4007cc72b8cb4f3ab42106d06bc8a8635b2a6a7a2e21419a1894f8840f62ad0f

Analysis

max time kernel
0s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20261019-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20261019-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
10/11/2026, 12:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
debian/rules
Size 652B
Sample261110-pbc5wsfb75
SHA256 4007cc72b8cb4f3ab42106d06bc8a8635b2a6a7a2e21419a1894f8840f62ad0f
MD5 1f55999bdbb4ea98e35637c602633d78
SHA1 fc1c55bcdee61d7deb19367ff79cab62303ed16e
SHA512 686b8edfaeeff76d603373752140808da113d611df2bd7b5d4c499f39a9d34434706e171d28cd0753b7ee01c434f972dd86c59457f398d4aef8af8fa8b53499f
TLSH
T176F0233343FC89ACA8841A20B34282655BD263FD4AFB7B4352F6010401D6351307625C
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: Unix Shell 1 TTPs 9 IoCs

Execute scripts via Unix Shell.

execution

Unix Shell

T1059.004

pid	Process
1548	sh
1556	sh
1560	sh
1571	sh
1579	sh
1587	sh
1564	sh
1575	sh
1583	sh

Software Deployment Tools 1 TTPs 10 IoCs

Use software deployment tools to execute code.

execution

Software Deployment Tools

T1072

pid	Process
1549	dpkg-buildflags
1561	dpkg-buildflags
1572	dpkg-buildflags
1576	dpkg-buildflags
1584	dpkg-buildflags
1545	dpkg-buildflags
1557	dpkg-buildflags
1565	dpkg-buildflags
1580	dpkg-buildflags
1588	dpkg-buildflags

/tmp/debian/rules
/tmp/debian/rules
1⤵
PID:1544
- /usr/local/sbin/dpkg-buildflags
  dpkg-buildflags "--export=configure"
  2⤵
  PID:1545
- /usr/local/bin/dpkg-buildflags
  dpkg-buildflags "--export=configure"
  2⤵
  PID:1545
- /usr/sbin/dpkg-buildflags
  dpkg-buildflags "--export=configure"
  2⤵
  PID:1545
- /usr/bin/dpkg-buildflags
  dpkg-buildflags "--export=configure"
  2⤵
  - Software Deployment Tools
  PID:1545
- - /usr/local/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:1546
- - /usr/local/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:1546
- - /usr/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:1546
- - /usr/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:1546
- - /bin/pwd
    /bin/pwd
    3⤵
    PID:1547
- /bin/sh
  /bin/sh -c "DEB_BUILD_MAINT_OPTIONS=\"hardening=+all\" dpkg-buildflags --get OBJCXXFLAGS"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:1548
- - /usr/bin/dpkg-buildflags
    dpkg-buildflags --get OBJCXXFLAGS
    3⤵
    - Software Deployment Tools
    PID:1549
  - - /usr/local/sbin/gcc
      gcc -dumpmachine
      4⤵
      PID:1553
  - - /usr/local/bin/gcc
      gcc -dumpmachine
      4⤵
      PID:1553
  - - /usr/sbin/gcc
      gcc -dumpmachine
      4⤵
      PID:1553
  - - /usr/bin/gcc
      gcc -dumpmachine
      4⤵
      PID:1553
  - - /bin/pwd
      /bin/pwd
      4⤵
      PID:1554
- /bin/sh
  /bin/sh -c "DEB_BUILD_MAINT_OPTIONS=\"hardening=+all\" dpkg-buildflags --get CPPFLAGS"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:1556
- - /usr/bin/dpkg-buildflags
    dpkg-buildflags --get CPPFLAGS
    3⤵
    - Software Deployment Tools
    PID:1557
  - - /usr/local/sbin/gcc
      gcc -dumpmachine
      4⤵
      PID:1558
  - - /usr/local/bin/gcc
      gcc -dumpmachine
      4⤵
      PID:1558
  - - /usr/sbin/gcc
      gcc -dumpmachine
      4⤵
      PID:1558
  - - /usr/bin/gcc
      gcc -dumpmachine
      4⤵
      PID:1558
  - - /bin/pwd
      /bin/pwd
      4⤵
      PID:1559
- /bin/sh
  /bin/sh -c "DEB_BUILD_MAINT_OPTIONS=\"hardening=+all\" dpkg-buildflags --get GCJFLAGS"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:1560
- - /usr/bin/dpkg-buildflags
    dpkg-buildflags --get GCJFLAGS
    3⤵
    - Software Deployment Tools
    PID:1561
  - - /usr/local/sbin/gcc
      gcc -dumpmachine
      4⤵
      PID:1562
  - - /usr/local/bin/gcc
      gcc -dumpmachine
      4⤵
      PID:1562
  - - /usr/sbin/gcc
      gcc -dumpmachine
      4⤵
      PID:1562
  - - /usr/bin/gcc
      gcc -dumpmachine
      4⤵
      PID:1562
  - - /bin/pwd
      /bin/pwd
      4⤵
      PID:1563
- /bin/sh
  /bin/sh -c "DEB_BUILD_MAINT_OPTIONS=\"hardening=+all\" dpkg-buildflags --get CFLAGS"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:1564
- - /usr/bin/dpkg-buildflags
    dpkg-buildflags --get CFLAGS
    3⤵
    - Software Deployment Tools
    PID:1565
  - - /usr/local/sbin/gcc
      gcc -dumpmachine
      4⤵
      PID:1569
  - - /usr/local/bin/gcc
      gcc -dumpmachine
      4⤵
      PID:1569
  - - /usr/sbin/gcc
      gcc -dumpmachine
      4⤵
      PID:1569
  - - /usr/bin/gcc
      gcc -dumpmachine
      4⤵
      PID:1569
  - - /bin/pwd
      /bin/pwd
      4⤵
      PID:1570
- /bin/sh
  /bin/sh -c "DEB_BUILD_MAINT_OPTIONS=\"hardening=+all\" dpkg-buildflags --get CXXFLAGS"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:1571
- - /usr/bin/dpkg-buildflags
    dpkg-buildflags --get CXXFLAGS
    3⤵
    - Software Deployment Tools
    PID:1572
  - - /usr/local/sbin/gcc
      gcc -dumpmachine
      4⤵
      PID:1573
  - - /usr/local/bin/gcc
      gcc -dumpmachine
      4⤵
      PID:1573
  - - /usr/sbin/gcc
      gcc -dumpmachine
      4⤵
      PID:1573
  - - /usr/bin/gcc
      gcc -dumpmachine
      4⤵
      PID:1573
  - - /bin/pwd
      /bin/pwd
      4⤵
      PID:1574
- /bin/sh
  /bin/sh -c "DEB_BUILD_MAINT_OPTIONS=\"hardening=+all\" dpkg-buildflags --get FFLAGS"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:1575
- - /usr/bin/dpkg-buildflags
    dpkg-buildflags --get FFLAGS
    3⤵
    - Software Deployment Tools
    PID:1576
  - - /usr/local/sbin/gcc
      gcc -dumpmachine
      4⤵
      PID:1577
  - - /usr/local/bin/gcc
      gcc -dumpmachine
      4⤵
      PID:1577
  - - /usr/sbin/gcc
      gcc -dumpmachine
      4⤵
      PID:1577
  - - /usr/bin/gcc
      gcc -dumpmachine
      4⤵
      PID:1577
  - - /bin/pwd
      /bin/pwd
      4⤵
      PID:1578
- /bin/sh
  /bin/sh -c "DEB_BUILD_MAINT_OPTIONS=\"hardening=+all\" dpkg-buildflags --get LDFLAGS"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:1579
- - /usr/bin/dpkg-buildflags
    dpkg-buildflags --get LDFLAGS
    3⤵
    - Software Deployment Tools
    PID:1580
  - - /usr/local/sbin/gcc
      gcc -dumpmachine
      4⤵
      PID:1581
  - - /usr/local/bin/gcc
      gcc -dumpmachine
      4⤵
      PID:1581
  - - /usr/sbin/gcc
      gcc -dumpmachine
      4⤵
      PID:1581
  - - /usr/bin/gcc
      gcc -dumpmachine
      4⤵
      PID:1581
  - - /bin/pwd
      /bin/pwd
      4⤵
      PID:1582
- /bin/sh
  /bin/sh -c "DEB_BUILD_MAINT_OPTIONS=\"hardening=+all\" dpkg-buildflags --get FCFLAGS"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:1583
- - /usr/bin/dpkg-buildflags
    dpkg-buildflags --get FCFLAGS
    3⤵
    - Software Deployment Tools
    PID:1584
  - - /usr/local/sbin/gcc
      gcc -dumpmachine
      4⤵
      PID:1585
  - - /usr/local/bin/gcc
      gcc -dumpmachine
      4⤵
      PID:1585
  - - /usr/sbin/gcc
      gcc -dumpmachine
      4⤵
      PID:1585
  - - /usr/bin/gcc
      gcc -dumpmachine
      4⤵
      PID:1585
  - - /bin/pwd
      /bin/pwd
      4⤵
      PID:1586
- /bin/sh
  /bin/sh -c "DEB_BUILD_MAINT_OPTIONS=\"hardening=+all\" dpkg-buildflags --get OBJCFLAGS"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:1587
- - /usr/bin/dpkg-buildflags
    dpkg-buildflags --get OBJCFLAGS
    3⤵
    - Software Deployment Tools
    PID:1588
  - - /usr/local/sbin/gcc
      gcc -dumpmachine
      4⤵
      PID:1589
  - - /usr/local/bin/gcc
      gcc -dumpmachine
      4⤵
      PID:1589
  - - /usr/sbin/gcc
      gcc -dumpmachine
      4⤵
      PID:1589
  - - /usr/bin/gcc
      gcc -dumpmachine
      4⤵
      PID:1589
  - - /bin/pwd
      /bin/pwd
      4⤵
      PID:1590
- /bin/sh
  /bin/sh -c "dh_auto_configure -- \\ --libdir=\\\${prefix}/lib \\ CFLAGS=\"-g -O2 -fdebug-prefix-map=/tmp/debian=. -fstack-protector-strong -Wformat -Werror=format-security\" CPPFLAGS=\"-Wdate-time -D_FORTIFY_SOURCE=2\" CXXFLAGS=\"-g -O2 -fdebug-prefix-map=/tmp/debian=. -fstack-protector-strong -Wformat -Werror=format-security\" FCFLAGS=\"-g -O2 -fdebug-prefix-map=/tmp/debian=. -fstack-protector-strong\" FFLAGS=\"-g -O2 -fdebug-prefix-map=/tmp/debian=. -fstack-protector-strong\" GCJFLAGS=\"-g -O2 -fdebug-prefix-map=/tmp/debian=. -fstack-protector-strong\" LDFLAGS=\"-Wl,-Bsymbolic-functions -Wl,-z,relro\" OBJCFLAGS=\"-g -O2 -fdebug-prefix-map=/tmp/debian=. -fstack-protector-strong -Wformat -Werror=format-security\" OBJCXXFLAGS=\"-g -O2 -fdebug-prefix-map=/tmp/debian=. -fstack-protector-strong -Wformat -Werror=format-security\" "
  2⤵
  PID:1591

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Unix Shell

T1059.004

Software Deployment Tools

T1072

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Software Deployment Tools

T1072

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads