269b4c221f5e8c79ef442d9439db20d770e137df9117a22d6310aa462a8173b0

Analysis

max time kernel
1s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
13/11/2026, 12:11

Target
debian/tests/01.compile-and-run-test-program.t
Size 264B
Sample261113-pc3f6sad76
SHA256 269b4c221f5e8c79ef442d9439db20d770e137df9117a22d6310aa462a8173b0
MD5 65515aef83b26ca6e13fc1cebab8f874
SHA1 9ea6a4e170ba8cb80dd92e042202c528d6b56f37
SHA512 886c1dcedeb91d0eec0e7d794276c12f1a6c51ca3c5c08dfe60dbbf5b2d7dfd7a763c5b975c2c3d73a288d994655747b9634e4bde22a47d6a603c5015e0aee83
TLSH
T105D02B39000F1E664C546A81CC09B43632D0C70539EC95008F531101D313F3F39CF701
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Reads runtime system information 4 IoCs

Reads data from /proc virtual filesystem.

Writes file to tmp directory 3 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/ccTOOpo6.s	gcc
File opened for modification	/tmp/ccTOOpo6.s	cc1
File opened for modification	/tmp/debian/tests/test-results/tmp/debian/tests/01.compile-and-run-test-program.653.counts	01.compile-and-run-test-program.t

/tmp/debian/tests/01.compile-and-run-test-program.t
/tmp/debian/tests/01.compile-and-run-test-program.t
1⤵
- Writes file to tmp directory
PID:653
- /usr/bin/tput
  tput bold
  2⤵
  PID:657
- /usr/bin/basename
  basename /tmp/debian/tests/01.compile-and-run-test-program.t .t
  2⤵
  PID:661
- /bin/rm
  rm -rf "trash directory.01.compile-and-run-test-program"
  2⤵
  PID:664
- /bin/mkdir
  mkdir -p "trash directory.01.compile-and-run-test-program"
  2⤵
  - Reads runtime system information
  PID:666
- /usr/bin/gcc
  gcc ../ex_stats_print.c -o ex_stats_print -ljemalloc
  2⤵
  - Writes file to tmp directory
  PID:671
- - /usr/lib/gcc/arm-linux-gnueabihf/6/cc1
    /usr/lib/gcc/arm-linux-gnueabihf/6/cc1 -quiet -imultilib . -imultiarch arm-linux-gnueabihf ../ex_stats_print.c -quiet -dumpbase ex_stats_print.c "-march=armv7-a" "-mfloat-abi=hard" "-mfpu=vfpv3-d16" -mthumb "-mtls-dialect=gnu" -auxbase ex_stats_print -o /tmp/ccTOOpo6.s
    3⤵
    - Writes file to tmp directory
    PID:675
- /bin/sed
  sed -e "s/^/# /"
  2⤵
  - Reads runtime system information
  PID:687
- /tmp/debian/tests/trash directory.01.compile-and-run-test-program/ex_stats_print
  ./ex_stats_print
  2⤵
  PID:688
- /bin/sed
  sed -e "s/^/# /"
  2⤵
  - Reads runtime system information
  PID:690
- /bin/mkdir
  mkdir -p /tmp/debian/tests/test-results
  2⤵
  - Reads runtime system information
  PID:691

ccTOOpo6.s

Path /tmp/ccTOOpo6.s
Size 271B
SHA256 d969102b016929a5ba7377d045f1ffca5b6220d9cedfd6ece9f4fcc54eece11f
MD5 a7b53417a8f315c40fcc51a170c8b4dd
SHA1 14dc13b6c165a75eb8562c6e0a2dd2850041942e
SHA512 2f88be5c9055a2ef46c41418de803cdf6af5f653e3b53c1a70f73a763b10f343da88311004165aac909ac8447b60ddcd32f1c8060e91d8ff426a353b599076c3
TLSH
T15FD089759A5DD23BDC0695E29AC368AC8186A11E21A90123140AC40B4D3CB24A0EA50E
MD5 SHA1 SHA512 TLSH

Submit Download