b63c422ca03098c9f40aed213fa3efa99b61561003207c47cbf5d5e12d81f4f1

Analysis

max time kernel
9s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
10/11/2026, 16:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
debian/rules
Size 14KB
Sample261110-tm5fqsvyet
SHA256 b63c422ca03098c9f40aed213fa3efa99b61561003207c47cbf5d5e12d81f4f1
MD5 223fc1b13c9e655eba9c7d011c7f3c01
SHA1 4efc4fcdc813dda8c00535e3a51260ec9f32e4d2
SHA512 4a334d45054f3693b4adc4eb8764c44ce58c94bc03bcdb4e95cb14183f7bb3dd91b4f878abe48cf9a54423efe32f23bbcd4a051e6aeca0a7eca8ad145486b2eb
SSDEEP 384:maUaa/8n0tRejkSzWENxUpRM4CHCvC/CjCDCHCFxClCLCZ1CMv6vJByZzeSMLM93:maUaa60twjPzWENeCvJ8U3i
TLSH
T160620EC193CDC736FEC36EED76954168848AA8F36A2175A960B89F859D8E1470C37B03
MD5 SHA1 SHA512 SSDEEP TLSH

Score

2^/10

execution

Malware Config

Signatures

Software Deployment Tools 1 TTPs 5 IoCs

Use software deployment tools to execute code.

execution

Software Deployment Tools

T1072

pid	Process
677	dpkg-buildflags
707	dpkg-buildflags
728	dpkg-buildflags
731	dpkg-buildflags
748	dpkg-buildflags

/tmp/debian/rules
/tmp/debian/rules
1⤵
PID:653
- /usr/local/sbin/py3versions
  py3versions -vr
  2⤵
  PID:658
- /usr/local/bin/py3versions
  py3versions -vr
  2⤵
  PID:658
- /usr/sbin/py3versions
  py3versions -vr
  2⤵
  PID:658
- /usr/bin/py3versions
  py3versions -vr
  2⤵
  PID:658
- /usr/local/sbin/py3versions
  py3versions -vd
  2⤵
  PID:676
- /usr/local/bin/py3versions
  py3versions -vd
  2⤵
  PID:676
- /usr/sbin/py3versions
  py3versions -vd
  2⤵
  PID:676
- /usr/bin/py3versions
  py3versions -vd
  2⤵
  PID:676
- /usr/local/sbin/dpkg-buildflags
  dpkg-buildflags --get CFLAGS
  2⤵
  PID:677
- /usr/local/bin/dpkg-buildflags
  dpkg-buildflags --get CFLAGS
  2⤵
  PID:677
- /usr/sbin/dpkg-buildflags
  dpkg-buildflags --get CFLAGS
  2⤵
  PID:677
- /usr/bin/dpkg-buildflags
  dpkg-buildflags --get CFLAGS
  2⤵
  - Software Deployment Tools
  PID:677
- - /bin/pwd
    /bin/pwd
    3⤵
    PID:702
- - /usr/local/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:703
- - /usr/local/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:703
- - /usr/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:703
- - /usr/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:703
- /usr/local/sbin/dpkg-buildflags
  dpkg-buildflags --get CPPFLAGS
  2⤵
  PID:707
- /usr/local/bin/dpkg-buildflags
  dpkg-buildflags --get CPPFLAGS
  2⤵
  PID:707
- /usr/sbin/dpkg-buildflags
  dpkg-buildflags --get CPPFLAGS
  2⤵
  PID:707
- /usr/bin/dpkg-buildflags
  dpkg-buildflags --get CPPFLAGS
  2⤵
  - Software Deployment Tools
  PID:707
- - /bin/pwd
    /bin/pwd
    3⤵
    PID:726
- - /usr/local/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:727
- - /usr/local/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:727
- - /usr/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:727
- - /usr/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:727
- /usr/local/sbin/dpkg-buildflags
  dpkg-buildflags --get CXXFLAGS
  2⤵
  PID:728
- /usr/local/bin/dpkg-buildflags
  dpkg-buildflags --get CXXFLAGS
  2⤵
  PID:728
- /usr/sbin/dpkg-buildflags
  dpkg-buildflags --get CXXFLAGS
  2⤵
  PID:728
- /usr/bin/dpkg-buildflags
  dpkg-buildflags --get CXXFLAGS
  2⤵
  - Software Deployment Tools
  PID:728
- - /bin/pwd
    /bin/pwd
    3⤵
    PID:729
- - /usr/local/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:730
- - /usr/local/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:730
- - /usr/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:730
- - /usr/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:730
- /usr/local/sbin/dpkg-buildflags
  dpkg-buildflags --get CPPFLAGS
  2⤵
  PID:731
- /usr/local/bin/dpkg-buildflags
  dpkg-buildflags --get CPPFLAGS
  2⤵
  PID:731
- /usr/sbin/dpkg-buildflags
  dpkg-buildflags --get CPPFLAGS
  2⤵
  PID:731
- /usr/bin/dpkg-buildflags
  dpkg-buildflags --get CPPFLAGS
  2⤵
  - Software Deployment Tools
  PID:731
- - /bin/pwd
    /bin/pwd
    3⤵
    PID:744
- - /usr/local/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:745
- - /usr/local/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:745
- - /usr/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:745
- - /usr/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:745
- /usr/local/sbin/dpkg-buildflags
  dpkg-buildflags --get LDFLAGS
  2⤵
  PID:748
- /usr/local/bin/dpkg-buildflags
  dpkg-buildflags --get LDFLAGS
  2⤵
  PID:748
- /usr/sbin/dpkg-buildflags
  dpkg-buildflags --get LDFLAGS
  2⤵
  PID:748
- /usr/bin/dpkg-buildflags
  dpkg-buildflags --get LDFLAGS
  2⤵
  - Software Deployment Tools
  PID:748
- - /bin/pwd
    /bin/pwd
    3⤵
    PID:767
- - /usr/local/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:768
- - /usr/local/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:768
- - /usr/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:768
- - /usr/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:768
- /usr/local/sbin/python2.7-config
  python2.7-config --configdir
  2⤵
  PID:769
- /usr/local/bin/python2.7-config
  python2.7-config --configdir
  2⤵
  PID:769
- /usr/sbin/python2.7-config
  python2.7-config --configdir
  2⤵
  PID:769
- /usr/bin/python2.7-config
  python2.7-config --configdir
  2⤵
  PID:769
- /sbin/python2.7-config
  python2.7-config --configdir
  2⤵
  PID:769
- /bin/python2.7-config
  python2.7-config --configdir
  2⤵
  PID:769
- /usr/local/sbin/dh_testdir
  dh_testdir
  2⤵
  PID:770
- /usr/local/bin/dh_testdir
  dh_testdir
  2⤵
  PID:770
- /usr/sbin/dh_testdir
  dh_testdir
  2⤵
  PID:770
- /usr/bin/dh_testdir
  dh_testdir
  2⤵
  PID:770
- /sbin/dh_testdir
  dh_testdir
  2⤵
  PID:770
- /bin/dh_testdir
  dh_testdir
  2⤵
  PID:770

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Software Deployment Tools

T1072

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Software Deployment Tools

T1072

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads