37be13ae2b1a396e8a9c77bd01efe6579698a3410c448b1ff23bf19800544d55

Analysis

max time kernel
1s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
27/10/2026, 01:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
freeciv-3.2.6/autogen.sh
Size 8KB
Sample261027-bga1tscd46
SHA256 37be13ae2b1a396e8a9c77bd01efe6579698a3410c448b1ff23bf19800544d55
MD5 72d960a811fa7ffad8c574f44a066b6d
SHA1 222764365f7960d945bcbdd0d5949ceca941d079
SHA512 51fa3cc8de045ce27ba4b75c901877f3b4914c116be5068746d2297da94bc5d7ebf99e08e9acc0cf8e6ce570c89c8fcd6f2625f23c1b1ec5388e54dabd7ac983
SSDEEP 192:jlSzd1zu46DJFVYL4ofpHS3rYVqp8CgrpAannbFxco0u5vnX+Rqm2enD23RMJRvN:RS5ADJ3QNhywpNnnbcoPvnXhm2eD20I0
TLSH
T1AB128507F005C3F0652A2CA11D4C791A3F6C2AEF9A9C3C78F09E7454AB51299A1FB795
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads runtime system information 42 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls

/tmp/freeciv-3.2.6/autogen.sh
/tmp/freeciv-3.2.6/autogen.sh
1⤵
PID:759
- /usr/bin/dirname
  dirname /tmp/freeciv-3.2.6/autogen.sh
  2⤵
  PID:760
- /bin/ls
  ls "/usr/local/sbin/autoconf-*"
  2⤵
  - Reads runtime system information
  PID:763
- /bin/ls
  ls "/usr/local/bin/autoconf-*"
  2⤵
  - Reads runtime system information
  PID:764
- /bin/ls
  ls "/usr/sbin/autoconf-*"
  2⤵
  - Reads runtime system information
  PID:765
- /bin/ls
  ls "/usr/bin/autoconf-*"
  2⤵
  - Reads runtime system information
  PID:766
- /bin/ls
  ls "/sbin/autoconf-*"
  2⤵
  - Reads runtime system information
  PID:767
- /bin/ls
  ls "/bin/autoconf-*"
  2⤵
  - Reads runtime system information
  PID:768
- /usr/bin/tr
  tr -d "\\n"
  2⤵
  PID:770
- /bin/ls
  ls "/usr/local/sbin/autoheader-*"
  2⤵
  - Reads runtime system information
  PID:776
- /bin/ls
  ls "/usr/local/bin/autoheader-*"
  2⤵
  - Reads runtime system information
  PID:777
- /bin/ls
  ls "/usr/sbin/autoheader-*"
  2⤵
  - Reads runtime system information
  PID:778
- /bin/ls
  ls "/usr/bin/autoheader-*"
  2⤵
  - Reads runtime system information
  PID:779
- /bin/ls
  ls "/sbin/autoheader-*"
  2⤵
  - Reads runtime system information
  PID:780
- /bin/ls
  ls "/bin/autoheader-*"
  2⤵
  - Reads runtime system information
  PID:781
- /usr/bin/tr
  tr -d "\\n"
  2⤵
  PID:783
- /bin/ls
  ls "/usr/local/sbin/automake-*"
  2⤵
  - Reads runtime system information
  PID:786
- /bin/ls
  ls "/usr/local/bin/automake-*"
  2⤵
  - Reads runtime system information
  PID:787
- /bin/ls
  ls "/usr/sbin/automake-*"
  2⤵
  - Reads runtime system information
  PID:788
- /bin/ls
  ls "/usr/bin/automake-*"
  2⤵
  - Reads runtime system information
  PID:789
- /bin/ls
  ls "/sbin/automake-*"
  2⤵
  - Reads runtime system information
  PID:790
- /bin/ls
  ls "/bin/automake-*"
  2⤵
  - Reads runtime system information
  PID:791
- /usr/bin/tr
  tr -d "\\n"
  2⤵
  PID:793
- /bin/ls
  ls "/usr/local/sbin/aclocal-*"
  2⤵
  - Reads runtime system information
  PID:796
- /bin/ls
  ls "/usr/local/bin/aclocal-*"
  2⤵
  - Reads runtime system information
  PID:797
- /bin/ls
  ls "/usr/sbin/aclocal-*"
  2⤵
  - Reads runtime system information
  PID:798
- /bin/ls
  ls "/usr/bin/aclocal-*"
  2⤵
  - Reads runtime system information
  PID:799
- /bin/ls
  ls "/sbin/aclocal-*"
  2⤵
  - Reads runtime system information
  PID:800
- /bin/ls
  ls "/bin/aclocal-*"
  2⤵
  - Reads runtime system information
  PID:801
- /usr/bin/tr
  tr -d "\\n"
  2⤵
  PID:803
- /bin/ls
  ls "/usr/local/sbin/libtoolize-*"
  2⤵
  - Reads runtime system information
  PID:806
- /bin/ls
  ls "/usr/local/bin/libtoolize-*"
  2⤵
  - Reads runtime system information
  PID:807
- /bin/ls
  ls "/usr/sbin/libtoolize-*"
  2⤵
  - Reads runtime system information
  PID:808
- /bin/ls
  ls "/usr/bin/libtoolize-*"
  2⤵
  - Reads runtime system information
  PID:809
- /bin/ls
  ls "/sbin/libtoolize-*"
  2⤵
  - Reads runtime system information
  PID:810
- /bin/ls
  ls "/bin/libtoolize-*"
  2⤵
  - Reads runtime system information
  PID:811
- /usr/bin/tr
  tr -d "\\n"
  2⤵
  PID:813
- /bin/ls
  ls "/usr/local/sbin/glibtoolize-*"
  2⤵
  - Reads runtime system information
  PID:816
- /bin/ls
  ls "/usr/local/bin/glibtoolize-*"
  2⤵
  - Reads runtime system information
  PID:817
- /bin/ls
  ls "/usr/sbin/glibtoolize-*"
  2⤵
  - Reads runtime system information
  PID:818
- /bin/ls
  ls "/usr/bin/glibtoolize-*"
  2⤵
  - Reads runtime system information
  PID:819
- /bin/ls
  ls "/sbin/glibtoolize-*"
  2⤵
  - Reads runtime system information
  PID:820
- /bin/ls
  ls "/bin/glibtoolize-*"
  2⤵
  - Reads runtime system information
  PID:821
- /usr/bin/tr
  tr -d "\\n"
  2⤵
  PID:823
- /usr/bin/python3
  python3 --version
  2⤵
  PID:825
- /bin/grep
  grep -a -v " line "
  2⤵
  PID:828
- /bin/sed
  sed "s/([^)]*)//g;s/^[a-zA-Z\\.\\ \\-]*//;s/ .*\$//"
  2⤵
  - Reads runtime system information
  PID:830
- /usr/bin/head
  head -n 1
  2⤵
  PID:829
- /usr/bin/python3
  python3 --version
  2⤵
  PID:827
- /usr/bin/cut
  cut -d. -f1
  2⤵
  PID:833
- /usr/bin/cut
  cut -d. -f2
  2⤵
  PID:837
- /bin/sed
  sed "s/[-,a-z,A-Z+].*//"
  2⤵
  - Reads runtime system information
  PID:836
- /bin/sed
  sed "s/[-,a-z,A-Z+].*//"
  2⤵
  - Reads runtime system information
  PID:840
- /usr/bin/cut
  cut -d. -f3
  2⤵
  PID:841
- /usr/bin/tr
  tr -d "\\n"
  2⤵
  PID:843
- /usr/bin/python3
  python3 --version
  2⤵
  PID:844
- /bin/grep
  grep -a -v " line "
  2⤵
  PID:847
- /usr/bin/head
  head -n 1
  2⤵
  PID:848
- /bin/sed
  sed "s/([^)]*)//g;s/^[a-zA-Z\\.\\ \\-]*//;s/ .*\$//"
  2⤵
  - Reads runtime system information
  PID:849
- /usr/bin/python3
  python3 --version
  2⤵
  PID:846
- /usr/bin/cut
  cut -d. -f1
  2⤵
  PID:852
- /usr/bin/cut
  cut -d. -f2
  2⤵
  PID:856
- /bin/sed
  sed "s/[-,a-z,A-Z+].*//"
  2⤵
  - Reads runtime system information
  PID:855
- /usr/bin/cut
  cut -d. -f3
  2⤵
  PID:860
- /bin/sed
  sed "s/[-,a-z,A-Z+].*//"
  2⤵
  - Reads runtime system information
  PID:859
- /usr/bin/tr
  tr -d "\\n"
  2⤵
  PID:862
- /usr/bin/tr
  tr -d "\\n"
  2⤵
  PID:865

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads