71a562f6b476f44c6b96b1795d0601121b4bfc88fb5c77a92fe09d7998e5c6d1

Analysis

max time kernel
0s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20261019-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20261019-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
13/11/2026, 01:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
debian/rules
Size 635B
Sample261113-bp49mses91
SHA256 71a562f6b476f44c6b96b1795d0601121b4bfc88fb5c77a92fe09d7998e5c6d1
MD5 4058d6216b328e7ffa940da0e44ee7ac
SHA1 f64432076b31d56ef6ba5c685e03c70c8c8c5b23
SHA512 ccc8f0118eb3c5f6c32089aac6e41c4ba7c5f97bd52595b7855015d26509910675a636938e59146235fc45cf800406323939b0e833c693ad539447b7fb66aeab
TLSH
T1E7F0D375E1D76FAB754E00033E0D81CEC9B394A6A1B05341645DDE745554B0480304A4
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: Unix Shell 1 TTPs 1 IoCs

Execute scripts via Unix Shell.

execution

Unix Shell

T1059.004

pid	Process
1514	sh

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	mkdir

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/debian/debian/js/rdflib.js	sh

/tmp/debian/rules
/tmp/debian/rules
1⤵
PID:1512
- /usr/local/sbin/mkdir
  mkdir -p debian/js
  2⤵
  PID:1513
- /usr/local/bin/mkdir
  mkdir -p debian/js
  2⤵
  PID:1513
- /usr/sbin/mkdir
  mkdir -p debian/js
  2⤵
  PID:1513
- /usr/bin/mkdir
  mkdir -p debian/js
  2⤵
  PID:1513
- /sbin/mkdir
  mkdir -p debian/js
  2⤵
  PID:1513
- /bin/mkdir
  mkdir -p debian/js
  2⤵
  - Reads runtime system information
  PID:1513
- /bin/sh
  /bin/sh -c "cat N3.js > debian/js/rdflib.js"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  - Writes file to tmp directory
  PID:1514
- - /bin/cat
    cat N3.js
    3⤵
    PID:1515

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Unix Shell

T1059.004

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads