378c4410fa05bae3512be4383835bd0372ee4eb34181a933612955b214f59551

Analysis

max time kernel
0s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20261019-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20261019-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
13/11/2026, 12:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
debian/tests/testsuite
Size 99B
Sample261113-pc65csad93
SHA256 378c4410fa05bae3512be4383835bd0372ee4eb34181a933612955b214f59551
MD5 51f85a0e0af1f4d195393f179d252455
SHA1 dda30a9813b3fa5a1b937619e1d7048dc7c9e4a1
SHA512 f0503551a8d02cbda4032d3ef03819e8a052f45e5479414d7747e052237f483abdb590aaa61c2ba0b9edc587c6afe7647577b01409433c8d470afd9dcea4da3a
TLSH
T1C7B0120A8033038E0458D4AD1E26F07F53D080C43DE6501019F10B0951C12B76623331
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/security/apparmor/features/dbus/mask	dbus-daemon

Reads runtime system information 5 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/mounts	dbus-daemon
File opened for reading	/proc/sys/kernel/cap_last_cap	dbus-daemon
File opened for reading	/proc/1531/status	dbus-daemon
File opened for reading	/proc/1531/attr/current	dbus-daemon
File opened for reading	/proc/filesystems	dbus-daemon

/tmp/debian/tests/testsuite
/tmp/debian/tests/testsuite
1⤵
PID:1524
- /usr/bin/dbus-launch
  dbus-launch --exit-with-session dh_auto_test
  2⤵
  PID:1525
- - /usr/bin/dbus-daemon
    /usr/bin/dbus-daemon --syslog --fork --print-pid 5 --print-address 7 --session
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:1529
- /usr/local/sbin/dh_auto_test
  dh_auto_test
  2⤵
  PID:1525
- /usr/local/bin/dh_auto_test
  dh_auto_test
  2⤵
  PID:1525
- /usr/sbin/dh_auto_test
  dh_auto_test
  2⤵
  PID:1525
- /usr/bin/dh_auto_test
  dh_auto_test
  2⤵
  PID:1525
- /sbin/dh_auto_test
  dh_auto_test
  2⤵
  PID:1525
- /bin/dh_auto_test
  dh_auto_test
  2⤵
  PID:1525
- /snap/bin/dh_auto_test
  dh_auto_test
  2⤵
  PID:1525

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads