d175fd1a5f807c08f5d9f91f30c2af15eb11b9e9ea760be9e2c35f526e1639ef

Analysis

max time kernel
0s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20261019-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20261019-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
10/11/2026, 04:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
debian/rules
Size 841B
Sample261110-extdwsgt8t
SHA256 d175fd1a5f807c08f5d9f91f30c2af15eb11b9e9ea760be9e2c35f526e1639ef
MD5 8bc1808797449071ea351528e05b620c
SHA1 5a9bb676669151ce780406b0c0393dc861918919
SHA512 c1eaedae19fb052caad06436e081683b0f5c41828cb3860bd82a81ded6438d192859c69a16ac63588d73fd31f8295fa4b4749cfeb3dfb7e03d02ce246a3abb4c
TLSH
T1C70112C1D1A0667B0C8FC031A30745236DFB20F9E87A738313D81E31A2CB29502E7961
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg

/tmp/debian/rules
/tmp/debian/rules
1⤵
PID:1529
- /usr/local/sbin/dpkg-architecture
  dpkg-architecture -qDEB_HOST_GNU_TYPE
  2⤵
  PID:1530
- /usr/local/bin/dpkg-architecture
  dpkg-architecture -qDEB_HOST_GNU_TYPE
  2⤵
  PID:1530
- /usr/sbin/dpkg-architecture
  dpkg-architecture -qDEB_HOST_GNU_TYPE
  2⤵
  PID:1530
- /usr/bin/dpkg-architecture
  dpkg-architecture -qDEB_HOST_GNU_TYPE
  2⤵
  PID:1530
- - /usr/local/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:1533
- - /usr/local/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:1533
- - /usr/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:1533
- - /usr/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:1533
- /usr/local/sbin/dpkg-architecture
  dpkg-architecture -qDEB_BUILD_GNU_TYPE
  2⤵
  PID:1535
- /usr/local/bin/dpkg-architecture
  dpkg-architecture -qDEB_BUILD_GNU_TYPE
  2⤵
  PID:1535
- /usr/sbin/dpkg-architecture
  dpkg-architecture -qDEB_BUILD_GNU_TYPE
  2⤵
  PID:1535
- /usr/bin/dpkg-architecture
  dpkg-architecture -qDEB_BUILD_GNU_TYPE
  2⤵
  PID:1535
- - /usr/local/sbin/dpkg
    dpkg --print-architecture
    3⤵
    PID:1539
- - /usr/local/bin/dpkg
    dpkg --print-architecture
    3⤵
    PID:1539
- - /usr/sbin/dpkg
    dpkg --print-architecture
    3⤵
    PID:1539
- - /usr/bin/dpkg
    dpkg --print-architecture
    3⤵
    - Reads runtime system information
    PID:1539
- /usr/local/sbin/dpkg-architecture
  dpkg-architecture -qDEB_BUILD_ARCH
  2⤵
  PID:1540
- /usr/local/bin/dpkg-architecture
  dpkg-architecture -qDEB_BUILD_ARCH
  2⤵
  PID:1540
- /usr/sbin/dpkg-architecture
  dpkg-architecture -qDEB_BUILD_ARCH
  2⤵
  PID:1540
- /usr/bin/dpkg-architecture
  dpkg-architecture -qDEB_BUILD_ARCH
  2⤵
  PID:1540
- - /usr/local/sbin/dpkg
    dpkg --print-architecture
    3⤵
    PID:1541
- - /usr/local/bin/dpkg
    dpkg --print-architecture
    3⤵
    PID:1541
- - /usr/sbin/dpkg
    dpkg --print-architecture
    3⤵
    PID:1541
- - /usr/bin/dpkg
    dpkg --print-architecture
    3⤵
    - Reads runtime system information
    PID:1541
- /usr/local/sbin/dpkg-architecture
  dpkg-architecture -qDEB_HOST_ARCH
  2⤵
  PID:1542
- /usr/local/bin/dpkg-architecture
  dpkg-architecture -qDEB_HOST_ARCH
  2⤵
  PID:1542
- /usr/sbin/dpkg-architecture
  dpkg-architecture -qDEB_HOST_ARCH
  2⤵
  PID:1542
- /usr/bin/dpkg-architecture
  dpkg-architecture -qDEB_HOST_ARCH
  2⤵
  PID:1542
- - /usr/local/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:1543
- - /usr/local/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:1543
- - /usr/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:1543
- - /usr/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:1543
- /usr/local/sbin/rm
  rm -f nscd
  2⤵
  PID:1544
- /usr/local/bin/rm
  rm -f nscd
  2⤵
  PID:1544
- /usr/sbin/rm
  rm -f nscd
  2⤵
  PID:1544
- /usr/bin/rm
  rm -f nscd
  2⤵
  PID:1544
- /sbin/rm
  rm -f nscd
  2⤵
  PID:1544
- /bin/rm
  rm -f nscd
  2⤵
  PID:1544
- /usr/local/sbin/dh_auto_clean
  dh_auto_clean
  2⤵
  PID:1545
- /usr/local/bin/dh_auto_clean
  dh_auto_clean
  2⤵
  PID:1545
- /usr/sbin/dh_auto_clean
  dh_auto_clean
  2⤵
  PID:1545
- /usr/bin/dh_auto_clean
  dh_auto_clean
  2⤵
  PID:1545
- /sbin/dh_auto_clean
  dh_auto_clean
  2⤵
  PID:1545
- /bin/dh_auto_clean
  dh_auto_clean
  2⤵
  PID:1545
- /snap/bin/dh_auto_clean
  dh_auto_clean
  2⤵
  PID:1545

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads