44fa45b7b81997b9dd9f6c2f72cf7113713e4c8be819981dd7daeef7dacbdc8f

Analysis

max time kernel
2s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
13/11/2026, 04:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
debian/rules
Size 435B
Sample261113-e1ae7afv9y
SHA256 44fa45b7b81997b9dd9f6c2f72cf7113713e4c8be819981dd7daeef7dacbdc8f
MD5 ca125829e0ab36fb5a7d2222c68c208f
SHA1 c549debb7380f18725562627bdd922821aeee070
SHA512 f81380d48dda87ad028cde71ec738ba7df168a19d3a701878af7d65d3696ed0374c191a9ee782b7a9ce7f2094d3dec1a444597ca086d6adb9012831d08a17571
TLSH
T1FCE02B27D0B94C3A82830129C3450274FE8481EAD4ACF0D833C6D9A0E9D63B220A34F6
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: Unix Shell 1 TTPs 1 IoCs

Execute scripts via Unix Shell.

execution

Unix Shell

T1059.004

pid	Process
651	sh

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/maps	awk

Software Deployment Tools 1 TTPs 1 IoCs

Use software deployment tools to execute code.

execution

Software Deployment Tools

T1072

pid	Process
654	dpkg-parsechangelog

/tmp/debian/rules
/tmp/debian/rules
1⤵
PID:646
- /bin/sh
  /bin/sh -c "dpkg-parsechangelog | awk '/^Source:/ {print \$2}'"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:651
- - /usr/bin/awk
    awk "/^Source:/ {print \$2}"
    3⤵
    - Reads runtime system information
    PID:655
- - /usr/bin/dpkg-parsechangelog
    dpkg-parsechangelog
    3⤵
    - Software Deployment Tools
    PID:654
  - - /usr/local/sbin/tail
      tail -n 40 debian/changelog
      4⤵
      PID:674
  - - /usr/local/bin/tail
      tail -n 40 debian/changelog
      4⤵
      PID:674
  - - /usr/sbin/tail
      tail -n 40 debian/changelog
      4⤵
      PID:674
  - - /usr/bin/tail
      tail -n 40 debian/changelog
      4⤵
      PID:674
- /usr/local/sbin/dh_auto_clean
  dh_auto_clean
  2⤵
  PID:675
- /usr/local/bin/dh_auto_clean
  dh_auto_clean
  2⤵
  PID:675
- /usr/sbin/dh_auto_clean
  dh_auto_clean
  2⤵
  PID:675
- /usr/bin/dh_auto_clean
  dh_auto_clean
  2⤵
  PID:675
- /sbin/dh_auto_clean
  dh_auto_clean
  2⤵
  PID:675
- /bin/dh_auto_clean
  dh_auto_clean
  2⤵
  PID:675

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Unix Shell

T1059.004

Software Deployment Tools

T1072

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Software Deployment Tools

T1072

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads