1a19c50e140680d69d56cc502b903192fc4986c5716d326b2642a05ce33c6d95

Analysis

max time kernel
0s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20261019-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20261019-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
13/11/2026, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
debian/tests/run-tests
Size 125B
Sample261113-pc3f6sad76
SHA256 1a19c50e140680d69d56cc502b903192fc4986c5716d326b2642a05ce33c6d95
MD5 3feaa6e92989698d9673c83889b722fe
SHA1 540ef6cfc883a78ec73c8ba873451490eda6b15d
SHA512 19d891735d77ffe7e3335195b618812b0b4354543cd3b0fb6277146f1c1659a058fd0a44ee3416bf87695ddddce89354c3defb4fbe489c62d40e4ca513faace9
TLSH
T1E3B02B15D417047C0888E42390820A28840048C50C4F30B0800424856470313F63360B
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads runtime system information 3 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	sed

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/cc7Ekxvn.s	gcc
File opened for modification	/tmp/cc7Ekxvn.s	cc1

/tmp/debian/tests/run-tests
/tmp/debian/tests/run-tests
1⤵
PID:1512
- /usr/bin/dirname
  dirname /tmp/debian/tests/run-tests
  2⤵
  PID:1513
- /bin/mktemp
  mktemp -d "--suffix=.autopkgtest"
  2⤵
  PID:1514
- /usr/bin/prove
  prove -v 01.compile-and-run-test-program.t
  2⤵
  PID:1515
- - /usr/bin/perl
    /usr/bin/perl 01.compile-and-run-test-program.t
    3⤵
    PID:1523
- - /bin/sh
    /bin/sh 01.compile-and-run-test-program.t
    3⤵
    PID:1523
  - - /usr/bin/basename
      basename 01.compile-and-run-test-program.t .t
      4⤵
      PID:1526
  - - /bin/rm
      rm -rf "trash directory.01.compile-and-run-test-program"
      4⤵
      PID:1527
  - - /bin/mkdir
      mkdir -p "trash directory.01.compile-and-run-test-program"
      4⤵
      Reads runtime system information
      PID:1528
  - - /usr/bin/gcc
      gcc ../ex_stats_print.c -o ex_stats_print -ljemalloc
      4⤵
      Writes file to tmp directory
      PID:1529
    - - /usr/lib/gcc/x86_64-linux-gnu/7/cc1
        
        /usr/lib/gcc/x86_64-linux-gnu/7/cc1 -quiet -imultiarch x86_64-linux-gnu ../ex_stats_print.c -quiet -dumpbase ex_stats_print.c "-mtune=generic" "-march=x86-64" -auxbase ex_stats_print -fstack-protector-strong -Wformat -Wformat-security -o /tmp/cc7Ekxvn.s
        5⤵
        Writes file to tmp directory
        
        PID:1530
  - - /bin/sed
      sed -e "s/^/# /"
      4⤵
      Reads runtime system information
      PID:1532
  - - /tmp/debian/tests/trash directory.01.compile-and-run-test-program/ex_stats_print
      ./ex_stats_print
      4⤵
      PID:1533
  - - /bin/sed
      sed -e "s/^/# /"
      4⤵
      Reads runtime system information
      PID:1535

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

cc7Ekxvn.s

Path /tmp/cc7Ekxvn.s
Size 26B
SHA256 44385c2e9a8981a377d8937021b0d0014ec70d49ddf474bc0ae5040ddec33994
MD5 6ca585f34afa36da96ebfc367fef9c79
SHA1 7d2854c20541d4ee8d5d52100e900110a6d5474a
SHA512 4adc60aefb79edfb3833f505708d5ac80aea1521a85e217e1de01881f495b9334e8cbccfb9726d4c9efcbcd9544508bd6f55345863dce19b618d08d0c5642e3f
MD5 SHA1 SHA512

Submit Download