6888e9a72a0b0acd209055ca245b45c4592a08b00e02226453aa3f19487bc263

Analysis

max time kernel
6s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
13/11/2026, 01:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
debian/rules
Size 1KB
Sample261113-bp5v6set2t
SHA256 6888e9a72a0b0acd209055ca245b45c4592a08b00e02226453aa3f19487bc263
MD5 a84a4204061170d06e9c4c7e681a7a4e
SHA1 22e4290667057bff6f597aac293054924ae9592d
SHA512 5df160e2aa1507c1eef4dc511ce0018b06af48b79820b68688a825d35a1090203b833b086643449e10ab1a528437d734e7c923c41355d91359bb014c759bc2be
TLSH
T159114287C7D3A0A18C42074BABB4F36DEB41906C1B3F8BE5B45E1C6C23151211257D9F
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: Unix Shell 1 TTPs 1 IoCs

Execute scripts via Unix Shell.

execution

Unix Shell

T1059.004

pid	Process
711	sh

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	mkdir

Software Deployment Tools 1 TTPs 1 IoCs

Use software deployment tools to execute code.

execution

Software Deployment Tools

T1072

pid	Process
713	dpkg-parsechangelog

/tmp/debian/rules
/tmp/debian/rules
1⤵
PID:708
- /bin/sh
  /bin/sh -c "dpkg-parsechangelog | sed -ne 's/^Version: \\(\\([0-9]\\+\\):\\)\\?\\(.*\\)-.*/\\3/p'"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:711
- - /usr/bin/dpkg-parsechangelog
    dpkg-parsechangelog
    3⤵
    - Software Deployment Tools
    PID:713
  - - /usr/local/sbin/tail
      tail -n 40 debian/changelog
      4⤵
      PID:737
  - - /usr/local/bin/tail
      tail -n 40 debian/changelog
      4⤵
      PID:737
  - - /usr/sbin/tail
      tail -n 40 debian/changelog
      4⤵
      PID:737
  - - /usr/bin/tail
      tail -n 40 debian/changelog
      4⤵
      PID:737
- - /bin/sed
    sed -ne "s/^Version: \\(\\([0-9]\\+\\):\\)\\?\\(.*\\)-.*/\\3/p"
    3⤵
    - Reads runtime system information
    PID:714
- /usr/local/sbin/rm
  rm -rf get-orig-source-tmp
  2⤵
  PID:738
- /usr/local/bin/rm
  rm -rf get-orig-source-tmp
  2⤵
  PID:738
- /usr/sbin/rm
  rm -rf get-orig-source-tmp
  2⤵
  PID:738
- /usr/bin/rm
  rm -rf get-orig-source-tmp
  2⤵
  PID:738
- /sbin/rm
  rm -rf get-orig-source-tmp
  2⤵
  PID:738
- /bin/rm
  rm -rf get-orig-source-tmp
  2⤵
  PID:738
- /usr/local/sbin/mkdir
  mkdir get-orig-source-tmp
  2⤵
  PID:739
- /usr/local/bin/mkdir
  mkdir get-orig-source-tmp
  2⤵
  PID:739
- /usr/sbin/mkdir
  mkdir get-orig-source-tmp
  2⤵
  PID:739
- /usr/bin/mkdir
  mkdir get-orig-source-tmp
  2⤵
  PID:739
- /sbin/mkdir
  mkdir get-orig-source-tmp
  2⤵
  PID:739
- /bin/mkdir
  mkdir get-orig-source-tmp
  2⤵
  - Reads runtime system information
  PID:739
- /usr/local/sbin/uscan
  uscan --download --no-symlink --destdir get-orig-source-tmp
  2⤵
  PID:740
- /usr/local/bin/uscan
  uscan --download --no-symlink --destdir get-orig-source-tmp
  2⤵
  PID:740
- /usr/sbin/uscan
  uscan --download --no-symlink --destdir get-orig-source-tmp
  2⤵
  PID:740
- /usr/bin/uscan
  uscan --download --no-symlink --destdir get-orig-source-tmp
  2⤵
  PID:740
- /sbin/uscan
  uscan --download --no-symlink --destdir get-orig-source-tmp
  2⤵
  PID:740
- /bin/uscan
  uscan --download --no-symlink --destdir get-orig-source-tmp
  2⤵
  PID:740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Unix Shell

T1059.004

Software Deployment Tools

T1072

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Software Deployment Tools

T1072

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads