269b4c221f5e8c79ef442d9439db20d770e137df9117a22d6310aa462a8173b0

Analysis

max time kernel
0s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20261019-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20261019-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
13/11/2026, 12:11

Target
debian/tests/01.compile-and-run-test-program.t
Size 264B
Sample261113-pc3f6sad76
SHA256 269b4c221f5e8c79ef442d9439db20d770e137df9117a22d6310aa462a8173b0
MD5 65515aef83b26ca6e13fc1cebab8f874
SHA1 9ea6a4e170ba8cb80dd92e042202c528d6b56f37
SHA512 886c1dcedeb91d0eec0e7d794276c12f1a6c51ca3c5c08dfe60dbbf5b2d7dfd7a763c5b975c2c3d73a288d994655747b9634e4bde22a47d6a603c5015e0aee83
TLSH
T105D02B39000F1E664C546A81CC09B43632D0C70539EC95008F531101D313F3F39CF701
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Reads runtime system information 4 IoCs

Reads data from /proc virtual filesystem.

Writes file to tmp directory 3 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/ccHv2JF7.s	gcc
File opened for modification	/tmp/ccHv2JF7.s	cc1
File opened for modification	/tmp/debian/tests/test-results/tmp/debian/tests/01.compile-and-run-test-program.1519.counts	01.compile-and-run-test-program.t

/tmp/debian/tests/01.compile-and-run-test-program.t
/tmp/debian/tests/01.compile-and-run-test-program.t
1⤵
- Writes file to tmp directory
PID:1519
- /usr/bin/tput
  tput bold
  2⤵
  PID:1521
- /usr/bin/basename
  basename /tmp/debian/tests/01.compile-and-run-test-program.t .t
  2⤵
  PID:1523
- /bin/rm
  rm -rf "trash directory.01.compile-and-run-test-program"
  2⤵
  PID:1524
- /bin/mkdir
  mkdir -p "trash directory.01.compile-and-run-test-program"
  2⤵
  - Reads runtime system information
  PID:1525
- /usr/bin/gcc
  gcc ../ex_stats_print.c -o ex_stats_print -ljemalloc
  2⤵
  - Writes file to tmp directory
  PID:1527
- - /usr/lib/gcc/x86_64-linux-gnu/7/cc1
    /usr/lib/gcc/x86_64-linux-gnu/7/cc1 -quiet -imultiarch x86_64-linux-gnu ../ex_stats_print.c -quiet -dumpbase ex_stats_print.c "-mtune=generic" "-march=x86-64" -auxbase ex_stats_print -fstack-protector-strong -Wformat -Wformat-security -o /tmp/ccHv2JF7.s
    3⤵
    - Writes file to tmp directory
    PID:1528
- /bin/sed
  sed -e "s/^/# /"
  2⤵
  - Reads runtime system information
  PID:1532
- /tmp/debian/tests/trash directory.01.compile-and-run-test-program/ex_stats_print
  ./ex_stats_print
  2⤵
  PID:1533
- /bin/sed
  sed -e "s/^/# /"
  2⤵
  - Reads runtime system information
  PID:1535
- /bin/mkdir
  mkdir -p /tmp/debian/tests/test-results
  2⤵
  - Reads runtime system information
  PID:1536

ccHv2JF7.s

Path /tmp/ccHv2JF7.s
Size 26B
SHA256 44385c2e9a8981a377d8937021b0d0014ec70d49ddf474bc0ae5040ddec33994
MD5 6ca585f34afa36da96ebfc367fef9c79
SHA1 7d2854c20541d4ee8d5d52100e900110a6d5474a
SHA512 4adc60aefb79edfb3833f505708d5ac80aea1521a85e217e1de01881f495b9334e8cbccfb9726d4c9efcbcd9544508bd6f55345863dce19b618d08d0c5642e3f
MD5 SHA1 SHA512

Submit Download