e5af22f43554bd87f48c4c309bade29278f6a9c9747f0b543cb40b3eaf182050

Analysis

max time kernel
0s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20261019-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20261019-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
13/11/2026, 04:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
debian/rules
Size 2KB
Sample261113-e1bm9afw2s
SHA256 e5af22f43554bd87f48c4c309bade29278f6a9c9747f0b543cb40b3eaf182050
MD5 68329ba9673e81f9c413255969a4ebda
SHA1 6c7938de408a011c08aa034100504dbd2f59c0d3
SHA512 3aa33a226a85842225215452f5662558ba22a368346edf4128652e0d101c0998b6ef85c8c9db53a5e8f904d475add16cf1bacc4a398377d7425eb8a4de40d89f
TLSH
T146515221D594C9AC4C484F7BF7C11103AE7034B72DAA7CE3B2CC76245FC802A566BAE0
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: Unix Shell 1 TTPs 10 IoCs

Execute scripts via Unix Shell.

execution

Unix Shell

T1059.004

pid	Process
1558	sh
1562	sh
1566	sh
1538	sh
1554	sh
1520	sh
1529	sh
1534	sh
1546	sh
1550	sh

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	sed

Software Deployment Tools 1 TTPs 10 IoCs

Use software deployment tools to execute code.

execution

Software Deployment Tools

T1072

pid	Process
1559	dpkg-buildflags
1567	dpkg-buildflags
1521	dpkg-parsechangelog
1530	dpkg-buildflags
1563	dpkg-buildflags
1535	dpkg-buildflags
1539	dpkg-buildflags
1547	dpkg-buildflags
1551	dpkg-buildflags
1555	dpkg-buildflags

/tmp/debian/rules
/tmp/debian/rules
1⤵
PID:1519
- /bin/sh
  /bin/sh -c "dpkg-parsechangelog | sed -n -e '/^Version:/s/.*: //p'"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:1520
- - /bin/sed
    sed -n -e "/^Version:/s/.*: //p"
    3⤵
    - Reads runtime system information
    PID:1522
- - /usr/bin/dpkg-parsechangelog
    dpkg-parsechangelog
    3⤵
    - Software Deployment Tools
    PID:1521
  - - /usr/local/sbin/tail
      tail -n 40 debian/changelog
      4⤵
      PID:1525
  - - /usr/local/bin/tail
      tail -n 40 debian/changelog
      4⤵
      PID:1525
  - - /usr/sbin/tail
      tail -n 40 debian/changelog
      4⤵
      PID:1525
  - - /usr/bin/tail
      tail -n 40 debian/changelog
      4⤵
      PID:1525
- /bin/sh
  /bin/sh -c "echo | cut -f1,2 -d."
  2⤵
  PID:1526
- - /usr/bin/cut
    cut "-f1,2" -d.
    3⤵
    PID:1528
- /bin/sh
  /bin/sh -c "DEB_BUILD_MAINT_OPTIONS=\"hardening=+all,-pie\" dpkg-buildflags --get CFLAGS"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:1529
- - /usr/bin/dpkg-buildflags
    dpkg-buildflags --get CFLAGS
    3⤵
    - Software Deployment Tools
    PID:1530
  - - /usr/local/sbin/gcc
      gcc -dumpmachine
      4⤵
      PID:1532
  - - /usr/local/bin/gcc
      gcc -dumpmachine
      4⤵
      PID:1532
  - - /usr/sbin/gcc
      gcc -dumpmachine
      4⤵
      PID:1532
  - - /usr/bin/gcc
      gcc -dumpmachine
      4⤵
      PID:1532
  - - /bin/pwd
      /bin/pwd
      4⤵
      PID:1533
- /bin/sh
  /bin/sh -c "DEB_BUILD_MAINT_OPTIONS=\"hardening=+all,-pie\" dpkg-buildflags --get CPPFLAGS"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:1534
- - /usr/bin/dpkg-buildflags
    dpkg-buildflags --get CPPFLAGS
    3⤵
    - Software Deployment Tools
    PID:1535
  - - /usr/local/sbin/gcc
      gcc -dumpmachine
      4⤵
      PID:1536
  - - /usr/local/bin/gcc
      gcc -dumpmachine
      4⤵
      PID:1536
  - - /usr/sbin/gcc
      gcc -dumpmachine
      4⤵
      PID:1536
  - - /usr/bin/gcc
      gcc -dumpmachine
      4⤵
      PID:1536
  - - /bin/pwd
      /bin/pwd
      4⤵
      PID:1537
- /bin/sh
  /bin/sh -c "DEB_BUILD_MAINT_OPTIONS=\"hardening=+all,-pie\" dpkg-buildflags --get LDFLAGS"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:1538
- - /usr/bin/dpkg-buildflags
    dpkg-buildflags --get LDFLAGS
    3⤵
    - Software Deployment Tools
    PID:1539
  - - /usr/local/sbin/gcc
      gcc -dumpmachine
      4⤵
      PID:1544
  - - /usr/local/bin/gcc
      gcc -dumpmachine
      4⤵
      PID:1544
  - - /usr/sbin/gcc
      gcc -dumpmachine
      4⤵
      PID:1544
  - - /usr/bin/gcc
      gcc -dumpmachine
      4⤵
      PID:1544
  - - /bin/pwd
      /bin/pwd
      4⤵
      PID:1545
- /bin/sh
  /bin/sh -c "DEB_BUILD_MAINT_OPTIONS=\"hardening=+all,-pie\" dpkg-buildflags --get OBJCXXFLAGS"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:1546
- - /usr/bin/dpkg-buildflags
    dpkg-buildflags --get OBJCXXFLAGS
    3⤵
    - Software Deployment Tools
    PID:1547
  - - /usr/local/sbin/gcc
      gcc -dumpmachine
      4⤵
      PID:1548
  - - /usr/local/bin/gcc
      gcc -dumpmachine
      4⤵
      PID:1548
  - - /usr/sbin/gcc
      gcc -dumpmachine
      4⤵
      PID:1548
  - - /usr/bin/gcc
      gcc -dumpmachine
      4⤵
      PID:1548
  - - /bin/pwd
      /bin/pwd
      4⤵
      PID:1549
- /bin/sh
  /bin/sh -c "DEB_BUILD_MAINT_OPTIONS=\"hardening=+all,-pie\" dpkg-buildflags --get GCJFLAGS"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:1550
- - /usr/bin/dpkg-buildflags
    dpkg-buildflags --get GCJFLAGS
    3⤵
    - Software Deployment Tools
    PID:1551
  - - /usr/local/sbin/gcc
      gcc -dumpmachine
      4⤵
      PID:1552
  - - /usr/local/bin/gcc
      gcc -dumpmachine
      4⤵
      PID:1552
  - - /usr/sbin/gcc
      gcc -dumpmachine
      4⤵
      PID:1552
  - - /usr/bin/gcc
      gcc -dumpmachine
      4⤵
      PID:1552
  - - /bin/pwd
      /bin/pwd
      4⤵
      PID:1553
- /bin/sh
  /bin/sh -c "DEB_BUILD_MAINT_OPTIONS=\"hardening=+all,-pie\" dpkg-buildflags --get CXXFLAGS"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:1554
- - /usr/bin/dpkg-buildflags
    dpkg-buildflags --get CXXFLAGS
    3⤵
    - Software Deployment Tools
    PID:1555
  - - /usr/local/sbin/gcc
      gcc -dumpmachine
      4⤵
      PID:1556
  - - /usr/local/bin/gcc
      gcc -dumpmachine
      4⤵
      PID:1556
  - - /usr/sbin/gcc
      gcc -dumpmachine
      4⤵
      PID:1556
  - - /usr/bin/gcc
      gcc -dumpmachine
      4⤵
      PID:1556
  - - /bin/pwd
      /bin/pwd
      4⤵
      PID:1557
- /bin/sh
  /bin/sh -c "DEB_BUILD_MAINT_OPTIONS=\"hardening=+all,-pie\" dpkg-buildflags --get FFLAGS"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:1558
- - /usr/bin/dpkg-buildflags
    dpkg-buildflags --get FFLAGS
    3⤵
    - Software Deployment Tools
    PID:1559
  - - /usr/local/sbin/gcc
      gcc -dumpmachine
      4⤵
      PID:1560
  - - /usr/local/bin/gcc
      gcc -dumpmachine
      4⤵
      PID:1560
  - - /usr/sbin/gcc
      gcc -dumpmachine
      4⤵
      PID:1560
  - - /usr/bin/gcc
      gcc -dumpmachine
      4⤵
      PID:1560
  - - /bin/pwd
      /bin/pwd
      4⤵
      PID:1561
- /bin/sh
  /bin/sh -c "DEB_BUILD_MAINT_OPTIONS=\"hardening=+all,-pie\" dpkg-buildflags --get FCFLAGS"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:1562
- - /usr/bin/dpkg-buildflags
    dpkg-buildflags --get FCFLAGS
    3⤵
    - Software Deployment Tools
    PID:1563
  - - /usr/local/sbin/gcc
      gcc -dumpmachine
      4⤵
      PID:1564
  - - /usr/local/bin/gcc
      gcc -dumpmachine
      4⤵
      PID:1564
  - - /usr/sbin/gcc
      gcc -dumpmachine
      4⤵
      PID:1564
  - - /usr/bin/gcc
      gcc -dumpmachine
      4⤵
      PID:1564
  - - /bin/pwd
      /bin/pwd
      4⤵
      PID:1565
- /bin/sh
  /bin/sh -c "DEB_BUILD_MAINT_OPTIONS=\"hardening=+all,-pie\" dpkg-buildflags --get OBJCFLAGS"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:1566
- - /usr/bin/dpkg-buildflags
    dpkg-buildflags --get OBJCFLAGS
    3⤵
    - Software Deployment Tools
    PID:1567
  - - /usr/local/sbin/gcc
      gcc -dumpmachine
      4⤵
      PID:1568
  - - /usr/local/bin/gcc
      gcc -dumpmachine
      4⤵
      PID:1568
  - - /usr/sbin/gcc
      gcc -dumpmachine
      4⤵
      PID:1568
  - - /usr/bin/gcc
      gcc -dumpmachine
      4⤵
      PID:1568
  - - /bin/pwd
      /bin/pwd
      4⤵
      PID:1569
- /tmp/debian/configure
  ./configure "--mandir=/usr/share/postgresql//man" "--docdir=/usr/share/doc/postgresql-doc-" "--sysconfdir=/etc/postgresql-common" "--datarootdir=/usr/share/" "--datadir=/usr/share/postgresql/" "--bindir=/usr/lib/postgresql//bin" "--libdir=/usr/lib/" "--libexecdir=/usr/lib/postgresql/" "--includedir=/usr/include/postgresql/" --enable-nls --enable-integer-datetimes --enable-thread-safety --enable-debug --disable-rpath --with-perl --with-gnu-ld "--with-pgport=5432" "--with-system-tzdata=/usr/share/zoneinfo" --without-ossp-uuid --without-krb5 --without-gssapi --without-ldap --without-tcl --without-python --without-pam --without-openssl --without-libxml --without-libxslt "CFLAGS=-g -O2 -fdebug-prefix-map=/tmp/debian=. -specs=/usr/share/dpkg/no-pie-compile.specs -fstack-protector-strong -Wformat -Werror=format-security -fPIC -pie" "CPPFLAGS=-Wdate-time -D_FORTIFY_SOURCE=2" "LDFLAGS=-Wl,-Bsymbolic-functions -specs=/usr/share/dpkg/no-pie-link.specs -Wl,-z,relro -Wl,-z,now -Wl,--as-needed"
  2⤵
  PID:1570

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Unix Shell

T1059.004

Software Deployment Tools

T1072

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Software Deployment Tools

T1072

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads