Analysis

  • max time kernel
    0s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    13/11/2026, 10:08

General

  • Target
    debian/autogen.sh
  • Size 819B
  • Sample261113-l595yaav7n
  • SHA256 6142e3418266bc457faff597779b2f3a869eedeaf144a1e70e72c0b32fbed4a9
  • MD5 SHA1 SHA512 TLSH
Score
3/10

Malware Config

Signatures

  • Reads runtime system information 5 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/debian/autogen.sh
    /tmp/debian/autogen.sh
    1⤵
      PID:654
      • /usr/bin/xargs
        xargs -0 rm -rf ";"
        2⤵
        • Reads runtime system information
        PID:658
        • /usr/local/sbin/rm
          rm -rf ";"
          3⤵
            PID:663
          • /usr/local/bin/rm
            rm -rf ";"
            3⤵
              PID:663
            • /usr/sbin/rm
              rm -rf ";"
              3⤵
                PID:663
              • /usr/bin/rm
                rm -rf ";"
                3⤵
                  PID:663
                • /sbin/rm
                  rm -rf ";"
                  3⤵
                    PID:663
                  • /bin/rm
                    rm -rf ";"
                    3⤵
                      PID:663
                  • /usr/bin/find
                    find -type d -name autom4te.cache -print0
                    2⤵
                    • Reads runtime system information
                    PID:657
                  • /usr/bin/xargs
                    xargs -0 rm -f
                    2⤵
                    • Reads runtime system information
                    PID:668
                    • /usr/local/sbin/rm
                      rm -f
                      3⤵
                        PID:672
                      • /usr/local/bin/rm
                        rm -f
                        3⤵
                          PID:672
                        • /usr/sbin/rm
                          rm -f
                          3⤵
                            PID:672
                          • /usr/bin/rm
                            rm -f
                            3⤵
                              PID:672
                            • /sbin/rm
                              rm -f
                              3⤵
                                PID:672
                              • /bin/rm
                                rm -f
                                3⤵
                                  PID:672
                              • /usr/bin/find
                                find -type f "(" -name missing -o -name install-sh -o -name mkinstalldirs -o -name depcomp -o -name ltmain.sh -o -name configure -o -name config.sub -o -name config.guess ")" -print0
                                2⤵
                                • Reads runtime system information
                                PID:667
                              • /bin/cp
                                cp -f /usr/share/automake/install-sh .
                                2⤵
                                • Reads runtime system information
                                PID:674

                            Network

                                  MITRE ATT&CK Matrix

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads