e9c1541a7232699043b5dfa01e33b3e82cc9f53ed5f84e59c9ff8a5fec5640d1

Analysis

max time kernel
1s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
10/11/2026, 13:08

Target
debian/tests/acc
Size 351B
Sample261110-qdn6lsff48
SHA256 e9c1541a7232699043b5dfa01e33b3e82cc9f53ed5f84e59c9ff8a5fec5640d1
MD5 a37919d43af153827c10854906f7b51c
SHA1 30b1b2ed990e39eced55ffb85cf95e4933f83b5a
SHA512 f4d46390318e067afd4a897b09377b0928ffcd84595db7a23b87452c0d36bde91be6faf07c3998b83200236ff0ade1dc0e3025b18da919c8b5bef88dea0ed969
TLSH
T1BFE0208D04C495777CDDD26782A007C21199C042D9F327657A0438848F495B791D2F5C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/filesystems	cp

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/debian/tests/debian/*.acc	acc

/tmp/debian/tests/acc
/tmp/debian/tests/acc
1⤵
- Writes file to tmp directory
PID:658
- /usr/bin/dpkg-architecture
  dpkg-architecture -qDEB_HOST_MULTIARCH
  2⤵
  PID:661
- - /usr/local/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:684
- - /usr/local/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:684
- - /usr/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:684
- - /usr/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:684
- /bin/cp
  cp -r logs /acc.logs
  2⤵
  - Reads runtime system information
  PID:685