99e7a7495da46dded461f82562183a0496782ee135908f7b3262074808acd776

Analysis

max time kernel
1s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
13/11/2026, 23:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
debian/rules
Size 805B
Sample261113-24xffssz2m
SHA256 99e7a7495da46dded461f82562183a0496782ee135908f7b3262074808acd776
MD5 f299dd324bdacd567c05c35e4caeb931
SHA1 c6277ba863183946e45c616f36e7fd0ec96e2d0e
SHA512 76b028252ff14421996f42dc201e5f0a07e7ca92e619d3076190ceda493e5f1b4a97b240a08ce1776e00da790bd8ca02b333227ba1306d2d71c737b81fcf90ca
TLSH
T10B011245A0F24AA454CD4E79F30C070157EA51D9AE24B4A0B3FA6E1B304620C704A085
MD5 SHA1 SHA512 TLSH

Score

2^/10

execution

Malware Config

Signatures

Software Deployment Tools 1 TTPs 1 IoCs

Use software deployment tools to execute code.

execution

Software Deployment Tools

T1072

pid	Process
653	dpkg-parsechangelog

/tmp/debian/rules
/tmp/debian/rules
1⤵
PID:647
- /usr/local/sbin/dpkg-parsechangelog
  dpkg-parsechangelog -STimestamp
  2⤵
  PID:653
- /usr/local/bin/dpkg-parsechangelog
  dpkg-parsechangelog -STimestamp
  2⤵
  PID:653
- /usr/sbin/dpkg-parsechangelog
  dpkg-parsechangelog -STimestamp
  2⤵
  PID:653
- /usr/bin/dpkg-parsechangelog
  dpkg-parsechangelog -STimestamp
  2⤵
  - Software Deployment Tools
  PID:653
- - /usr/local/sbin/tail
    tail -n 40 debian/changelog
    3⤵
    PID:672
- - /usr/local/bin/tail
    tail -n 40 debian/changelog
    3⤵
    PID:672
- - /usr/sbin/tail
    tail -n 40 debian/changelog
    3⤵
    PID:672
- - /usr/bin/tail
    tail -n 40 debian/changelog
    3⤵
    PID:672
- /usr/local/sbin/dh_auto_configure
  dh_auto_configure -- "-DBUILD_TESTING=ON"
  2⤵
  PID:673
- /usr/local/bin/dh_auto_configure
  dh_auto_configure -- "-DBUILD_TESTING=ON"
  2⤵
  PID:673
- /usr/sbin/dh_auto_configure
  dh_auto_configure -- "-DBUILD_TESTING=ON"
  2⤵
  PID:673
- /usr/bin/dh_auto_configure
  dh_auto_configure -- "-DBUILD_TESTING=ON"
  2⤵
  PID:673
- /sbin/dh_auto_configure
  dh_auto_configure -- "-DBUILD_TESTING=ON"
  2⤵
  PID:673
- /bin/dh_auto_configure
  dh_auto_configure -- "-DBUILD_TESTING=ON"
  2⤵
  PID:673

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Software Deployment Tools

T1072

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Software Deployment Tools

T1072

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads