Overview
overview
7Static
static
1Meltype-li...12.pyc
windows10-2004-x64
3Meltype-li...12.pyc
windows11-ltsc_2024-x64
3Meltype-li...ype.so
ubuntu-18.04-amd64
Meltype-li...ype.so
debian-9-armhf
Meltype-li...ype.so
debian-9-mips
Meltype-li...ype.so
debian-9-mipsel
Meltype-li...eltype
ubuntu-18.04-amd64
3Meltype-li...eltype
debian-9-armhf
1Meltype-li...eltype
debian-9-mips
1Meltype-li...eltype
debian-9-mipsel
1Meltype-li...all.sh
ubuntu-18.04-amd64
7Meltype-li...all.sh
debian-9-armhf
7Meltype-li...all.sh
debian-9-mips
7Meltype-li...all.sh
debian-9-mipsel
1Meltype-li...ive.so
ubuntu-18.04-amd64
Meltype-li...ive.so
debian-9-armhf
Meltype-li...ive.so
debian-9-mips
Meltype-li...ive.so
debian-9-mipsel
Meltype-li...S.html
windows10-2004-x64
3Meltype-li...S.html
windows11-ltsc_2024-x64
3Meltype-li...helper
ubuntu-18.04-amd64
Meltype-li...helper
debian-9-armhf
Meltype-li...helper
debian-9-mips
Meltype-li...helper
debian-9-mipsel
Meltype-li...all.sh
ubuntu-18.04-amd64
6Meltype-li...all.sh
debian-9-armhf
6Meltype-li...all.sh
debian-9-mips
6Meltype-li...all.sh
debian-9-mipsel
6Analysis
- max time kernel
2s - platform
debian-9_armhf - resource
debian9-armhf-20260513-en - resource tags
arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem - submitted
29/10/2026, 22:50
Static task
static1
Behavioral task
behavioral1
Sample
Meltype-linux/__pycache__/ibus-engine-meltypecpython-312.pyc
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
Meltype-linux/__pycache__/ibus-engine-meltypecpython-312.pyc
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
Meltype-linux/fcitx5/meltype.so
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
Behavioral task
behavioral4
Sample
Meltype-linux/fcitx5/meltype.so
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral5
Sample
Meltype-linux/fcitx5/meltype.so
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral6
Sample
Meltype-linux/fcitx5/meltype.so
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral7
Sample
Meltype-linux/ibus-engine-meltype
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
Behavioral task
behavioral8
Sample
Meltype-linux/ibus-engine-meltype
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral9
Sample
Meltype-linux/ibus-engine-meltype
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral10
Sample
Meltype-linux/ibus-engine-meltype
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral11
Sample
Meltype-linux/install.sh
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
Behavioral task
behavioral12
Sample
Meltype-linux/install.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral13
Sample
Meltype-linux/install.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral14
Sample
Meltype-linux/install.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral15
Sample
Meltype-linux/libMeltypeNative.so
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
Behavioral task
behavioral16
Sample
Meltype-linux/libMeltypeNative.so
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral17
Sample
Meltype-linux/libMeltypeNative.so
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral18
Sample
Meltype-linux/libMeltypeNative.so
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral19
Sample
Meltype-linux/mozc/MOZC-CREDITS.html
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
Meltype-linux/mozc/MOZC-CREDITS.html
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral21
Sample
Meltype-linux/mozc/meltype_mozc_helper
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
Behavioral task
behavioral22
Sample
Meltype-linux/mozc/meltype_mozc_helper
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral23
Sample
Meltype-linux/mozc/meltype_mozc_helper
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral24
Sample
Meltype-linux/mozc/meltype_mozc_helper
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral25
Sample
Meltype-linux/uninstall.sh
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
Behavioral task
behavioral26
Sample
Meltype-linux/uninstall.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral27
Sample
Meltype-linux/uninstall.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral28
Sample
Meltype-linux/uninstall.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
General
- Target Meltype-linux/uninstall.sh
- Size 1KB
- Sample261029-2sl6cagy2p
- SHA256 467997e06760bdb3eb3506acd4ddb2adf140e7c59f710d01e948689af17512d1
- MD5 6dab3cfeec4d1c79b43a99fbca47a307
- SHA1 903986919823baa9a90737f01d02b4940721d440
- SHA512 829f095f5b6d2614beef2d791ff95fd8820d5aaf1ac6f2bb21691f0a99538f7fb18ea11610515efe20f767c6f17abe7fdb0a35fe0d694398179a88bc1d2f297f
- TLSH T113211174BA6D48B16CC843DB251B8084EBC93CD6D4AB575020BFF433681874EB089B39
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 3 IoCs
Abuse sudo or cached sudo credentials to execute code.
pid Process 755 sudo 763 sudo 769 sudo - Enumerates running processes
Discovers information about currently running processes on the system
- Reads CPU attributes 1 TTPs 2 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pkill -
description ioc Process File opened for reading /proc/self/fd sudo File opened for reading /proc/16/status pgrep File opened for reading /proc/291/cmdline pgrep File opened for reading /proc/298/status pgrep File opened for reading /proc/601/status pgrep File opened for reading /proc/601/cmdline pgrep File opened for reading /proc/5/cmdline pkill File opened for reading /proc/11/status pkill File opened for reading /proc/sys/kernel/osrelease pgrep File opened for reading /proc/140/status pgrep File opened for reading /proc/290/cmdline pgrep File opened for reading /proc/16/status pkill File opened for reading /proc/22/cmdline pkill File opened for reading /proc/76/cmdline pkill File opened for reading /proc/338/cmdline pkill File opened for reading /proc/16/cmdline pgrep File opened for reading /proc/290/status pgrep File opened for reading /proc/108/cmdline pkill File opened for reading /proc/97/status pgrep File opened for reading /proc/19/cmdline pkill File opened for reading /proc/771/cmdline pkill File opened for reading /proc/sys/kernel/ngroups_max sudo File opened for reading /proc/76/cmdline pgrep File opened for reading /proc/97/cmdline pgrep File opened for reading /proc/14/status pkill File opened for reading /proc/29/cmdline pkill File opened for reading /proc/filesystems find File opened for reading /proc/134/status pgrep File opened for reading /proc/589/status pgrep File opened for reading /proc/645/status pgrep File opened for reading /proc/97/status pkill File opened for reading /proc/320/cmdline pkill File opened for reading /proc/2/cmdline pgrep File opened for reading /proc/5/cmdline pgrep File opened for reading /proc/22/status pgrep File opened for reading /proc/19/status pkill File opened for reading /proc/312/status pkill File opened for reading /proc/76/status pgrep File opened for reading /proc/109/cmdline pgrep File opened for reading /proc/21/status pkill File opened for reading /proc/137/cmdline pkill File opened for reading /proc/233/status pkill File opened for reading /proc/20/cmdline pgrep File opened for reading /proc/751/cmdline pgrep File opened for reading /proc/1/cmdline pkill File opened for reading /proc/4/cmdline pkill File opened for reading /proc/645/cmdline pkill File opened for reading /proc/5/status pkill File opened for reading /proc/26/cmdline pkill File opened for reading /proc/169/status pgrep File opened for reading /proc/195/cmdline pgrep File opened for reading /proc/749/cmdline pgrep File opened for reading /proc/600/status pkill File opened for reading /proc/self/stat sudo File opened for reading /proc/self/fd sudo File opened for reading /proc/27/status pgrep File opened for reading /proc/2/status pkill File opened for reading /proc/747/status pgrep File opened for reading /proc/749/status pgrep File opened for reading /proc/27/cmdline pkill File opened for reading /proc/76/status pkill File opened for reading /proc/140/cmdline pkill File opened for reading /proc/331/status pgrep File opened for reading /proc/600/cmdline pgrep
Processes
-
/tmp/Meltype-linux/uninstall.sh/tmp/Meltype-linux/uninstall.sh1⤵PID:751
-
/usr/bin/sudosudo rm -f /usr/share/ibus/component/meltype.xml2⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
- Reads runtime system information
PID:755 -
/bin/rmrm -f /usr/share/ibus/component/meltype.xml3⤵PID:762
-
-
-
/usr/bin/sudosudo rm -f /usr/share/fcitx5/addon/meltype.conf /usr/share/fcitx5/inputmethod/meltype.conf2⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
- Reads runtime system information
PID:763 -
/bin/rmrm -f /usr/share/fcitx5/addon/meltype.conf /usr/share/fcitx5/inputmethod/meltype.conf3⤵PID:764
-
-
-
/usr/bin/xargsxargs -r sudo rm -f2⤵PID:766
-
-
/usr/bin/findfind /usr/lib /usr/lib64 -name meltype.so -path "*fcitx5*"2⤵
- Reads runtime system information
PID:767
-
-
/usr/bin/pgreppgrep -x fcitx52⤵
- Reads CPU attributes
- Reads runtime system information
PID:768
-
-
/usr/bin/sudosudo rm -rf /opt/meltype2⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
PID:769 -
/bin/rmrm -rf /opt/meltype3⤵PID:770
-
-
-
/usr/bin/pkillpkill -f ibus-engine-meltype2⤵
- Reads CPU attributes
- Reads runtime system information
PID:771
-