e8443fa6f5e3e083554cb2aaa935919436d09f53863b5a365f7e1c1621add3cf

Analysis

max time kernel
1s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
13/11/2026, 12:11

Target
debian/tests/build
Size 1KB
Sample261113-pc5arsad83
SHA256 e8443fa6f5e3e083554cb2aaa935919436d09f53863b5a365f7e1c1621add3cf
MD5 20c4ad5885374c331d64e480f69d04e0
SHA1 c92d7bfb6bad5dbb2f6c98d7160eb1336e299a66
SHA512 aafbbe75e2e75ce59d90ff9e6d3ca8828395ea77bd3debe9182825eae5c16095301b56fb475dd465c4d9df3c9135fcd8e17b9c6487d79cc6ce01725fe0c4fd42
TLSH
T1CD214456370706302C57B251334E2052F678E46B1B19A21271DE0235EF020E153FBFDA
MD5 SHA1 SHA512 TLSH

Score

3^/10

Writes file to tmp directory 3 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/cc4WaU24.s	cc1plus
File opened for modification	/tmp/tmp.U64aJWtMCX/simbodytest.c	build
File opened for modification	/tmp/cc4WaU24.s	g++

/tmp/debian/tests/build
/tmp/debian/tests/build
1⤵
- Writes file to tmp directory
PID:657
- /bin/mktemp
  mktemp -d
  2⤵
  PID:659
- /bin/cat
  cat
  2⤵
  PID:663
- /usr/bin/g++
  g++ -o simbodytest simbodytest.c
  2⤵
  - Writes file to tmp directory
  PID:668
- - /usr/lib/gcc/arm-linux-gnueabihf/6/cc1plus
    /usr/lib/gcc/arm-linux-gnueabihf/6/cc1plus -quiet -imultilib . -imultiarch arm-linux-gnueabihf -D_GNU_SOURCE simbodytest.c -quiet -dumpbase simbodytest.c "-march=armv7-a" "-mfloat-abi=hard" "-mfpu=vfpv3-d16" -mthumb "-mtls-dialect=gnu" -auxbase simbodytest -o /tmp/cc4WaU24.s
    3⤵
    - Writes file to tmp directory
    PID:676
- /bin/rm
  rm -rf /tmp/tmp.U64aJWtMCX
  2⤵
  PID:686

cc4WaU24.s

Path /tmp/cc4WaU24.s
Size 268B
SHA256 23dcf80611ffa67377ce11e5c83ef92a67f962fb98dd130d45ece86f4f7d5d48
MD5 70a06b31f6117b5aef44edb9e84291a6
SHA1 85efa07e0fca9deb5c1e7eab735c7d1e3576021f
SHA512 69ba57245e30de0f7e08f00d07eff58a68ac9020de78bca6d7b66a7bf96385a656ba34693fee67947d6d81ec3902ff2ad3dbe36b25b52d2654150bf9842151f7
TLSH
T161D09B79DA5DD23BDC0690E39AC369ADD187B11E25A90133140AC40F0D6CB64A0EE90E
MD5 SHA1 SHA512 TLSH

Submit Download

simbodytest.c

Path /tmp/tmp.U64aJWtMCX/simbodytest.c
Size 712B
SHA256 e7448aecec48e953f26f75cba643a44d2c313e707b20a2278e68fb895c027280
MD5 5edfac30edaa1a8709be0981c288386a
SHA1 8271d72ce443499958ef5846d72edcdf2e09e109
SHA512 5e197253e79a0dcd1a0534513d6b3e149f84c2384f2350b8259973339c9274718b406e0a86d602a050ae0c34273e9d24a80b954f993718b54d41324f49671fd6
TLSH
T1D2017B42270702616993D364235E3041E979E86F0B24C22276DE4769EF544D553F7FE6
MD5 SHA1 SHA512 TLSH

Submit Download