d497bbfbd21360e45091be7aec150e839f8ddfac99db6545f3a93b6815c64f23

Analysis

max time kernel
1s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
07/11/2026, 15:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
one-rules-file-starter/check-rules.sh
Size 4KB
Sample261107-skcr9scy21
SHA256 d497bbfbd21360e45091be7aec150e839f8ddfac99db6545f3a93b6815c64f23
MD5 eb7ca6ed53f64f50e82495471c917d8a
SHA1 2e6c9b403e6381241e401348a9b84e22e9e52f65
SHA512 6fb6341bf49c27bd943ee378928b06cd5efd0443b0ba591b2031d93971fed5595ac2f4fe8b6abe97d3e5eaaf9d9e44e5e94fddaf599576be09ea8ff5bf5a1a25
SSDEEP 96:KtZkeUNXDCUZPLM4qKhClZ9e7yOSe8Aaxd+ax2MP1HRkI3lC+Is2M5:zeUNXDPPLMp3lZ9e7yA8FLUU1H55
TLSH
T19D91840DFD188AAB459344B86EC2AE27370290BA4684FA58905DE08875DC77D17FEF78
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads runtime system information 8 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/filesystems	sed

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
692	grep

/tmp/one-rules-file-starter/check-rules.sh
/tmp/one-rules-file-starter/check-rules.sh
1⤵
PID:642

/usr/local/sbin/bash
bash /tmp/one-rules-file-starter/check-rules.sh
1⤵
PID:642

/usr/local/bin/bash
bash /tmp/one-rules-file-starter/check-rules.sh
1⤵
PID:642

/usr/sbin/bash
bash /tmp/one-rules-file-starter/check-rules.sh
1⤵
PID:642

/usr/bin/bash
bash /tmp/one-rules-file-starter/check-rules.sh
1⤵
PID:642

/sbin/bash
bash /tmp/one-rules-file-starter/check-rules.sh
1⤵
PID:642

/bin/bash
bash /tmp/one-rules-file-starter/check-rules.sh
1⤵
PID:642
- /usr/bin/wc
  wc -c
  2⤵
  PID:655
- /bin/grep
  grep -qx "@AGENTS.md"
  2⤵
  PID:662
- /bin/sed
  sed "1s/^\\xEF\\xBB\\xBF//" CLAUDE.md
  2⤵
  - Reads runtime system information
  PID:663
- /usr/bin/tr
  tr -d "\\r"
  2⤵
  PID:664
- /usr/bin/wc
  wc -l
  2⤵
  PID:669
- /usr/bin/find
  find .cursor/rules -type f -name "*.mdc"
  2⤵
  - Reads runtime system information
  PID:672
- /usr/bin/sort
  sort
  2⤵
  PID:673
- /bin/sed
  sed "1s/^\\xEF\\xBB\\xBF//" .cursor/rules/example-scoped.mdc
  2⤵
  - Reads runtime system information
  PID:678
- /usr/bin/tr
  tr -d "\\r"
  2⤵
  PID:679
- /usr/bin/head
  head -n1
  2⤵
  PID:682
- /usr/bin/awk
  awk "NR>1 && /^---[ \\t]*\$/ {print NR; exit}"
  2⤵
  - Reads runtime system information
  PID:686
- /bin/sed
  sed -n "2,4p"
  2⤵
  - Reads runtime system information
  PID:689
- /bin/grep
  grep -Ev "^(description|globs|alwaysApply):|^[[:space:]]*\$|^[[:space:]]*-[[:space:]]"
  2⤵
  - System Network Configuration Discovery
  PID:692
- /bin/sed
  sed -n "s/^alwaysApply:[[:space:]]*//p"
  2⤵
  - Reads runtime system information
  PID:696
- /bin/sed
  sed "s/[[:space:]]*\$//"
  2⤵
  - Reads runtime system information
  PID:697
- /usr/bin/wc
  wc -l
  2⤵
  PID:699
- /bin/grep
  grep -Eq "^globs:[[:space:]]*\\*|^globs:[[:space:]]*\\[([^]]*,)?[[:space:]]*\\*|^[[:space:]]*-[[:space:]]+\\*"
  2⤵
  PID:701
- /usr/bin/find
  find .cursor/rules -type f -name "*.md"
  2⤵
  - Reads runtime system information
  PID:703
- /usr/bin/sort
  sort
  2⤵
  PID:704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads