b89d9258946bcb083896815c09249dd5032807a0c63663fccc5ef29328e65c0e

Analysis

max time kernel
3s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
02/11/2026, 00:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
debian/rules
Size 5KB
Sample261102-ajdn3ayzh1
SHA256 b89d9258946bcb083896815c09249dd5032807a0c63663fccc5ef29328e65c0e
MD5 40fe79b8bf7345a3c3d738a6da84ba43
SHA1 76977bc45134fae7eb921dce3c8ab9fba249fe99
SHA512 58b45c9a0f0df28389232e8ef45b735df11f94a0d00137e010dd95296d803a0325b5f79e8f3cb6a0d4dc94e73161392f1fa84ebdb66265d1d3d13dbced616b43
SSDEEP 96:GnaQHWNResXjeRkiQoIEDOHYlOqUO53AYqsAtktw6ck/LxrGwLCxXDM:9QHWNIJK2A2rZGwLcXDM
TLSH
T1B7B1772BE31006F6258666B8B30438B5E739D072DB63B460F5FA6E95333C0566367CE9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

2^/10

execution

Malware Config

Signatures

Software Deployment Tools 1 TTPs 1 IoCs

Use software deployment tools to execute code.

execution

Software Deployment Tools

T1072

pid	Process
674	dpkg-parsechangelog

/tmp/debian/rules
/tmp/debian/rules
1⤵
PID:646
- /usr/local/sbin/date
  date -R
  2⤵
  PID:652
- /usr/local/bin/date
  date -R
  2⤵
  PID:652
- /usr/sbin/date
  date -R
  2⤵
  PID:652
- /usr/bin/date
  date -R
  2⤵
  PID:652
- /sbin/date
  date -R
  2⤵
  PID:652
- /bin/date
  date -R
  2⤵
  PID:652
- /usr/local/sbin/dpkg-architecture
  dpkg-architecture -qDEB_HOST_ARCH
  2⤵
  PID:655
- /usr/local/bin/dpkg-architecture
  dpkg-architecture -qDEB_HOST_ARCH
  2⤵
  PID:655
- /usr/sbin/dpkg-architecture
  dpkg-architecture -qDEB_HOST_ARCH
  2⤵
  PID:655
- /usr/bin/dpkg-architecture
  dpkg-architecture -qDEB_HOST_ARCH
  2⤵
  PID:655
- - /usr/local/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:673
- - /usr/local/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:673
- - /usr/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:673
- - /usr/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:673
- /usr/local/sbin/dpkg-parsechangelog
  dpkg-parsechangelog -STimestamp
  2⤵
  PID:674
- /usr/local/bin/dpkg-parsechangelog
  dpkg-parsechangelog -STimestamp
  2⤵
  PID:674
- /usr/sbin/dpkg-parsechangelog
  dpkg-parsechangelog -STimestamp
  2⤵
  PID:674
- /usr/bin/dpkg-parsechangelog
  dpkg-parsechangelog -STimestamp
  2⤵
  - Software Deployment Tools
  PID:674
- - /usr/local/sbin/tail
    tail -n 40 debian/changelog
    3⤵
    PID:675
- - /usr/local/bin/tail
    tail -n 40 debian/changelog
    3⤵
    PID:675
- - /usr/sbin/tail
    tail -n 40 debian/changelog
    3⤵
    PID:675
- - /usr/bin/tail
    tail -n 40 debian/changelog
    3⤵
    PID:675
- /usr/local/sbin/dh
  dh debian/rules.defs
  2⤵
  PID:676
- /usr/local/bin/dh
  dh debian/rules.defs
  2⤵
  PID:676
- /usr/sbin/dh
  dh debian/rules.defs
  2⤵
  PID:676
- /usr/bin/dh
  dh debian/rules.defs
  2⤵
  PID:676
- /sbin/dh
  dh debian/rules.defs
  2⤵
  PID:676
- /bin/dh
  dh debian/rules.defs
  2⤵
  PID:676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Software Deployment Tools

T1072

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Software Deployment Tools

T1072

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads