1b13fe990fc9f28928ea4ba805380405d32cafe75d710b3845a22c2f86670685

Analysis

max time kernel
8s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
13/11/2026, 23:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
debian/rules
Size 661B
Sample261113-247lessz4k
SHA256 1b13fe990fc9f28928ea4ba805380405d32cafe75d710b3845a22c2f86670685
MD5 d8f5e20cf1f99e9c106e5f9d28c0758d
SHA1 be9e47158541e0aeed42f9d27327cfbe114f7776
SHA512 d262c07995884969047f41c3186f0350e5b12bc3797cc36be902e3429e29ff764db2cce0dfe45cea570a0b664997bbc74ecffb71b5f71877ccfa931d79753e94
TLSH
T17A019913C0BD58F31A1488B2E74159E57FA0A3F5F8DF641330D4562B22C130022AE579
MD5 SHA1 SHA512 TLSH

Score

2^/10

execution

Malware Config

Signatures

Software Deployment Tools 1 TTPs 9 IoCs

Use software deployment tools to execute code.

execution

Software Deployment Tools

T1072

pid	Process
672	dpkg-buildflags
675	dpkg-buildflags
698	dpkg-buildflags
729	dpkg-buildflags
757	dpkg-buildflags
725	dpkg-buildflags
732	dpkg-buildflags
768	dpkg-buildflags
650	dpkg-buildflags

/tmp/debian/rules
/tmp/debian/rules
1⤵
PID:644
- /usr/local/sbin/dpkg-buildflags
  dpkg-buildflags --get LDFLAGS
  2⤵
  PID:650
- /usr/local/bin/dpkg-buildflags
  dpkg-buildflags --get LDFLAGS
  2⤵
  PID:650
- /usr/sbin/dpkg-buildflags
  dpkg-buildflags --get LDFLAGS
  2⤵
  PID:650
- /usr/bin/dpkg-buildflags
  dpkg-buildflags --get LDFLAGS
  2⤵
  - Software Deployment Tools
  PID:650
- - /bin/pwd
    /bin/pwd
    3⤵
    PID:670
- - /usr/local/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:671
- - /usr/local/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:671
- - /usr/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:671
- - /usr/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:671
- /usr/local/sbin/dpkg-buildflags
  dpkg-buildflags --get CFLAGS
  2⤵
  PID:672
- /usr/local/bin/dpkg-buildflags
  dpkg-buildflags --get CFLAGS
  2⤵
  PID:672
- /usr/sbin/dpkg-buildflags
  dpkg-buildflags --get CFLAGS
  2⤵
  PID:672
- /usr/bin/dpkg-buildflags
  dpkg-buildflags --get CFLAGS
  2⤵
  - Software Deployment Tools
  PID:672
- - /bin/pwd
    /bin/pwd
    3⤵
    PID:673
- - /usr/local/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:674
- - /usr/local/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:674
- - /usr/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:674
- - /usr/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:674
- /usr/local/sbin/dpkg-buildflags
  dpkg-buildflags --get CPPFLAGS
  2⤵
  PID:675
- /usr/local/bin/dpkg-buildflags
  dpkg-buildflags --get CPPFLAGS
  2⤵
  PID:675
- /usr/sbin/dpkg-buildflags
  dpkg-buildflags --get CPPFLAGS
  2⤵
  PID:675
- /usr/bin/dpkg-buildflags
  dpkg-buildflags --get CPPFLAGS
  2⤵
  - Software Deployment Tools
  PID:675
- - /bin/pwd
    /bin/pwd
    3⤵
    PID:694
- - /usr/local/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:695
- - /usr/local/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:695
- - /usr/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:695
- - /usr/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:695
- /usr/local/sbin/dpkg-buildflags
  dpkg-buildflags --get OBJCXXFLAGS
  2⤵
  PID:698
- /usr/local/bin/dpkg-buildflags
  dpkg-buildflags --get OBJCXXFLAGS
  2⤵
  PID:698
- /usr/sbin/dpkg-buildflags
  dpkg-buildflags --get OBJCXXFLAGS
  2⤵
  PID:698
- /usr/bin/dpkg-buildflags
  dpkg-buildflags --get OBJCXXFLAGS
  2⤵
  - Software Deployment Tools
  PID:698
- - /bin/pwd
    /bin/pwd
    3⤵
    PID:723
- - /usr/local/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:724
- - /usr/local/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:724
- - /usr/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:724
- - /usr/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:724
- /usr/local/sbin/dpkg-buildflags
  dpkg-buildflags --get GCJFLAGS
  2⤵
  PID:725
- /usr/local/bin/dpkg-buildflags
  dpkg-buildflags --get GCJFLAGS
  2⤵
  PID:725
- /usr/sbin/dpkg-buildflags
  dpkg-buildflags --get GCJFLAGS
  2⤵
  PID:725
- /usr/bin/dpkg-buildflags
  dpkg-buildflags --get GCJFLAGS
  2⤵
  - Software Deployment Tools
  PID:725
- - /bin/pwd
    /bin/pwd
    3⤵
    PID:727
- - /usr/local/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:728
- - /usr/local/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:728
- - /usr/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:728
- - /usr/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:728
- /usr/local/sbin/dpkg-buildflags
  dpkg-buildflags --get CXXFLAGS
  2⤵
  PID:729
- /usr/local/bin/dpkg-buildflags
  dpkg-buildflags --get CXXFLAGS
  2⤵
  PID:729
- /usr/sbin/dpkg-buildflags
  dpkg-buildflags --get CXXFLAGS
  2⤵
  PID:729
- /usr/bin/dpkg-buildflags
  dpkg-buildflags --get CXXFLAGS
  2⤵
  - Software Deployment Tools
  PID:729
- - /bin/pwd
    /bin/pwd
    3⤵
    PID:730
- - /usr/local/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:731
- - /usr/local/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:731
- - /usr/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:731
- - /usr/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:731
- /usr/local/sbin/dpkg-buildflags
  dpkg-buildflags --get FFLAGS
  2⤵
  PID:732
- /usr/local/bin/dpkg-buildflags
  dpkg-buildflags --get FFLAGS
  2⤵
  PID:732
- /usr/sbin/dpkg-buildflags
  dpkg-buildflags --get FFLAGS
  2⤵
  PID:732
- /usr/bin/dpkg-buildflags
  dpkg-buildflags --get FFLAGS
  2⤵
  - Software Deployment Tools
  PID:732
- - /bin/pwd
    /bin/pwd
    3⤵
    PID:752
- - /usr/local/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:754
- - /usr/local/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:754
- - /usr/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:754
- - /usr/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:754
- /usr/local/sbin/dpkg-buildflags
  dpkg-buildflags --get FCFLAGS
  2⤵
  PID:757
- /usr/local/bin/dpkg-buildflags
  dpkg-buildflags --get FCFLAGS
  2⤵
  PID:757
- /usr/sbin/dpkg-buildflags
  dpkg-buildflags --get FCFLAGS
  2⤵
  PID:757
- /usr/bin/dpkg-buildflags
  dpkg-buildflags --get FCFLAGS
  2⤵
  - Software Deployment Tools
  PID:757
- - /bin/pwd
    /bin/pwd
    3⤵
    PID:766
- - /usr/local/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:767
- - /usr/local/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:767
- - /usr/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:767
- - /usr/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:767
- /usr/local/sbin/dpkg-buildflags
  dpkg-buildflags --get OBJCFLAGS
  2⤵
  PID:768
- /usr/local/bin/dpkg-buildflags
  dpkg-buildflags --get OBJCFLAGS
  2⤵
  PID:768
- /usr/sbin/dpkg-buildflags
  dpkg-buildflags --get OBJCFLAGS
  2⤵
  PID:768
- /usr/bin/dpkg-buildflags
  dpkg-buildflags --get OBJCFLAGS
  2⤵
  - Software Deployment Tools
  PID:768
- - /bin/pwd
    /bin/pwd
    3⤵
    PID:769
- - /usr/local/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:770
- - /usr/local/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:770
- - /usr/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:770
- - /usr/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:770
- /tmp/debian/configure
  ./configure "--prefix=/usr" "--LDFLAGS=-Wl,-z,relro" "--CFLAGS=-g -O2 -fdebug-prefix-map=/tmp/debian=. -fstack-protector-strong -Wformat -Werror=format-security -Wdate-time -D_FORTIFY_SOURCE=2"
  2⤵
  PID:771

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Software Deployment Tools

T1072

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Software Deployment Tools

T1072

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads