr5i9PtK5bMiQkfeYPafD9/MCYroizNPgn1CDD7:miRByLOXxr6PwaiQk4JUCQoi+CDD7
- TLSH
  T11991733E7658C6B52A88435A0D1366C5EE0D6CCFED09BE24347ED4667F246ADF088731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery privilege_escalation credential_access execution persistence antivm
- File and Directory Permissions Modification
  Adversaries may modify file or directory permissions to evade defenses.
  defense_evasion
- Executes dropped EXE
- OS Credential Dumping
  Adversaries may attempt to dump credentials to use it in password cracking.
  credential_access
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  Abuse sudo or cached sudo credentials to execute code.
  privilege_escalation defense_evasion
- Deletes log files
  Deletes log files on the system.
  defense_evasion
- Write file to user bin folder
  persistence
behavioral11 behavioral12 behavioral13 behavioral14
- Target
  Meltype-linux/libMeltypeNative.so
- Size 14.2MB
- SHA256 9ad3f5a5a3ef94f786b41aa01e7c50e861eb6a42bebc7791af811065ec5189ac
- MD5 df2f9796b6a435890f8a1b7b4d0270b9
- SHA1 aa2bb978653d366d63631d46cf0b9f5e5a820a44
- SHA512 d78fbc5727af9b811fa7d6f77bcc478dc862cbab459a4c2d67eab15d53f37c762d0bdfcb2b83eb31814411bbd5a8a5e681e1f37f1570ddbcbcba9cbaaf770e22
- SSDEEP 98304:6JGLFb5s4VUXP43Jg4GchVsj1xx1gTE6pIzQv4cNh9bT4mLFNmpD7:nXsCUA5g4zVsj11gTETz3cNhNrLFNi
- TLSH
  T1D7E67D94924E3C2AE2C7E27CDD4A4BF5712FFE62C22450FCB41E60A4897AAC5DB71531
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16 behavioral17 behavioral18
- Target
  Meltype-linux/mozc/MOZC-CREDITS.html
- Size 33KB
- SHA256 dd7c566382204f448040095e5d3c2f2b5199a1b85d44f427ceb94277dc04af50
- MD5 0674f036581cdf6670f967985e92fa51
- SHA1 f5cab60ffc0213c5549cede4fa0b248ceb39ab01
- SHA512 ab56c6f30623f7b9a46392d802f360d2ef6ff0b01967de30b912b04dd1643a1ac6f032f542773507afaa74d6b893e795e2ab66ed825ed0ca06f3b15f405d4a06
- SSDEEP 768:5VsDL2ITzJlFvAfxk1UEgiWi4LtXAFZDL6v5Oe47gv10tG:5VS2IfJIa1UEgiWiUwFZ6hOL7gv10tG
- TLSH
  T11BF2A57BA344037706C301A1BA8B69CAB36E903E3B67591434ADD21C1B27D79D3B72D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  Meltype-linux/mozc/meltype_mozc_helper
- Size 22.8MB
- SHA256 36fd8577278285f9cc94ee64e8c0d4655d3496e7fd4af850e5d7c49e004ec982
- MD5 5f0e5114df15af85c707a04429b8932e
- SHA1 1d10517bc3b734e69640ccfd621213bc51d9639c
- SHA512 013c09e5a1ce6eba1820c670ab8033b13b01a71b377f60d84b87ab6a8cd43364222f9f6a0f3a1154433152c70f96da483fb432d7c0fc009e71e5827a423da73c
- SSDEEP 393216:2NG1ZZRoPhzuNJh9nH5H9hAt0ubNgGOj7kB5eyEdu4DQTpm:usjL9Z/d8eKgu4ETU
- TLSH
  T14037E017D06ACC21F809F2B8A9468245F727ADE0E1454BEFEA4C7328DD3B9C4FB51916
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22 behavioral23 behavioral24
- Target
  Meltype-linux/uninstall.sh
- Size 1KB
- SHA256 467997e06760bdb3eb3506acd4ddb2adf140e7c59f710d01e948689af17512d1
- MD5 6dab3cfeec4d1c79b43a99fbca47a307
- SHA1 903986919823baa9a90737f01d02b4940721d440
- SHA512 829f095f5b6d2614beef2d791ff95fd8820d5aaf1ac6f2bb21691f0a99538f7fb18ea11610515efe20f767c6f17abe7fdb0a35fe0d694398179a88bc1d2f297f
- TLSH
  T113211174BA6D48B16CC843DB251B8084EBC93CD6D4AB575020BFF433681874EB089B39
- MD5 SHA1 SHA512 TLSH
Score

6^/10

defense_evasion discovery privilege_escalation
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  Abuse sudo or cached sudo credentials to execute code.
  privilege_escalation defense_evasion
- Enumerates running processes
  Discovers information about currently running processes on the system
behavioral25 behavioral26 behavioral27 behavioral28