212bea17b57111467b26a49d51d09998e2812bc7bf933234119224dd3f69aee3

Analysis

max time kernel
0s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20261019-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20261019-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
13/11/2026, 08:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
debian/rules
Size 803B
Sample261113-j3hlssst3k
SHA256 212bea17b57111467b26a49d51d09998e2812bc7bf933234119224dd3f69aee3
MD5 e3165b4d87b147086ca18accc88e1a81
SHA1 4ea5567f5fc39a1cb35f8a9d0e451be289de6ce6
SHA512 f6492bfd8cb2b34a18ee8ecdcd4eb7376f2cb75c2beb4ac42f17b6612956e7c52d0bdc50afacb0f4ebfabb218ed6a3461276c0bd2f120882a1dda8dfcaa97171
TLSH
T1DF01CE61B2F44DB5381749237C4DD2092FEA40E736AAECD2D089A496B686368E72BC54
MD5 SHA1 SHA512 TLSH

Score

2^/10

execution

Malware Config

Signatures

Software Deployment Tools 1 TTPs 1 IoCs

Use software deployment tools to execute code.

execution

Software Deployment Tools

T1072

pid	Process
1540	dpkg-parsechangelog

/tmp/debian/rules
/tmp/debian/rules
1⤵
PID:1539
- /usr/local/sbin/dpkg-parsechangelog
  dpkg-parsechangelog -STimestamp
  2⤵
  PID:1540
- /usr/local/bin/dpkg-parsechangelog
  dpkg-parsechangelog -STimestamp
  2⤵
  PID:1540
- /usr/sbin/dpkg-parsechangelog
  dpkg-parsechangelog -STimestamp
  2⤵
  PID:1540
- /usr/bin/dpkg-parsechangelog
  dpkg-parsechangelog -STimestamp
  2⤵
  - Software Deployment Tools
  PID:1540
- - /usr/local/sbin/tail
    tail -n 40 debian/changelog
    3⤵
    PID:1545
- - /usr/local/bin/tail
    tail -n 40 debian/changelog
    3⤵
    PID:1545
- - /usr/sbin/tail
    tail -n 40 debian/changelog
    3⤵
    PID:1545
- - /usr/bin/tail
    tail -n 40 debian/changelog
    3⤵
    PID:1545
- /usr/local/sbin/dh_auto_install
  dh_auto_install -- "PREFIX=/usr"
  2⤵
  PID:1546
- /usr/local/bin/dh_auto_install
  dh_auto_install -- "PREFIX=/usr"
  2⤵
  PID:1546
- /usr/sbin/dh_auto_install
  dh_auto_install -- "PREFIX=/usr"
  2⤵
  PID:1546
- /usr/bin/dh_auto_install
  dh_auto_install -- "PREFIX=/usr"
  2⤵
  PID:1546
- /sbin/dh_auto_install
  dh_auto_install -- "PREFIX=/usr"
  2⤵
  PID:1546
- /bin/dh_auto_install
  dh_auto_install -- "PREFIX=/usr"
  2⤵
  PID:1546
- /snap/bin/dh_auto_install
  dh_auto_install -- "PREFIX=/usr"
  2⤵
  PID:1546

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Software Deployment Tools

T1072

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Software Deployment Tools

T1072

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads