2b32a9bab5a4321c3f0300af3bf0c8ce78d706dfb1e231d36628a622599670d1

Analysis

max time kernel
0s
max time network
128s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20261019-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20261019-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
13/11/2026, 08:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
debian/rules
Size 696B
Sample261113-katzsshv7x
SHA256 2b32a9bab5a4321c3f0300af3bf0c8ce78d706dfb1e231d36628a622599670d1
MD5 6f1f9429971dd36a1fce6be8c6c16bf7
SHA1 a6daea10634a9a9774c7f3d6fa1fb1c0433f7a7f
SHA512 9a8f647800744694a713f590c3432313b362dbf9753bb3f5d59f41ef8c843698706df8cd80373d600dbb323429f879108ab46e94e4eb04b217a79b0cf7d79b66
TLSH
T181016033C2E8BD382E40031293C203912A9401CCDFED338B22CB2A18529741A104BDEE
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: Unix Shell 1 TTPs 1 IoCs

Execute scripts via Unix Shell.

execution

Unix Shell

T1059.004

pid	Process
1514	sh

/tmp/debian/rules
/tmp/debian/rules
1⤵
PID:1511
- /usr/local/sbin/dpkg-architecture
  dpkg-architecture -qDEB_HOST_MULTIARCH
  2⤵
  PID:1512
- /usr/local/bin/dpkg-architecture
  dpkg-architecture -qDEB_HOST_MULTIARCH
  2⤵
  PID:1512
- /usr/sbin/dpkg-architecture
  dpkg-architecture -qDEB_HOST_MULTIARCH
  2⤵
  PID:1512
- /usr/bin/dpkg-architecture
  dpkg-architecture -qDEB_HOST_MULTIARCH
  2⤵
  PID:1512
- - /usr/local/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:1513
- - /usr/local/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:1513
- - /usr/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:1513
- - /usr/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:1513
- /bin/sh
  /bin/sh -c "# hack for using cec-platform"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:1514
- /usr/local/sbin/ln
  ln -s /usr/include/cec-platform src/platform
  2⤵
  PID:1515
- /usr/local/bin/ln
  ln -s /usr/include/cec-platform src/platform
  2⤵
  PID:1515
- /usr/sbin/ln
  ln -s /usr/include/cec-platform src/platform
  2⤵
  PID:1515
- /usr/bin/ln
  ln -s /usr/include/cec-platform src/platform
  2⤵
  PID:1515
- /sbin/ln
  ln -s /usr/include/cec-platform src/platform
  2⤵
  PID:1515
- /bin/ln
  ln -s /usr/include/cec-platform src/platform
  2⤵
  PID:1515

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Unix Shell

T1059.004

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads