3755a2b7457963638671c4fc5bc2f615873eddbf56e1b43b919b45a4ca3801d9

Analysis

max time kernel
0s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20261019-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20261019-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
13/11/2026, 08:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
debian/rules
Size 1KB
Sample261113-kavlbssv4k
SHA256 3755a2b7457963638671c4fc5bc2f615873eddbf56e1b43b919b45a4ca3801d9
MD5 45bc8c59ec0279b7bc6925fb1d53ff6f
SHA1 1e1ea58148645102b394834b2dbe5597eab4ad44
SHA512 6336d4718d9cf39cbd33a9e0bf57872b6b7f33a60b3c6e8c517174a9ad1f7f63886d1ce119675b46c14544daaec77616975f64a76b347ac1d90cf25d41dd890d
TLSH
T1563129384D92C933F668266F6D522D229B650AC4FCB190CD81EBDBC2554B42C9937FE2
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: Unix Shell 1 TTPs 1 IoCs

Execute scripts via Unix Shell.

execution

Unix Shell

T1059.004

pid	Process
1550	sh

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1550	sh

/tmp/debian/rules
/tmp/debian/rules
1⤵
PID:1539
- /usr/local/sbin/pyversions
  pyversions -sv
  2⤵
  PID:1540
- /usr/local/bin/pyversions
  pyversions -sv
  2⤵
  PID:1540
- /usr/sbin/pyversions
  pyversions -sv
  2⤵
  PID:1540
- /usr/bin/pyversions
  pyversions -sv
  2⤵
  PID:1540
- /usr/local/sbin/py3versions
  py3versions -sv
  2⤵
  PID:1544
- /usr/local/bin/py3versions
  py3versions -sv
  2⤵
  PID:1544
- /usr/sbin/py3versions
  py3versions -sv
  2⤵
  PID:1544
- /usr/bin/py3versions
  py3versions -sv
  2⤵
  PID:1544
- /bin/sh
  /bin/sh -c "set -e && for pyvers in 2.7; do \\ ( cd lib/ipp; python\$pyvers ipp-setup.py build ); \\ ( cd lib/plt; python\$pyvers plt-setup.py build ); \\ ( cd lib/natkit; python\$pyvers natkit-setup.py build ); \\ ( cd lib/pldns; python\$pyvers pldns-setup.py build ); \\ done"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  - System Network Configuration Discovery
  PID:1550

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Unix Shell

T1059.004

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads