f8e5fc55ee7ada14590a70218f95217f32b2931060d1234f5fee5ae77500f181

Analysis

max time kernel
0s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
13/11/2026, 03:07

Target
debian/gbp/postclone.sh
Size 436B
Sample261113-dmg3fae18x
SHA256 f8e5fc55ee7ada14590a70218f95217f32b2931060d1234f5fee5ae77500f181
MD5 a898967ceb87f5755e85c39beb933b5d
SHA1 3b49289d876011558d1227af4989dc911d4fa8e1
SHA512 9921016c7ad1f8972284ec01dddce7a90b14370d6b296db4877073653ed57da92d8c39ed24710a28c6269a602f9945ec31dd051e4b29f55bf1a5a096c367be5a
TLSH
T1A2E0DC3531501C63937992B16838FCC22B25225B179B5D3A0A13124FC4932E4070DCB4
MD5 SHA1 SHA512 TLSH

Score

3^/10

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/debian/gbp/.git/info/exclude	postclone.sh

/tmp/debian/gbp/postclone.sh
/tmp/debian/gbp/postclone.sh
1⤵
- Writes file to tmp directory
PID:716
- /bin/egrep
  egrep "^/?\\.pc/?\$" .git/info/exclude
  2⤵
  PID:719
- /usr/local/sbin/grep
  grep -E "^/?\\.pc/?\$" .git/info/exclude
  2⤵
  PID:719
- /usr/local/bin/grep
  grep -E "^/?\\.pc/?\$" .git/info/exclude
  2⤵
  PID:719
- /usr/sbin/grep
  grep -E "^/?\\.pc/?\$" .git/info/exclude
  2⤵
  PID:719
- /usr/bin/grep
  grep -E "^/?\\.pc/?\$" .git/info/exclude
  2⤵
  PID:719
- /sbin/grep
  grep -E "^/?\\.pc/?\$" .git/info/exclude
  2⤵
  PID:719
- /bin/grep
  grep -E "^/?\\.pc/?\$" .git/info/exclude
  2⤵
  PID:719