Overview
overview
7Static
static
1Meltype-li...12.pyc
windows10-2004-x64
3Meltype-li...12.pyc
windows11-ltsc_2024-x64
3Meltype-li...ype.so
ubuntu-18.04-amd64
Meltype-li...ype.so
debian-9-armhf
Meltype-li...ype.so
debian-9-mips
Meltype-li...ype.so
debian-9-mipsel
Meltype-li...eltype
ubuntu-18.04-amd64
3Meltype-li...eltype
debian-9-armhf
1Meltype-li...eltype
debian-9-mips
1Meltype-li...eltype
debian-9-mipsel
1Meltype-li...all.sh
ubuntu-18.04-amd64
7Meltype-li...all.sh
debian-9-armhf
7Meltype-li...all.sh
debian-9-mips
7Meltype-li...all.sh
debian-9-mipsel
1Meltype-li...ive.so
ubuntu-18.04-amd64
Meltype-li...ive.so
debian-9-armhf
Meltype-li...ive.so
debian-9-mips
Meltype-li...ive.so
debian-9-mipsel
Meltype-li...S.html
windows10-2004-x64
3Meltype-li...S.html
windows11-ltsc_2024-x64
3Meltype-li...helper
ubuntu-18.04-amd64
Meltype-li...helper
debian-9-armhf
Meltype-li...helper
debian-9-mips
Meltype-li...helper
debian-9-mipsel
Meltype-li...all.sh
ubuntu-18.04-amd64
6Meltype-li...all.sh
debian-9-armhf
6Meltype-li...all.sh
debian-9-mips
6Meltype-li...all.sh
debian-9-mipsel
6Analysis
- max time kernel
33s - platform
debian-9_mipsel - resource
debian9-mipsel-20260513-en - resource tags
arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem - submitted
29/10/2026, 22:50
Static task
static1
Behavioral task
behavioral1
Sample
Meltype-linux/__pycache__/ibus-engine-meltypecpython-312.pyc
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
Meltype-linux/__pycache__/ibus-engine-meltypecpython-312.pyc
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
Meltype-linux/fcitx5/meltype.so
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
Behavioral task
behavioral4
Sample
Meltype-linux/fcitx5/meltype.so
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral5
Sample
Meltype-linux/fcitx5/meltype.so
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral6
Sample
Meltype-linux/fcitx5/meltype.so
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral7
Sample
Meltype-linux/ibus-engine-meltype
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
Behavioral task
behavioral8
Sample
Meltype-linux/ibus-engine-meltype
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral9
Sample
Meltype-linux/ibus-engine-meltype
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral10
Sample
Meltype-linux/ibus-engine-meltype
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral11
Sample
Meltype-linux/install.sh
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
Behavioral task
behavioral12
Sample
Meltype-linux/install.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral13
Sample
Meltype-linux/install.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral14
Sample
Meltype-linux/install.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral15
Sample
Meltype-linux/libMeltypeNative.so
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
Behavioral task
behavioral16
Sample
Meltype-linux/libMeltypeNative.so
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral17
Sample
Meltype-linux/libMeltypeNative.so
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral18
Sample
Meltype-linux/libMeltypeNative.so
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral19
Sample
Meltype-linux/mozc/MOZC-CREDITS.html
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
Meltype-linux/mozc/MOZC-CREDITS.html
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral21
Sample
Meltype-linux/mozc/meltype_mozc_helper
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
Behavioral task
behavioral22
Sample
Meltype-linux/mozc/meltype_mozc_helper
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral23
Sample
Meltype-linux/mozc/meltype_mozc_helper
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral24
Sample
Meltype-linux/mozc/meltype_mozc_helper
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral25
Sample
Meltype-linux/uninstall.sh
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
Behavioral task
behavioral26
Sample
Meltype-linux/uninstall.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral27
Sample
Meltype-linux/uninstall.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral28
Sample
Meltype-linux/uninstall.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
General
- Target Meltype-linux/uninstall.sh
- Size 1KB
- Sample261029-2sl6cagy2p
- SHA256 467997e06760bdb3eb3506acd4ddb2adf140e7c59f710d01e948689af17512d1
- MD5 6dab3cfeec4d1c79b43a99fbca47a307
- SHA1 903986919823baa9a90737f01d02b4940721d440
- SHA512 829f095f5b6d2614beef2d791ff95fd8820d5aaf1ac6f2bb21691f0a99538f7fb18ea11610515efe20f767c6f17abe7fdb0a35fe0d694398179a88bc1d2f297f
- TLSH T113211174BA6D48B16CC843DB251B8084EBC93CD6D4AB575020BFF433681874EB089B39
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 3 IoCs
Abuse sudo or cached sudo credentials to execute code.
pid Process 747 sudo 749 sudo 759 sudo - Enumerates running processes
Discovers information about currently running processes on the system
- Reads CPU attributes 1 TTPs 2 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pkill -
description ioc Process File opened for reading /proc/679/status pkill File opened for reading /proc/71/status pgrep File opened for reading /proc/378/cmdline pkill File opened for reading /proc/75/status pkill File opened for reading /proc/16/status pgrep File opened for reading /proc/332/status pgrep File opened for reading /proc/self/stat sudo File opened for reading /proc/125/cmdline pkill File opened for reading /proc/662/cmdline pkill File opened for reading /proc/21/status pgrep File opened for reading /proc/8/cmdline pkill File opened for reading /proc/16/cmdline pkill File opened for reading /proc/71/status pkill File opened for reading /proc/sys/kernel/ngroups_max sudo File opened for reading /proc/1/status pgrep File opened for reading /proc/9/status pgrep File opened for reading /proc/7/cmdline pkill File opened for reading /proc/8/status pkill File opened for reading /proc/12/status pkill File opened for reading /proc/363/status pkill File opened for reading /proc/22/cmdline pkill File opened for reading /proc/69/cmdline pkill File opened for reading /proc/filesystems pkill File opened for reading /proc/23/status pgrep File opened for reading /proc/24/status pgrep File opened for reading /proc/762/status pkill File opened for reading /proc/filesystems sudo File opened for reading /proc/2/cmdline pgrep File opened for reading /proc/7/status pgrep File opened for reading /proc/17/status pkill File opened for reading /proc/82/cmdline pkill File opened for reading /proc/332/status pkill File opened for reading /proc/332/cmdline pkill File opened for reading /proc/390/cmdline pkill File opened for reading /proc/74/cmdline pgrep File opened for reading /proc/708/status pgrep File opened for reading /proc/sys/kernel/ngroups_max sudo File opened for reading /proc/72/cmdline pkill File opened for reading /proc/8/status pgrep File opened for reading /proc/8/cmdline pgrep File opened for reading /proc/68/status pgrep File opened for reading /proc/109/cmdline pgrep File opened for reading /proc/16/status pkill File opened for reading /proc/177/status pkill File opened for reading /proc/20/status pgrep File opened for reading /proc/81/cmdline pgrep File opened for reading /proc/674/cmdline pgrep File opened for reading /proc/20/cmdline pkill File opened for reading /proc/158/cmdline pkill File opened for reading /proc/739/cmdline pkill File opened for reading /proc/sys/kernel/osrelease pgrep File opened for reading /proc/73/cmdline pgrep File opened for reading /proc/334/status pkill File opened for reading /proc/422/cmdline pkill File opened for reading /proc/81/status pgrep File opened for reading /proc/708/status pkill File opened for reading /proc/4/status pgrep File opened for reading /proc/4/cmdline pgrep File opened for reading /proc/363/status pgrep File opened for reading /proc/743/cmdline pgrep File opened for reading /proc/4/status pkill File opened for reading /proc/674/status pkill File opened for reading /proc/737/cmdline pkill File opened for reading /proc/filesystems find
Processes
-
/tmp/Meltype-linux/uninstall.sh/tmp/Meltype-linux/uninstall.sh1⤵PID:739
-
/usr/bin/sudosudo rm -f /usr/share/ibus/component/meltype.xml2⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
- Reads runtime system information
PID:747 -
/bin/rmrm -f /usr/share/ibus/component/meltype.xml3⤵PID:748
-
-
-
/usr/bin/sudosudo rm -f /usr/share/fcitx5/addon/meltype.conf /usr/share/fcitx5/inputmethod/meltype.conf2⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
PID:749 -
/bin/rmrm -f /usr/share/fcitx5/addon/meltype.conf /usr/share/fcitx5/inputmethod/meltype.conf3⤵PID:750
-
-
-
/usr/bin/xargsxargs -r sudo rm -f2⤵PID:752
-
-
/usr/bin/findfind /usr/lib /usr/lib64 -name meltype.so -path "*fcitx5*"2⤵
- Reads runtime system information
PID:753
-
-
/usr/bin/pgreppgrep -x fcitx52⤵
- Reads CPU attributes
- Reads runtime system information
PID:756
-
-
/usr/bin/sudosudo rm -rf /opt/meltype2⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
- Reads runtime system information
PID:759 -
/bin/rmrm -rf /opt/meltype3⤵PID:761
-
-
-
/usr/bin/pkillpkill -f ibus-engine-meltype2⤵
- Reads CPU attributes
- Reads runtime system information
PID:763
-