45e4c2db372a495deb132857b845342a8e0037fc0ecb02d1e21c96de3e638730

Analysis

max time kernel
3s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
13/11/2026, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
debian/rules
Size 1KB
Sample261113-e1sa1af15r
SHA256 45e4c2db372a495deb132857b845342a8e0037fc0ecb02d1e21c96de3e638730
MD5 8fc99a917bf1a9a3672765d45fc779e4
SHA1 acf952310603b2ac6ab1714894674730d9f616ab
SHA512 4cdbbbed0dcfde6358788f1a737b15e2f1e877089f1e89ef1bb890588d44ef6bd43c8175b442cb88068994a8277933442eb19a4f15ec301b1c9031a7682690ee
TLSH
T1A021D03281C252F0BD9223D6A7A323EAEF75D1719DB40AC683DA572D130B5D1707E49B
MD5 SHA1 SHA512 TLSH

Score

2^/10

execution

Malware Config

Signatures

Software Deployment Tools 1 TTPs 2 IoCs

Use software deployment tools to execute code.

execution

Software Deployment Tools

T1072

pid	Process
658	dpkg-buildflags
680	dpkg-buildflags

/tmp/debian/rules
/tmp/debian/rules
1⤵
PID:651
- /usr/local/sbin/dpkg-buildflags
  dpkg-buildflags --get CFLAGS
  2⤵
  PID:658
- /usr/local/bin/dpkg-buildflags
  dpkg-buildflags --get CFLAGS
  2⤵
  PID:658
- /usr/sbin/dpkg-buildflags
  dpkg-buildflags --get CFLAGS
  2⤵
  PID:658
- /usr/bin/dpkg-buildflags
  dpkg-buildflags --get CFLAGS
  2⤵
  - Software Deployment Tools
  PID:658
- - /bin/pwd
    /bin/pwd
    3⤵
    PID:678
- - /usr/local/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:679
- - /usr/local/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:679
- - /usr/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:679
- - /usr/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:679
- /usr/local/sbin/dpkg-buildflags
  dpkg-buildflags --get LDFLAGS
  2⤵
  PID:680
- /usr/local/bin/dpkg-buildflags
  dpkg-buildflags --get LDFLAGS
  2⤵
  PID:680
- /usr/sbin/dpkg-buildflags
  dpkg-buildflags --get LDFLAGS
  2⤵
  PID:680
- /usr/bin/dpkg-buildflags
  dpkg-buildflags --get LDFLAGS
  2⤵
  - Software Deployment Tools
  PID:680
- - /bin/pwd
    /bin/pwd
    3⤵
    PID:681
- - /usr/local/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:682
- - /usr/local/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:682
- - /usr/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:682
- - /usr/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:682
- /usr/local/sbin/dh_testdir
  dh_testdir
  2⤵
  PID:683
- /usr/local/bin/dh_testdir
  dh_testdir
  2⤵
  PID:683
- /usr/sbin/dh_testdir
  dh_testdir
  2⤵
  PID:683
- /usr/bin/dh_testdir
  dh_testdir
  2⤵
  PID:683
- /sbin/dh_testdir
  dh_testdir
  2⤵
  PID:683
- /bin/dh_testdir
  dh_testdir
  2⤵
  PID:683

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Software Deployment Tools

T1072

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Software Deployment Tools

T1072

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads