f8e5fc55ee7ada14590a70218f95217f32b2931060d1234f5fee5ae77500f181

Analysis

max time kernel
0s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20261019-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20261019-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
13/11/2026, 03:07

Target
debian/gbp/postclone.sh
Size 436B
Sample261113-dmg3fae18x
SHA256 f8e5fc55ee7ada14590a70218f95217f32b2931060d1234f5fee5ae77500f181
MD5 a898967ceb87f5755e85c39beb933b5d
SHA1 3b49289d876011558d1227af4989dc911d4fa8e1
SHA512 9921016c7ad1f8972284ec01dddce7a90b14370d6b296db4877073653ed57da92d8c39ed24710a28c6269a602f9945ec31dd051e4b29f55bf1a5a096c367be5a
TLSH
T1A2E0DC3531501C63937992B16838FCC22B25225B179B5D3A0A13124FC4932E4070DCB4
MD5 SHA1 SHA512 TLSH

Score

3^/10

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/debian/gbp/.git/info/exclude	postclone.sh

/tmp/debian/gbp/postclone.sh
/tmp/debian/gbp/postclone.sh
1⤵
- Writes file to tmp directory
PID:1552
- /bin/egrep
  egrep "^/?\\.pc/?\$" .git/info/exclude
  2⤵
  PID:1553
- /usr/local/sbin/grep
  grep -E "^/?\\.pc/?\$" .git/info/exclude
  2⤵
  PID:1553
- /usr/local/bin/grep
  grep -E "^/?\\.pc/?\$" .git/info/exclude
  2⤵
  PID:1553
- /usr/sbin/grep
  grep -E "^/?\\.pc/?\$" .git/info/exclude
  2⤵
  PID:1553
- /usr/bin/grep
  grep -E "^/?\\.pc/?\$" .git/info/exclude
  2⤵
  PID:1553
- /sbin/grep
  grep -E "^/?\\.pc/?\$" .git/info/exclude
  2⤵
  PID:1553
- /bin/grep
  grep -E "^/?\\.pc/?\$" .git/info/exclude
  2⤵
  PID:1553