Overview
overview
7Static
static
1Meltype-li...12.pyc
windows10-2004-x64
3Meltype-li...12.pyc
windows11-ltsc_2024-x64
3Meltype-li...ype.so
ubuntu-18.04-amd64
Meltype-li...ype.so
debian-9-armhf
Meltype-li...ype.so
debian-9-mips
Meltype-li...ype.so
debian-9-mipsel
Meltype-li...eltype
ubuntu-18.04-amd64
3Meltype-li...eltype
debian-9-armhf
1Meltype-li...eltype
debian-9-mips
1Meltype-li...eltype
debian-9-mipsel
1Meltype-li...all.sh
ubuntu-18.04-amd64
7Meltype-li...all.sh
debian-9-armhf
7Meltype-li...all.sh
debian-9-mips
7Meltype-li...all.sh
debian-9-mipsel
1Meltype-li...ive.so
ubuntu-18.04-amd64
Meltype-li...ive.so
debian-9-armhf
Meltype-li...ive.so
debian-9-mips
Meltype-li...ive.so
debian-9-mipsel
Meltype-li...S.html
windows10-2004-x64
3Meltype-li...S.html
windows11-ltsc_2024-x64
3Meltype-li...helper
ubuntu-18.04-amd64
Meltype-li...helper
debian-9-armhf
Meltype-li...helper
debian-9-mips
Meltype-li...helper
debian-9-mipsel
Meltype-li...all.sh
ubuntu-18.04-amd64
6Meltype-li...all.sh
debian-9-armhf
6Meltype-li...all.sh
debian-9-mips
6Meltype-li...all.sh
debian-9-mipsel
6Analysis
- max time kernel
11s - platform
debian-9_mips - resource
debian9-mipsbe-20260513-en - resource tags
arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem - submitted
29/10/2026, 22:50
Static task
static1
Behavioral task
behavioral1
Sample
Meltype-linux/__pycache__/ibus-engine-meltypecpython-312.pyc
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
Meltype-linux/__pycache__/ibus-engine-meltypecpython-312.pyc
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
Meltype-linux/fcitx5/meltype.so
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
Behavioral task
behavioral4
Sample
Meltype-linux/fcitx5/meltype.so
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral5
Sample
Meltype-linux/fcitx5/meltype.so
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral6
Sample
Meltype-linux/fcitx5/meltype.so
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral7
Sample
Meltype-linux/ibus-engine-meltype
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
Behavioral task
behavioral8
Sample
Meltype-linux/ibus-engine-meltype
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral9
Sample
Meltype-linux/ibus-engine-meltype
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral10
Sample
Meltype-linux/ibus-engine-meltype
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral11
Sample
Meltype-linux/install.sh
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
Behavioral task
behavioral12
Sample
Meltype-linux/install.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral13
Sample
Meltype-linux/install.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral14
Sample
Meltype-linux/install.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral15
Sample
Meltype-linux/libMeltypeNative.so
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
Behavioral task
behavioral16
Sample
Meltype-linux/libMeltypeNative.so
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral17
Sample
Meltype-linux/libMeltypeNative.so
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral18
Sample
Meltype-linux/libMeltypeNative.so
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral19
Sample
Meltype-linux/mozc/MOZC-CREDITS.html
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
Meltype-linux/mozc/MOZC-CREDITS.html
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral21
Sample
Meltype-linux/mozc/meltype_mozc_helper
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
Behavioral task
behavioral22
Sample
Meltype-linux/mozc/meltype_mozc_helper
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral23
Sample
Meltype-linux/mozc/meltype_mozc_helper
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral24
Sample
Meltype-linux/mozc/meltype_mozc_helper
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral25
Sample
Meltype-linux/uninstall.sh
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
Behavioral task
behavioral26
Sample
Meltype-linux/uninstall.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral27
Sample
Meltype-linux/uninstall.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral28
Sample
Meltype-linux/uninstall.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
General
- Target Meltype-linux/uninstall.sh
- Size 1KB
- Sample261029-2sl6cagy2p
- SHA256 467997e06760bdb3eb3506acd4ddb2adf140e7c59f710d01e948689af17512d1
- MD5 6dab3cfeec4d1c79b43a99fbca47a307
- SHA1 903986919823baa9a90737f01d02b4940721d440
- SHA512 829f095f5b6d2614beef2d791ff95fd8820d5aaf1ac6f2bb21691f0a99538f7fb18ea11610515efe20f767c6f17abe7fdb0a35fe0d694398179a88bc1d2f297f
- TLSH T113211174BA6D48B16CC843DB251B8084EBC93CD6D4AB575020BFF433681874EB089B39
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 3 IoCs
Abuse sudo or cached sudo credentials to execute code.
pid Process 730 sudo 733 sudo 739 sudo - Enumerates running processes
Discovers information about currently running processes on the system
- Reads CPU attributes 1 TTPs 2 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pkill -
description ioc Process File opened for reading /proc/6/status pgrep File opened for reading /proc/6/cmdline pgrep File opened for reading /proc/74/cmdline pgrep File opened for reading /proc/105/status pgrep File opened for reading /proc/327/status pgrep File opened for reading /proc/727/status pgrep File opened for reading /proc/self/fd sudo File opened for reading /proc/16/cmdline pkill File opened for reading /proc/9/status pgrep File opened for reading /proc/11/cmdline pgrep File opened for reading /proc/664/cmdline pgrep File opened for reading /proc/1/cmdline pkill File opened for reading /proc/11/status pkill File opened for reading /proc/17/cmdline pkill File opened for reading /proc/82/cmdline pkill File opened for reading /proc/17/cmdline pgrep File opened for reading /proc/36/cmdline pgrep File opened for reading /proc/82/cmdline pgrep File opened for reading /proc/660/status pgrep File opened for reading /proc/24/cmdline pkill File opened for reading /proc/701/status pkill File opened for reading /proc/filesystems pkill File opened for reading /proc/7/status pkill File opened for reading /proc/23/cmdline pkill File opened for reading /proc/70/status pkill File opened for reading /proc/373/status pkill File opened for reading /proc/146/status pgrep File opened for reading /proc/165/status pgrep File opened for reading /proc/723/status pgrep File opened for reading /proc/6/status pkill File opened for reading /proc/37/status pkill File opened for reading /proc/667/status pkill File opened for reading /proc/70/cmdline pkill File opened for reading /proc/74/status pkill File opened for reading /proc/1/cmdline pgrep File opened for reading /proc/116/status pgrep File opened for reading /proc/18/cmdline pkill File opened for reading /proc/24/status pkill File opened for reading /proc/372/cmdline pkill File opened for reading /proc/filesystems sudo File opened for reading /proc/8/cmdline pgrep File opened for reading /proc/82/status pgrep File opened for reading /proc/3/status pkill File opened for reading /proc/71/cmdline pkill File opened for reading /proc/327/status pkill File opened for reading /proc/741/cmdline pkill File opened for reading /proc/75/cmdline pkill File opened for reading /proc/76/cmdline pkill File opened for reading /proc/18/cmdline pgrep File opened for reading /proc/669/status pgrep File opened for reading /proc/115/cmdline pkill File opened for reading /proc/321/cmdline pgrep File opened for reading /proc/9/cmdline pgrep File opened for reading /proc/72/cmdline pkill File opened for reading /proc/self/fd sudo File opened for reading /proc/22/status pgrep File opened for reading /proc/23/cmdline pgrep File opened for reading /proc/17/status pkill File opened for reading /proc/726/status pkill File opened for reading /proc/21/status pgrep File opened for reading /proc/72/cmdline pgrep File opened for reading /proc/11/cmdline pkill File opened for reading /proc/146/status pkill File opened for reading /proc/149/cmdline pkill
Processes
-
/tmp/Meltype-linux/uninstall.sh/tmp/Meltype-linux/uninstall.sh1⤵PID:726
-
/usr/bin/sudosudo rm -f /usr/share/ibus/component/meltype.xml2⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
PID:730 -
/bin/rmrm -f /usr/share/ibus/component/meltype.xml3⤵PID:732
-
-
-
/usr/bin/sudosudo rm -f /usr/share/fcitx5/addon/meltype.conf /usr/share/fcitx5/inputmethod/meltype.conf2⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
- Reads runtime system information
PID:733 -
/bin/rmrm -f /usr/share/fcitx5/addon/meltype.conf /usr/share/fcitx5/inputmethod/meltype.conf3⤵PID:734
-
-
-
/usr/bin/xargsxargs -r sudo rm -f2⤵PID:736
-
-
/usr/bin/findfind /usr/lib /usr/lib64 -name meltype.so -path "*fcitx5*"2⤵PID:737
-
-
/usr/bin/pgreppgrep -x fcitx52⤵
- Reads CPU attributes
- Reads runtime system information
PID:738
-
-
/usr/bin/sudosudo rm -rf /opt/meltype2⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
- Reads runtime system information
PID:739 -
/bin/rmrm -rf /opt/meltype3⤵PID:740
-
-
-
/usr/bin/pkillpkill -f ibus-engine-meltype2⤵
- Reads CPU attributes
- Reads runtime system information
PID:741
-