a018654e058f0961f3e3a9f2293af935cc6917d7f335c74edf1b135445f4976d

Analysis

max time kernel
3s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
13/11/2026, 01:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
debian/rules
Size 2KB
Sample261113-bprcsayv7n
SHA256 a018654e058f0961f3e3a9f2293af935cc6917d7f335c74edf1b135445f4976d
MD5 3ec6fdeaf2656d44d5000270c7d3e07d
SHA1 53684f50c18118a355f9a7dbd5afc05dbd6a1e97
SHA512 f4ad43ce097a3b6a55d8fdd67f4c2b8f2e5f400e04c1c8998e490066b881da61e6c3e6fb302c7933920cbdca81b07603296a8da76c15c159dfa3241bfaaf171a
TLSH
T147511F70C12BE270B68A931FE3510551DE7696E9E8F07486F3EF05741A8731A80B6EA3
MD5 SHA1 SHA512 TLSH

Score

2^/10

execution

Malware Config

Signatures

Software Deployment Tools 1 TTPs 1 IoCs

Use software deployment tools to execute code.

execution

Software Deployment Tools

T1072

pid	Process
663	dpkg-parsechangelog

/tmp/debian/rules
/tmp/debian/rules
1⤵
PID:658
- /usr/local/sbin/dpkg-parsechangelog
  dpkg-parsechangelog -S Date
  2⤵
  PID:663
- /usr/local/bin/dpkg-parsechangelog
  dpkg-parsechangelog -S Date
  2⤵
  PID:663
- /usr/sbin/dpkg-parsechangelog
  dpkg-parsechangelog -S Date
  2⤵
  PID:663
- /usr/bin/dpkg-parsechangelog
  dpkg-parsechangelog -S Date
  2⤵
  - Software Deployment Tools
  PID:663
- - /usr/local/sbin/tail
    tail -n 40 debian/changelog
    3⤵
    PID:684
- - /usr/local/bin/tail
    tail -n 40 debian/changelog
    3⤵
    PID:684
- - /usr/sbin/tail
    tail -n 40 debian/changelog
    3⤵
    PID:684
- - /usr/bin/tail
    tail -n 40 debian/changelog
    3⤵
    PID:684
- /bin/sh
  /bin/sh -c "LC_ALL=C date -u \"+%B %d, %Y\" -d \"\""
  2⤵
  PID:685
- - /bin/date
    date -u "+%B %d, %Y" -d
    3⤵
    PID:686
- /usr/local/sbin/py3versions
  py3versions -vr
  2⤵
  PID:687
- /usr/local/bin/py3versions
  py3versions -vr
  2⤵
  PID:687
- /usr/sbin/py3versions
  py3versions -vr
  2⤵
  PID:687
- /usr/bin/py3versions
  py3versions -vr
  2⤵
  PID:687
- /usr/local/sbin/py3versions
  py3versions -vr
  2⤵
  PID:688
- /usr/local/bin/py3versions
  py3versions -vr
  2⤵
  PID:688
- /usr/sbin/py3versions
  py3versions -vr
  2⤵
  PID:688
- /usr/bin/py3versions
  py3versions -vr
  2⤵
  PID:688
- /bin/sh
  /bin/sh -c "dh_listpackages | grep -- -doc"
  2⤵
  PID:705
- - /bin/grep
    grep -- -doc
    3⤵
    PID:707
- /usr/local/sbin/dh_auto_build
  dh_auto_build
  2⤵
  PID:709
- /usr/local/bin/dh_auto_build
  dh_auto_build
  2⤵
  PID:709
- /usr/sbin/dh_auto_build
  dh_auto_build
  2⤵
  PID:709
- /usr/bin/dh_auto_build
  dh_auto_build
  2⤵
  PID:709
- /sbin/dh_auto_build
  dh_auto_build
  2⤵
  PID:709
- /bin/dh_auto_build
  dh_auto_build
  2⤵
  PID:709

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Software Deployment Tools

T1072

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Software Deployment Tools

T1072

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads