3f6a403e8564c5c2d6d02d6deb3ba8af7a47ab0df986f86e1c4c327162e8d30b

Analysis

max time kernel
1s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
04/08/2026, 00:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
script.deb.sh
Size 5KB
Sample260804-akpgyszdmg
SHA256 3f6a403e8564c5c2d6d02d6deb3ba8af7a47ab0df986f86e1c4c327162e8d30b
MD5 44ef04203b625a7889018203ef921423
SHA1 4971c2ead32b07428242e25c2dd81f6a3dc86b9b
SHA512 de219b39d41659abec3d0ba54fe0e5f0e31991bee40b029a4cdb9847f8406beb07f2fcde830adb3c3ce0bd5f112f1d262851807b5a526cc9846a4449a91df08c
SSDEEP 96:NW+xF50yDTXKAObfMVXUHGMY/3purmdodIidl3xhhkIKvBE955D+7A5dHLjm:U+xFawTX1VXUHpO3pEmi7dlBhOv65565
TLSH
T111B1A6AB44948A3210B853F5899BD21D6B0EE11302685C55F27C650C6B3E3AFF6F336B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Reads runtime system information 3 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/self/fd	apt-get
File opened for reading	/proc/filesystems	dpkg

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
643	script.deb.sh

Writes file to tmp directory 4 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/fileutl.message.ipsrzH	apt-get
File opened for modification	/tmp/fileutl.message.obMyTm	apt-get
File opened for modification	/tmp/fileutl.message.wIjVB7	apt-get
File opened for modification	/tmp/fileutl.message.ysthGT	apt-get

Software Deployment Tools 1 TTPs 1 IoCs

Use software deployment tools to execute code.

execution

Software Deployment Tools

T1072

pid	Process
655	apt-get

/tmp/script.deb.sh
/tmp/script.deb.sh
1⤵
- System Network Configuration Discovery
PID:643
- /usr/bin/head
  head -1
  2⤵
  PID:656
- /usr/bin/apt-get
  apt-get -v
  2⤵
  - Software Deployment Tools
  PID:655
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  - Reads runtime system information
  PID:657
- /usr/bin/cut
  cut -d. -f1
  2⤵
  PID:670
- /usr/bin/cut
  cut -d. -f2
  2⤵
  PID:674
- /usr/bin/apt-get
  apt-get install -y debian-archive-keyring
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:675
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:679

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Software Deployment Tools

T1072

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Software Deployment Tools

T1072

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads