7fc9ba2e0d7ea70b9c268d099f3412da812562969fcde0e00a0c0bdd9f5db545

Analysis

max time kernel
3s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
13/11/2026, 02:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
debian/rules
Size 566B
Sample261113-cprtzsfs8j
SHA256 7fc9ba2e0d7ea70b9c268d099f3412da812562969fcde0e00a0c0bdd9f5db545
MD5 20946976908886e8e6e23ba549f99aec
SHA1 9f698ae3ba18585d6d6a3b46398d611de3fcc4bd
SHA512 d4651537e2d29265ff5d5abb61dac0347822f3259312bd437c6f02c46405402792659974b6f83374394a687c46ad8fe701dff1318a1df9c58767083e950a1855
TLSH
T1DBF0E162D33DCCF1284EF201930583E05FE3B4F4CADC7441B2D9680E5D0A24462B6661
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: Unix Shell 1 TTPs 3 IoCs

Execute scripts via Unix Shell.

execution

Unix Shell

T1059.004

pid	Process
680	sh
683	sh
686	sh

Reads runtime system information 3 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed

Software Deployment Tools 1 TTPs 2 IoCs

Use software deployment tools to execute code.

execution

Software Deployment Tools

T1072

pid	Process
659	dpkg-parsechangelog
689	dpkg-parsechangelog

/tmp/debian/rules
/tmp/debian/rules
1⤵
PID:653
- /usr/local/sbin/dpkg-parsechangelog
  dpkg-parsechangelog -SVersion
  2⤵
  PID:659
- /usr/local/bin/dpkg-parsechangelog
  dpkg-parsechangelog -SVersion
  2⤵
  PID:659
- /usr/sbin/dpkg-parsechangelog
  dpkg-parsechangelog -SVersion
  2⤵
  PID:659
- /usr/bin/dpkg-parsechangelog
  dpkg-parsechangelog -SVersion
  2⤵
  - Software Deployment Tools
  PID:659
- - /usr/local/sbin/tail
    tail -n 40 debian/changelog
    3⤵
    PID:679
- - /usr/local/bin/tail
    tail -n 40 debian/changelog
    3⤵
    PID:679
- - /usr/sbin/tail
    tail -n 40 debian/changelog
    3⤵
    PID:679
- - /usr/bin/tail
    tail -n 40 debian/changelog
    3⤵
    PID:679
- /bin/sh
  /bin/sh -c "echo '' | sed -e 's/-[^-]*\$//'"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:680
- - /bin/sed
    sed -e "s/-[^-]*\$//"
    3⤵
    - Reads runtime system information
    PID:682
- /bin/sh
  /bin/sh -c "echo '' | sed -e 's/^[0-9]*://'"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:683
- - /bin/sed
    sed -e "s/^[0-9]*://"
    3⤵
    - Reads runtime system information
    PID:685
- /bin/sh
  /bin/sh -c "echo | sed -e 's/\\+.*//'"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:686
- - /bin/sed
    sed -e "s/\\+.*//"
    3⤵
    - Reads runtime system information
    PID:688
- /usr/local/sbin/dpkg-parsechangelog
  dpkg-parsechangelog -STimestamp
  2⤵
  PID:689
- /usr/local/bin/dpkg-parsechangelog
  dpkg-parsechangelog -STimestamp
  2⤵
  PID:689
- /usr/sbin/dpkg-parsechangelog
  dpkg-parsechangelog -STimestamp
  2⤵
  PID:689
- /usr/bin/dpkg-parsechangelog
  dpkg-parsechangelog -STimestamp
  2⤵
  - Software Deployment Tools
  PID:689
- - /usr/local/sbin/tail
    tail -n 40 debian/changelog
    3⤵
    PID:690
- - /usr/local/bin/tail
    tail -n 40 debian/changelog
    3⤵
    PID:690
- - /usr/sbin/tail
    tail -n 40 debian/changelog
    3⤵
    PID:690
- - /usr/bin/tail
    tail -n 40 debian/changelog
    3⤵
    PID:690
- /usr/local/sbin/dh_auto_clean
  dh_auto_clean
  2⤵
  PID:691
- /usr/local/bin/dh_auto_clean
  dh_auto_clean
  2⤵
  PID:691
- /usr/sbin/dh_auto_clean
  dh_auto_clean
  2⤵
  PID:691
- /usr/bin/dh_auto_clean
  dh_auto_clean
  2⤵
  PID:691
- /sbin/dh_auto_clean
  dh_auto_clean
  2⤵
  PID:691
- /bin/dh_auto_clean
  dh_auto_clean
  2⤵
  PID:691

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Unix Shell

T1059.004

Software Deployment Tools

T1072

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Software Deployment Tools

T1072

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads