c51faef7af818fa229c814d4ec820a637b624c771fe50ac2ba1d032f5357283e

Analysis

max time kernel
10s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
10/11/2026, 07:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
debian/rules
Size 1KB
Sample261110-hycdjsdf72
SHA256 c51faef7af818fa229c814d4ec820a637b624c771fe50ac2ba1d032f5357283e
MD5 d3ae93ca027bcebc06ff489d31c4c284
SHA1 85b3537aaf1e77916875fee357ab5653ac10684b
SHA512 7ce1039a489ea199adb5db0668ac0e04170e93b3ba8277076c4f14b6f598fafef2e158d4fb000a4d7d96ae99d4550125543b349c8b51a80d0d27262195511d31
TLSH
T1FC410F31D2F852B59C16E631DB4486CA9FEB84F887F2B2A1F5CC6C34A21165191B9A90
MD5 SHA1 SHA512 TLSH

Score

2^/10

execution

Malware Config

Signatures

Software Deployment Tools 1 TTPs 10 IoCs

Use software deployment tools to execute code.

execution

Software Deployment Tools

T1072

pid	Process
673	dpkg-buildflags
676	dpkg-buildflags
691	dpkg-buildflags
733	dpkg-parsechangelog
751	dpkg-buildflags
774	dpkg-buildflags
721	dpkg-buildflags
730	dpkg-buildflags
768	dpkg-buildflags
771	dpkg-buildflags

/tmp/debian/rules
/tmp/debian/rules
1⤵
PID:646
- /usr/local/sbin/dpkg-architecture
  dpkg-architecture -qDEB_HOST_ARCH_BITS
  2⤵
  PID:652
- /usr/local/bin/dpkg-architecture
  dpkg-architecture -qDEB_HOST_ARCH_BITS
  2⤵
  PID:652
- /usr/sbin/dpkg-architecture
  dpkg-architecture -qDEB_HOST_ARCH_BITS
  2⤵
  PID:652
- /usr/bin/dpkg-architecture
  dpkg-architecture -qDEB_HOST_ARCH_BITS
  2⤵
  PID:652
- - /usr/local/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:672
- - /usr/local/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:672
- - /usr/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:672
- - /usr/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:672
- /usr/local/sbin/dpkg-buildflags
  dpkg-buildflags --get OBJCXXFLAGS
  2⤵
  PID:673
- /usr/local/bin/dpkg-buildflags
  dpkg-buildflags --get OBJCXXFLAGS
  2⤵
  PID:673
- /usr/sbin/dpkg-buildflags
  dpkg-buildflags --get OBJCXXFLAGS
  2⤵
  PID:673
- /usr/bin/dpkg-buildflags
  dpkg-buildflags --get OBJCXXFLAGS
  2⤵
  - Software Deployment Tools
  PID:673
- - /bin/pwd
    /bin/pwd
    3⤵
    PID:674
- - /usr/local/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:675
- - /usr/local/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:675
- - /usr/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:675
- - /usr/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:675
- /usr/local/sbin/dpkg-buildflags
  dpkg-buildflags --get CPPFLAGS
  2⤵
  PID:676
- /usr/local/bin/dpkg-buildflags
  dpkg-buildflags --get CPPFLAGS
  2⤵
  PID:676
- /usr/sbin/dpkg-buildflags
  dpkg-buildflags --get CPPFLAGS
  2⤵
  PID:676
- /usr/bin/dpkg-buildflags
  dpkg-buildflags --get CPPFLAGS
  2⤵
  - Software Deployment Tools
  PID:676
- - /bin/pwd
    /bin/pwd
    3⤵
    PID:686
- - /usr/local/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:688
- - /usr/local/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:688
- - /usr/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:688
- - /usr/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:688
- /usr/local/sbin/dpkg-buildflags
  dpkg-buildflags --get GCJFLAGS
  2⤵
  PID:691
- /usr/local/bin/dpkg-buildflags
  dpkg-buildflags --get GCJFLAGS
  2⤵
  PID:691
- /usr/sbin/dpkg-buildflags
  dpkg-buildflags --get GCJFLAGS
  2⤵
  PID:691
- /usr/bin/dpkg-buildflags
  dpkg-buildflags --get GCJFLAGS
  2⤵
  - Software Deployment Tools
  PID:691
- - /bin/pwd
    /bin/pwd
    3⤵
    PID:716
- - /usr/local/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:719
- - /usr/local/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:719
- - /usr/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:719
- - /usr/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:719
- /usr/local/sbin/dpkg-buildflags
  dpkg-buildflags --get CFLAGS
  2⤵
  PID:721
- /usr/local/bin/dpkg-buildflags
  dpkg-buildflags --get CFLAGS
  2⤵
  PID:721
- /usr/sbin/dpkg-buildflags
  dpkg-buildflags --get CFLAGS
  2⤵
  PID:721
- /usr/bin/dpkg-buildflags
  dpkg-buildflags --get CFLAGS
  2⤵
  - Software Deployment Tools
  PID:721
- - /bin/pwd
    /bin/pwd
    3⤵
    PID:728
- - /usr/local/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:729
- - /usr/local/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:729
- - /usr/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:729
- - /usr/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:729
- /usr/local/sbin/dpkg-buildflags
  dpkg-buildflags --get CXXFLAGS
  2⤵
  PID:730
- /usr/local/bin/dpkg-buildflags
  dpkg-buildflags --get CXXFLAGS
  2⤵
  PID:730
- /usr/sbin/dpkg-buildflags
  dpkg-buildflags --get CXXFLAGS
  2⤵
  PID:730
- /usr/bin/dpkg-buildflags
  dpkg-buildflags --get CXXFLAGS
  2⤵
  - Software Deployment Tools
  PID:730
- - /bin/pwd
    /bin/pwd
    3⤵
    PID:731
- - /usr/local/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:732
- - /usr/local/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:732
- - /usr/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:732
- - /usr/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:732
- /usr/local/sbin/dpkg-parsechangelog
  dpkg-parsechangelog -STimestamp
  2⤵
  PID:733
- /usr/local/bin/dpkg-parsechangelog
  dpkg-parsechangelog -STimestamp
  2⤵
  PID:733
- /usr/sbin/dpkg-parsechangelog
  dpkg-parsechangelog -STimestamp
  2⤵
  PID:733
- /usr/bin/dpkg-parsechangelog
  dpkg-parsechangelog -STimestamp
  2⤵
  - Software Deployment Tools
  PID:733
- - /usr/local/sbin/tail
    tail -n 40 debian/changelog
    3⤵
    PID:749
- - /usr/local/bin/tail
    tail -n 40 debian/changelog
    3⤵
    PID:749
- - /usr/sbin/tail
    tail -n 40 debian/changelog
    3⤵
    PID:749
- - /usr/bin/tail
    tail -n 40 debian/changelog
    3⤵
    PID:749
- /usr/local/sbin/dpkg-buildflags
  dpkg-buildflags --get FFLAGS
  2⤵
  PID:751
- /usr/local/bin/dpkg-buildflags
  dpkg-buildflags --get FFLAGS
  2⤵
  PID:751
- /usr/sbin/dpkg-buildflags
  dpkg-buildflags --get FFLAGS
  2⤵
  PID:751
- /usr/bin/dpkg-buildflags
  dpkg-buildflags --get FFLAGS
  2⤵
  - Software Deployment Tools
  PID:751
- - /bin/pwd
    /bin/pwd
    3⤵
    PID:766
- - /usr/local/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:767
- - /usr/local/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:767
- - /usr/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:767
- - /usr/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:767
- /usr/local/sbin/dpkg-buildflags
  dpkg-buildflags --get LDFLAGS
  2⤵
  PID:768
- /usr/local/bin/dpkg-buildflags
  dpkg-buildflags --get LDFLAGS
  2⤵
  PID:768
- /usr/sbin/dpkg-buildflags
  dpkg-buildflags --get LDFLAGS
  2⤵
  PID:768
- /usr/bin/dpkg-buildflags
  dpkg-buildflags --get LDFLAGS
  2⤵
  - Software Deployment Tools
  PID:768
- - /bin/pwd
    /bin/pwd
    3⤵
    PID:769
- - /usr/local/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:770
- - /usr/local/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:770
- - /usr/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:770
- - /usr/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:770
- /usr/local/sbin/dpkg-buildflags
  dpkg-buildflags --get FCFLAGS
  2⤵
  PID:771
- /usr/local/bin/dpkg-buildflags
  dpkg-buildflags --get FCFLAGS
  2⤵
  PID:771
- /usr/sbin/dpkg-buildflags
  dpkg-buildflags --get FCFLAGS
  2⤵
  PID:771
- /usr/bin/dpkg-buildflags
  dpkg-buildflags --get FCFLAGS
  2⤵
  - Software Deployment Tools
  PID:771
- - /bin/pwd
    /bin/pwd
    3⤵
    PID:772
- - /usr/local/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:773
- - /usr/local/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:773
- - /usr/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:773
- - /usr/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:773
- /usr/local/sbin/dpkg-buildflags
  dpkg-buildflags --get OBJCFLAGS
  2⤵
  PID:774
- /usr/local/bin/dpkg-buildflags
  dpkg-buildflags --get OBJCFLAGS
  2⤵
  PID:774
- /usr/sbin/dpkg-buildflags
  dpkg-buildflags --get OBJCFLAGS
  2⤵
  PID:774
- /usr/bin/dpkg-buildflags
  dpkg-buildflags --get OBJCFLAGS
  2⤵
  - Software Deployment Tools
  PID:774
- - /bin/pwd
    /bin/pwd
    3⤵
    PID:775
- - /usr/local/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:776
- - /usr/local/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:776
- - /usr/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:776
- - /usr/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:776
- /usr/local/sbin/dh
  dh override_dh_auto_configure --with "autoreconf,javahelper"
  2⤵
  PID:777
- /usr/local/bin/dh
  dh override_dh_auto_configure --with "autoreconf,javahelper"
  2⤵
  PID:777
- /usr/sbin/dh
  dh override_dh_auto_configure --with "autoreconf,javahelper"
  2⤵
  PID:777
- /usr/bin/dh
  dh override_dh_auto_configure --with "autoreconf,javahelper"
  2⤵
  PID:777
- /sbin/dh
  dh override_dh_auto_configure --with "autoreconf,javahelper"
  2⤵
  PID:777
- /bin/dh
  dh override_dh_auto_configure --with "autoreconf,javahelper"
  2⤵
  PID:777

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Software Deployment Tools

T1072

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Software Deployment Tools

T1072

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads