450692d780a1fa5d5850052ef87fa6c32213cd6c939385e53f8992706c9648f5

Analysis

max time kernel
4s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
13/11/2026, 22:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
debian/rules
Size 1KB
Sample261113-161efssv7q
SHA256 450692d780a1fa5d5850052ef87fa6c32213cd6c939385e53f8992706c9648f5
MD5 87868e26de955c36612ce14141384d9f
SHA1 be01aa9786f184b66d6fd8b50db85329c72328cd
SHA512 98c3cbd11f0503a75475f237fb93b7e5517c4a695272a1e7718eb0e1aa4b9850ae96531b1f7dd810daffdf9c1e608ef9f8e9e66a0ba95ef05bcecd68fb01c9c6
TLSH
T1E031B4BDE081596245CA04B35B0812E2FF76C06CDEB076F0E1CF3D760B016D8121EAE9
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: Unix Shell 1 TTPs 6 IoCs

Execute scripts via Unix Shell.

execution

Unix Shell

T1059.004

pid	Process
675	sh
678	sh
681	sh
703	sh
704	sh
706	sh

Reads runtime system information 3 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed

Software Deployment Tools 1 TTPs 2 IoCs

Use software deployment tools to execute code.

execution

Software Deployment Tools

T1072

pid	Process
651	dpkg-parsechangelog
682	dpkg-parsechangelog

/tmp/debian/rules
/tmp/debian/rules
1⤵
PID:645
- /bin/sh
  /bin/sh -c "dpkg-parsechangelog | grep ^Version | cut -d' ' -f2 | cut -d- -f1"
  2⤵
  PID:649
- - /bin/grep
    grep "^Version"
    3⤵
    PID:652
- - /usr/bin/cut
    cut -d- -f1
    3⤵
    PID:655
- - /usr/bin/cut
    cut "-d " -f2
    3⤵
    PID:654
- - /usr/bin/dpkg-parsechangelog
    dpkg-parsechangelog
    3⤵
    - Software Deployment Tools
    PID:651
  - - /usr/local/sbin/tail
      tail -n 40 debian/changelog
      4⤵
      PID:674
  - - /usr/local/bin/tail
      tail -n 40 debian/changelog
      4⤵
      PID:674
  - - /usr/sbin/tail
      tail -n 40 debian/changelog
      4⤵
      PID:674
  - - /usr/bin/tail
      tail -n 40 debian/changelog
      4⤵
      PID:674
- /bin/sh
  /bin/sh -c "echo | sed -e \"s/~beta[[:digit:]]\\+/-BETA/\""
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:675
- - /bin/sed
    sed -e "s/~beta[[:digit:]]\\+/-BETA/"
    3⤵
    - Reads runtime system information
    PID:677
- /bin/sh
  /bin/sh -c "echo | tr A-Z a-z"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:678
- - /usr/bin/tr
    tr A-Z a-z
    3⤵
    PID:680
- /bin/sh
  /bin/sh -c "dpkg-parsechangelog | sed -ne 's/^Version: \\(.*\\)-.*/\\1/p' | sed -e 's/\\+.*//; s/^[0-9]://'"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:681
- - /bin/sed
    sed -e "s/\\+.*//; s/^[0-9]://"
    3⤵
    - Reads runtime system information
    PID:684
- - /bin/sed
    sed -ne "s/^Version: \\(.*\\)-.*/\\1/p"
    3⤵
    - Reads runtime system information
    PID:683
- - /usr/bin/dpkg-parsechangelog
    dpkg-parsechangelog
    3⤵
    - Software Deployment Tools
    PID:682
  - - /usr/local/sbin/tail
      tail -n 40 debian/changelog
      4⤵
      PID:685
  - - /usr/local/bin/tail
      tail -n 40 debian/changelog
      4⤵
      PID:685
  - - /usr/sbin/tail
      tail -n 40 debian/changelog
      4⤵
      PID:685
  - - /usr/bin/tail
      tail -n 40 debian/changelog
      4⤵
      PID:685
- /usr/local/sbin/dpkg-architecture
  dpkg-architecture -qDEB_HOST_ARCH
  2⤵
  PID:686
- /usr/local/bin/dpkg-architecture
  dpkg-architecture -qDEB_HOST_ARCH
  2⤵
  PID:686
- /usr/sbin/dpkg-architecture
  dpkg-architecture -qDEB_HOST_ARCH
  2⤵
  PID:686
- /usr/bin/dpkg-architecture
  dpkg-architecture -qDEB_HOST_ARCH
  2⤵
  PID:686
- - /usr/local/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:699
- - /usr/local/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:699
- - /usr/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:699
- - /usr/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:699
- /bin/sh
  /bin/sh -c "echo \"Spatialite full version: \""
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:703
- /bin/sh
  /bin/sh -c "echo \"Spatialite version: \""
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:704
- /bin/sh
  /bin/sh -c "echo \"Spatialite symbols: \""
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:706

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Unix Shell

T1059.004

Software Deployment Tools

T1072

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Software Deployment Tools

T1072

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads