Overview
overview
7Static
static
1Meltype-li...12.pyc
windows10-2004-x64
3Meltype-li...12.pyc
windows11-ltsc_2024-x64
3Meltype-li...ype.so
ubuntu-18.04-amd64
Meltype-li...ype.so
debian-9-armhf
Meltype-li...ype.so
debian-9-mips
Meltype-li...ype.so
debian-9-mipsel
Meltype-li...eltype
ubuntu-18.04-amd64
3Meltype-li...eltype
debian-9-armhf
1Meltype-li...eltype
debian-9-mips
1Meltype-li...eltype
debian-9-mipsel
1Meltype-li...all.sh
ubuntu-18.04-amd64
7Meltype-li...all.sh
debian-9-armhf
7Meltype-li...all.sh
debian-9-mips
7Meltype-li...all.sh
debian-9-mipsel
1Meltype-li...ive.so
ubuntu-18.04-amd64
Meltype-li...ive.so
debian-9-armhf
Meltype-li...ive.so
debian-9-mips
Meltype-li...ive.so
debian-9-mipsel
Meltype-li...S.html
windows10-2004-x64
3Meltype-li...S.html
windows11-ltsc_2024-x64
3Meltype-li...helper
ubuntu-18.04-amd64
Meltype-li...helper
debian-9-armhf
Meltype-li...helper
debian-9-mips
Meltype-li...helper
debian-9-mipsel
Meltype-li...all.sh
ubuntu-18.04-amd64
6Meltype-li...all.sh
debian-9-armhf
6Meltype-li...all.sh
debian-9-mips
6Meltype-li...all.sh
debian-9-mipsel
6Analysis
- max time kernel
1s - max time network
132s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20261019-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20261019-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
29/10/2026, 22:50
Static task
static1
Behavioral task
behavioral1
Sample
Meltype-linux/__pycache__/ibus-engine-meltypecpython-312.pyc
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
Meltype-linux/__pycache__/ibus-engine-meltypecpython-312.pyc
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
Meltype-linux/fcitx5/meltype.so
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
Behavioral task
behavioral4
Sample
Meltype-linux/fcitx5/meltype.so
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral5
Sample
Meltype-linux/fcitx5/meltype.so
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral6
Sample
Meltype-linux/fcitx5/meltype.so
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral7
Sample
Meltype-linux/ibus-engine-meltype
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
Behavioral task
behavioral8
Sample
Meltype-linux/ibus-engine-meltype
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral9
Sample
Meltype-linux/ibus-engine-meltype
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral10
Sample
Meltype-linux/ibus-engine-meltype
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral11
Sample
Meltype-linux/install.sh
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
Behavioral task
behavioral12
Sample
Meltype-linux/install.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral13
Sample
Meltype-linux/install.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral14
Sample
Meltype-linux/install.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral15
Sample
Meltype-linux/libMeltypeNative.so
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
Behavioral task
behavioral16
Sample
Meltype-linux/libMeltypeNative.so
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral17
Sample
Meltype-linux/libMeltypeNative.so
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral18
Sample
Meltype-linux/libMeltypeNative.so
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral19
Sample
Meltype-linux/mozc/MOZC-CREDITS.html
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
Meltype-linux/mozc/MOZC-CREDITS.html
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral21
Sample
Meltype-linux/mozc/meltype_mozc_helper
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
Behavioral task
behavioral22
Sample
Meltype-linux/mozc/meltype_mozc_helper
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral23
Sample
Meltype-linux/mozc/meltype_mozc_helper
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral24
Sample
Meltype-linux/mozc/meltype_mozc_helper
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral25
Sample
Meltype-linux/uninstall.sh
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
Behavioral task
behavioral26
Sample
Meltype-linux/uninstall.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral27
Sample
Meltype-linux/uninstall.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral28
Sample
Meltype-linux/uninstall.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
General
- Target Meltype-linux/uninstall.sh
- Size 1KB
- Sample261029-2sl6cagy2p
- SHA256 467997e06760bdb3eb3506acd4ddb2adf140e7c59f710d01e948689af17512d1
- MD5 6dab3cfeec4d1c79b43a99fbca47a307
- SHA1 903986919823baa9a90737f01d02b4940721d440
- SHA512 829f095f5b6d2614beef2d791ff95fd8820d5aaf1ac6f2bb21691f0a99538f7fb18ea11610515efe20f767c6f17abe7fdb0a35fe0d694398179a88bc1d2f297f
- TLSH T113211174BA6D48B16CC843DB251B8084EBC93CD6D4AB575020BFF433681874EB089B39
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 3 IoCs
Abuse sudo or cached sudo credentials to execute code.
pid Process 1536 sudo 1538 sudo 1548 sudo - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 2 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself gmain 1555 ibus Changes the process name, possibly in an attempt to hide itself gdbus 1557 ibus - Reads CPU attributes 1 TTPs 2 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pgrep -
description ioc Process File opened for reading /proc/sys/kernel/osrelease pkill File opened for reading /proc/25/status pkill File opened for reading /proc/170/status pkill File opened for reading /proc/1056/cmdline pkill File opened for reading /proc/1099/cmdline pkill File opened for reading /proc/12/cmdline pgrep File opened for reading /proc/83/cmdline pgrep File opened for reading /proc/178/cmdline pgrep File opened for reading /proc/456/cmdline pgrep File opened for reading /proc/652/cmdline pgrep File opened for reading /proc/661/status pkill File opened for reading /proc/979/status pkill File opened for reading /proc/1550/cmdline pkill File opened for reading /proc/25/cmdline pgrep File opened for reading /proc/80/cmdline pkill File opened for reading /proc/173/cmdline pkill File opened for reading /proc/1016/cmdline pkill File opened for reading /proc/mounts python3 File opened for reading /proc/1185/status pgrep File opened for reading /proc/1340/cmdline pgrep File opened for reading /proc/89/cmdline pkill File opened for reading /proc/171/cmdline pkill File opened for reading /proc/1102/cmdline pkill File opened for reading /proc/1200/status pkill File opened for reading /proc/self/stat sudo File opened for reading /proc/self/fd xargs File opened for reading /proc/177/status pgrep File opened for reading /proc/177/cmdline pgrep File opened for reading /proc/495/cmdline pgrep File opened for reading /proc/545/cmdline pgrep File opened for reading /proc/4/status pkill File opened for reading /proc/504/cmdline pkill File opened for reading /proc/276/status pgrep File opened for reading /proc/608/status pgrep File opened for reading /proc/609/cmdline pgrep File opened for reading /proc/955/status pgrep File opened for reading /proc/1061/cmdline pgrep File opened for reading /proc/1073/cmdline pgrep File opened for reading /proc/1097/status pgrep File opened for reading /proc/1104/status pgrep File opened for reading /proc/137/cmdline pgrep File opened for reading /proc/181/cmdline pgrep File opened for reading /proc/654/status pgrep File opened for reading /proc/1532/cmdline pgrep File opened for reading /proc/21/cmdline pkill File opened for reading /proc/973/cmdline pkill File opened for reading /proc/1085/cmdline pkill File opened for reading /proc/1133/status pkill File opened for reading /proc/8/status pgrep File opened for reading /proc/175/status pgrep File opened for reading /proc/13/cmdline pkill File opened for reading /proc/595/cmdline pkill File opened for reading /proc/646/status pkill File opened for reading /proc/973/status pkill File opened for reading /proc/997/status pkill File opened for reading /proc/1052/cmdline pkill File opened for reading /proc/17/cmdline pgrep File opened for reading /proc/34/status pgrep File opened for reading /proc/180/status pgrep File opened for reading /proc/271/status pgrep File opened for reading /proc/935/cmdline pgrep File opened for reading /proc/1543/status pgrep File opened for reading /proc/30/status pkill File opened for reading /proc/1061/cmdline pkill
Processes
-
/tmp/Meltype-linux/uninstall.sh/tmp/Meltype-linux/uninstall.sh1⤵PID:1535
-
/usr/bin/sudosudo rm -f /usr/share/ibus/component/meltype.xml2⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
- Reads runtime system information
PID:1536 -
/bin/rmrm -f /usr/share/ibus/component/meltype.xml3⤵PID:1537
-
-
-
/usr/bin/sudosudo rm -f /usr/share/fcitx5/addon/meltype.conf /usr/share/fcitx5/inputmethod/meltype.conf2⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
PID:1538 -
/bin/rmrm -f /usr/share/fcitx5/addon/meltype.conf /usr/share/fcitx5/inputmethod/meltype.conf3⤵PID:1539
-
-
-
/usr/bin/xargsxargs -r sudo rm -f2⤵
- Reads runtime system information
PID:1541
-
-
/usr/bin/findfind /usr/lib /usr/lib64 -name meltype.so -path "*fcitx5*"2⤵PID:1542
-
-
/usr/bin/pgreppgrep -x fcitx52⤵
- Reads CPU attributes
- Reads runtime system information
PID:1547
-
-
/usr/bin/sudosudo rm -rf /opt/meltype2⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
PID:1548 -
/bin/rmrm -rf /opt/meltype3⤵PID:1549
-
-
-
/usr/bin/pkillpkill -f ibus-engine-meltype2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1550
-
-
/usr/bin/ibusibus write-cache2⤵PID:1551
-
/usr/lib/ibus/ibus-engine-table/usr/lib/ibus/ibus-engine-table --xml3⤵PID:1552
-
-
/usr/bin/python3/usr/bin/python3 /usr/share/ibus-table/engine/main.py --xml3⤵
- Reads runtime system information
PID:1552 -
/sbin/ldconfig/sbin/ldconfig -p4⤵PID:1553
-
-
/sbin/ldconfig.real/sbin/ldconfig.real -p4⤵PID:1553
-
-
-
-
/usr/bin/ibusibus restart2⤵
- Changes its process name
PID:1554
-