0055c26a181520f12ba0083fd836cd31a62fc27b7cc150ba4f4e543eb83ee803

Analysis

max time kernel
0s
max time network
130s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20261019-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20261019-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
29/10/2026, 22:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Meltype-linux/install.sh
Size 4KB
Sample261029-2sl6cagy2p
SHA256 0055c26a181520f12ba0083fd836cd31a62fc27b7cc150ba4f4e543eb83ee803
MD5 11a999efb8f7e619e2bf1f03071d9028
SHA1 1a55544045ed86d8dd4bfc8aeb5ff47513e0300f
SHA512 afb2cb3d3a8a494cb7d22e50ba4340079bdf95e75988960a8e7a2bc8113ab81a5e75fdf7e392bc6c49c42dbc868dbe543085876c665f1e97bccb0b590e36487d
SSDEEP 48:tE+boG7y8t5CeBy9zG5O3OIQEkr5i9PtK5bMiQkfeYPafD9/MCYroizNPgn1CDD7:miRByLOXxr6PwaiQk4JUCQoi+CDD7
TLSH
T11991733E7658C6B52A88435A0D1366C5EE0D6CCFED09BE24347ED4667F246ADF088731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1550	sudo
1551	chmod

Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 4 IoCs

Abuse sudo or cached sudo credentials to execute code.

privilege_escalation defense_evasion

Sudo and Sudo Caching

T1548.003

pid	Process
1540	sudo
1546	sudo
1548	sudo
1553	sudo

Changes its process name 2 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	gmain	1559	ibus
Changes the process name, possibly in an attempt to hide itself	gdbus	1561	ibus

Reads runtime system information 31 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/kernel/ngroups_max	sudo
File opened for reading	/proc/sys/kernel/ngroups_max	sudo
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/stat	sudo
File opened for reading	/proc/filesystems	ibus
File opened for reading	/proc/filesystems	python3
File opened for reading	/proc/sys/kernel/ngroups_max	sudo
File opened for reading	/proc/self/stat	sudo
File opened for reading	/proc/filesystems	sudo
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/sys/kernel/ngroups_max	sudo
File opened for reading	/proc/self/fd	ibus
File opened for reading	/proc/mounts	python3
File opened for reading	/proc/self/fd	sudo
File opened for reading	/proc/self/stat	sudo
File opened for reading	/proc/self/fd	sudo
File opened for reading	/proc/self/fd	python3
File opened for reading	/proc/self/fd	sudo
File opened for reading	/proc/filesystems	sudo
File opened for reading	/proc/self/status	python3
File opened for reading	/proc/filesystems	sudo
File opened for reading	/proc/filesystems	sudo
File opened for reading	/proc/filesystems	sudo
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/sys/kernel/ngroups_max	sudo
File opened for reading	/proc/self/stat	sudo
File opened for reading	/proc/self/fd	sudo
File opened for reading	/proc/filesystems	ibus
File opened for reading	/proc/self/stat	sudo
File opened for reading	/proc/self/fd	sudo
File opened for reading	/proc/filesystems	python3

/tmp/Meltype-linux/install.sh
/tmp/Meltype-linux/install.sh
1⤵
PID:1537
- /usr/bin/dirname
  dirname /tmp/Meltype-linux/install.sh
  2⤵
  PID:1538
- /usr/bin/python3
  python3 -c "import gi; gi.require_version(\"IBus\", \"1.0\"); from gi.repository import IBus"
  2⤵
  - Reads runtime system information
  PID:1539
- /usr/bin/sudo
  sudo rm -rf /opt/meltype
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  - Reads runtime system information
  PID:1540
- - /bin/rm
    rm -rf /opt/meltype
    3⤵
    PID:1545
- /usr/bin/sudo
  sudo mkdir -p /opt/meltype
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  - Reads runtime system information
  PID:1546
- - /bin/mkdir
    mkdir -p /opt/meltype
    3⤵
    - Reads runtime system information
    PID:1547
- /usr/bin/sudo
  sudo cp -R libMeltypeNative.so ibus-engine-meltype icon.png mozc LICENSE THIRD-PARTY-NOTICES.md /opt/meltype/
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  - Reads runtime system information
  PID:1548
- - /bin/cp
    cp -R libMeltypeNative.so ibus-engine-meltype icon.png mozc LICENSE THIRD-PARTY-NOTICES.md /opt/meltype/
    3⤵
    - Reads runtime system information
    PID:1549
- /usr/bin/sudo
  sudo chmod 755 /opt/meltype/ibus-engine-meltype /opt/meltype/mozc/meltype_mozc_helper
  2⤵
  - File and Directory Permissions Modification
  - Reads runtime system information
  PID:1550
- - /bin/chmod
    chmod 755 /opt/meltype/ibus-engine-meltype /opt/meltype/mozc/meltype_mozc_helper
    3⤵
    - File and Directory Permissions Modification
    PID:1551
- /usr/bin/sudo
  sudo tee /usr/share/ibus/component/meltype.xml
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  - Reads runtime system information
  PID:1553
- - /usr/bin/tee
    tee /usr/share/ibus/component/meltype.xml
    3⤵
    PID:1554
- /bin/sed
  sed "s|@DIR@|/opt/meltype|g" meltype.xml
  2⤵
  - Reads runtime system information
  PID:1552
- /usr/bin/ibus
  ibus write-cache
  2⤵
  - Reads runtime system information
  PID:1555
- - /usr/lib/ibus/ibus-engine-table
    /usr/lib/ibus/ibus-engine-table --xml
    3⤵
    PID:1556
- - /usr/bin/python3
    /usr/bin/python3 /usr/share/ibus-table/engine/main.py --xml
    3⤵
    - Reads runtime system information
    PID:1556
  - - /sbin/ldconfig
      /sbin/ldconfig -p
      4⤵
      PID:1557
  - - /sbin/ldconfig.real
      /sbin/ldconfig.real -p
      4⤵
      PID:1557
- /usr/bin/ibus
  ibus restart
  2⤵
  - Changes its process name
  - Reads runtime system information
  PID:1558

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LICENSE

Path /opt/meltype/LICENSE
Size 34KB
SHA256 3972dc9744f6499f0f9b2dbf76696f2ae7ad8af9b23dde66d6af86c9dfb36986
MD5 1ebbd3e34237af26da5dc08a4e440464
SHA1 31a3d460bb3c7d98845187c716a30db81c44b615
SHA512 d361e5e8201481c6346ee6a886592c51265112be550d5224f1a7a6e116255c2f1ab8788df579d9b8372ed7bfd19bac4b6e70e00b472642966ab5b319b99a2686
SSDEEP 768:Fo1acy3LTB2VsrHG/OfvMmnBCtLmJ9A7J:Fhcycsrfrnoum
TLSH
T15FF2835FB74413B2018206A26A9F68DEE319D03A73664095785DC15C27B3E3483BFBED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

THIRD-PARTY-NOTICES.md

Path /opt/meltype/THIRD-PARTY-NOTICES.md
Size 21KB
SHA256 49d61c247ac51c5e3057ff40632164616a5eca3969aa02db793d90b9a49c4241
MD5 cd201fca715045474a0d141c110a6580
SHA1 b7dfab2496df889cd9c55f2d79431fd5af7af7ca
SHA512 9709ea8c4f8519af2b45343a61df58009194485482f13e44fbac585a8ae48171753dac3f4c5557c737c40b8b04a52626e765cdfd5a63302bed8825dcb5d2cfe9
SSDEEP 384:V9VuDbB/EpDQIRqLz4A//hisVwXsK6purs0rsXqZAV6Smh72EJDrPxskf:gB/Ntz4Anhbe80ryoAVfm12EJDbj
TLSH
T1C6A2D35FE30413320AF24697648CB5C9F31EE82BFA532664346CC1987726A5CD27A9BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ibus-engine-meltype

Path /opt/meltype/ibus-engine-meltype
Size 24KB
SHA256 0aaf9064f3100a9b3470f088eb83fd254076d2d0b928124d3a42b348dd6a93af
MD5 a7a24063f3e512c1f5465db09349c64e
SHA1 d3d3dc61b90dfc900ed545afb00a5188e12672de
SHA512 d06b3997c8e573c8c2ca1ef00588380cd483fedab835ca2f6ffefdbe50a68b4dd07ab3de37041c17f72d5fdec6851e56590a76651294e66265de0db693d3bfd4
SSDEEP 384:ieTz3+1+T5XkRt8zhXeugZ+Zgrl1UlGmz92VR0z3AB5KnJc4lbfhqIeMMM75o:ieTiLtqxREUQB5KLDMIeC75o
TLSH
T13BB298FDA59A9C2187478A569852A453730E7C47E8481B387CFD8034BF695AED0E0FF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon.png

Path /opt/meltype/icon.png
Size 5KB
SHA256 816a89653cc58324000ed3f3fd579dc8efb14109765260e24f154073b5525b62
MD5 8e45a0ff0351102dceedf4123a7a117a
SHA1 6e3972553170234d334ba6b807355578a92f328e
SHA512 5b2fc41902d00995db5d3187d560e13eb41eb21879f9425c40dc632f1779b58971509cee184e48108a3b1bfa3985216ca19a338776d63c101b12af591d69bfd7
SSDEEP 96:DrWNqJdfJccMZiVcTtfxWtB5IZWYShT1laTGxXNreGXTPEqNSNAW422UG5bjJwEd:3wqJd5Qd1xWf5GWYKT1l0GrXT1Wz4NUu
TLSH
T1C6B18E0176F8490EDBB1A1743EE616964B2BC24D1AF7660C73A30901D99D70D1C6D74D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libMeltypeNative.so

Path /opt/meltype/libMeltypeNative.so
Size 14.2MB
SHA256 9ad3f5a5a3ef94f786b41aa01e7c50e861eb6a42bebc7791af811065ec5189ac
MD5 df2f9796b6a435890f8a1b7b4d0270b9
SHA1 aa2bb978653d366d63631d46cf0b9f5e5a820a44
SHA512 d78fbc5727af9b811fa7d6f77bcc478dc862cbab459a4c2d67eab15d53f37c762d0bdfcb2b83eb31814411bbd5a8a5e681e1f37f1570ddbcbcba9cbaaf770e22
SSDEEP 98304:6JGLFb5s4VUXP43Jg4GchVsj1xx1gTE6pIzQv4cNh9bT4mLFNmpD7:nXsCUA5g4zVsj11gTETz3cNhNrLFNi
TLSH
T1D7E67D94924E3C2AE2C7E27CDD4A4BF5712FFE62C22450FCB41E60A4897AAC5DB71531
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MOZC-CREDITS.html

Path /opt/meltype/mozc/MOZC-CREDITS.html
Size 33KB
SHA256 dd7c566382204f448040095e5d3c2f2b5199a1b85d44f427ceb94277dc04af50
MD5 0674f036581cdf6670f967985e92fa51
SHA1 f5cab60ffc0213c5549cede4fa0b248ceb39ab01
SHA512 ab56c6f30623f7b9a46392d802f360d2ef6ff0b01967de30b912b04dd1643a1ac6f032f542773507afaa74d6b893e795e2ab66ed825ed0ca06f3b15f405d4a06
SSDEEP 768:5VsDL2ITzJlFvAfxk1UEgiWi4LtXAFZDL6v5Oe47gv10tG:5VS2IfJIa1UEgiWiUwFZ6hOL7gv10tG
TLSH
T11BF2A57BA344037706C301A1BA8B69CAB36E903E3B67591434ADD21C1B27D79D3B72D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MOZC-LICENSE.txt

Path /opt/meltype/mozc/MOZC-LICENSE.txt
Size 5KB
SHA256 44cdd923b91ea9199293abecc2762c70c87dbf1e581c027a94c416368d1a648c
MD5 6ae333b67f21a94c8683f6adf7087ce0
SHA1 91551e1334fca877f8cddc71c578b8b824d3632f
SHA512 0a08a0acd37f07807dbde40a2a8ab47818f4fdc1ecc7bf50f6515495318c50dfd198bd1e91689ed21b8fed2f919dc380969d4a8a4b61c2c1180f4499abc5e0b4
SSDEEP 96:CYrYJKrYJdHCPN3B53hpYTLebE8ANq/EOGgjEzZ/gjDxLgTv6Odf7hN9l+xg:CYrsKrsRCPN3r3La6btANa2mg/g/xuBr
TLSH
T1EAC1B666F38823B619D302E2A14AADC4F32D94383327A954289DD11D1707F79DABF2D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

meltype_mozc_helper

Path /opt/meltype/mozc/meltype_mozc_helper
Size 22.8MB
SHA256 36fd8577278285f9cc94ee64e8c0d4655d3496e7fd4af850e5d7c49e004ec982
MD5 5f0e5114df15af85c707a04429b8932e
SHA1 1d10517bc3b734e69640ccfd621213bc51d9639c
SHA512 013c09e5a1ce6eba1820c670ab8033b13b01a71b377f60d84b87ab6a8cd43364222f9f6a0f3a1154433152c70f96da483fb432d7c0fc009e71e5827a423da73c
SSDEEP 393216:2NG1ZZRoPhzuNJh9nH5H9hAt0ubNgGOj7kB5eyEdu4DQTpm:usjL9Z/d8eKgu4ETU
TLSH
T14037E017D06ACC21F809F2B8A9468245F727ADE0E1454BEFEA4C7328DD3B9C4FB51916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

meltype.xml

Path /usr/share/ibus/component/meltype.xml
Size 1KB
SHA256 a4ec144cecb887e8245400cb57406d9869bb4751108c0cd354914b35c9fd4277
MD5 8db13a4fb5af57443486cb7b2d25e29a
SHA1 8eb7d3963047eed01e1dd6e261df45a436d37fe4
SHA512 b39e7a79ffcae60d5b1991d35cbedd75712d522ebb8f8fba85f58341373889318ee06753cee84c9625f6c2b74d79fb6e71078c203202b0fde35519321f2a5d5a
TLSH
T163211F2C58FCE57362C2C75EEC32B01ACF592D9B8892E101F18D85315F13E4F869BAA0
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads