c57a97ea55cae8e9726a6ec9884898ff1b43f3a6469bf93deac7fbbb0a1c9de4

Analysis

max time kernel
1s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
10/11/2026, 10:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
debian/rules
Size 658B
Sample261110-l9lcdaee78
SHA256 c57a97ea55cae8e9726a6ec9884898ff1b43f3a6469bf93deac7fbbb0a1c9de4
MD5 5833a6bacc34db6f12cf834b9afd609b
SHA1 38ca5a374b934967686ac2581068b739f113a6c1
SHA512 49381a3f45703fb7ac844d8df319534e80621841c2c4611700727dace98e86ea1ad4a0b3fae9ab6c05b9ec69c160867c0624029ea94744c3b50b3e0acb6509b4
TLSH
T167019E73C33DCCF1284EE202831942A09BA3B0F5C5DC7051B3E9A90E691655452B5563
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: Unix Shell 1 TTPs 1 IoCs

Execute scripts via Unix Shell.

execution

Unix Shell

T1059.004

pid	Process
650	sh

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed

Software Deployment Tools 1 TTPs 1 IoCs

Use software deployment tools to execute code.

execution

Software Deployment Tools

T1072

pid	Process
652	dpkg-parsechangelog

/tmp/debian/rules
/tmp/debian/rules
1⤵
PID:645
- /bin/sh
  /bin/sh -c "dpkg-parsechangelog | sed -ne 's/^Version: \\(.*\\)-.*/\\1/p' | sed -e 's/\\+.*//; s/^[0-9]://'"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:650
- - /bin/sed
    sed -ne "s/^Version: \\(.*\\)-.*/\\1/p"
    3⤵
    - Reads runtime system information
    PID:653
- - /bin/sed
    sed -e "s/\\+.*//; s/^[0-9]://"
    3⤵
    - Reads runtime system information
    PID:654
- - /usr/bin/dpkg-parsechangelog
    dpkg-parsechangelog
    3⤵
    - Software Deployment Tools
    PID:652
  - - /usr/local/sbin/tail
      tail -n 40 debian/changelog
      4⤵
      PID:676
  - - /usr/local/bin/tail
      tail -n 40 debian/changelog
      4⤵
      PID:676
  - - /usr/sbin/tail
      tail -n 40 debian/changelog
      4⤵
      PID:676
  - - /usr/bin/tail
      tail -n 40 debian/changelog
      4⤵
      PID:676
- /usr/local/sbin/dh_auto_clean
  dh_auto_clean
  2⤵
  PID:677
- /usr/local/bin/dh_auto_clean
  dh_auto_clean
  2⤵
  PID:677
- /usr/sbin/dh_auto_clean
  dh_auto_clean
  2⤵
  PID:677
- /usr/bin/dh_auto_clean
  dh_auto_clean
  2⤵
  PID:677
- /sbin/dh_auto_clean
  dh_auto_clean
  2⤵
  PID:677
- /bin/dh_auto_clean
  dh_auto_clean
  2⤵
  PID:677

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Unix Shell

T1059.004

Software Deployment Tools

T1072

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Software Deployment Tools

T1072

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads