4067e646688a44f33e55a4001b51bfc67e09095e7048c3fb8c519e05a2f81d3e

Analysis

max time kernel
2s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
13/11/2026, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
debian/rules
Size 281B
Sample261113-pc1ycaad64
SHA256 4067e646688a44f33e55a4001b51bfc67e09095e7048c3fb8c519e05a2f81d3e
MD5 82f1b3690b41102bf643e25c40cbae89
SHA1 5aa19751ab7aabe40a4eaf69c464fb995cad49ec
SHA512 d1ea66fbf8ba4fa601ee98bd3ac5e3f9873866461ca30f54b4241b7d58b326550e6b96ef1e076138f10fb8d1b29b87722e48fc8f7c379e3a02697c00811549a0
TLSH
T189D02B35C077A6B553545830356088BD07FAE1E0FFEC7C8772E8074CE6D59819917B64
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: Unix Shell 1 TTPs 1 IoCs

Execute scripts via Unix Shell.

execution

Unix Shell

T1059.004

pid	Process
685	sh

Software Deployment Tools 1 TTPs 1 IoCs

Use software deployment tools to execute code.

execution

Software Deployment Tools

T1072

pid	Process
663	dpkg-parsechangelog

/tmp/debian/rules
/tmp/debian/rules
1⤵
PID:656
- /usr/local/sbin/dpkg-parsechangelog
  dpkg-parsechangelog -STimestamp
  2⤵
  PID:663
- /usr/local/bin/dpkg-parsechangelog
  dpkg-parsechangelog -STimestamp
  2⤵
  PID:663
- /usr/sbin/dpkg-parsechangelog
  dpkg-parsechangelog -STimestamp
  2⤵
  PID:663
- /usr/bin/dpkg-parsechangelog
  dpkg-parsechangelog -STimestamp
  2⤵
  - Software Deployment Tools
  PID:663
- - /usr/local/sbin/tail
    tail -n 40 debian/changelog
    3⤵
    PID:684
- - /usr/local/bin/tail
    tail -n 40 debian/changelog
    3⤵
    PID:684
- - /usr/sbin/tail
    tail -n 40 debian/changelog
    3⤵
    PID:684
- - /usr/bin/tail
    tail -n 40 debian/changelog
    3⤵
    PID:684
- /bin/sh
  /bin/sh -c "PYBUILD_SYSTEM=custom \\ PYBUILD_TEST_ARGS=\"{interpreter} setup.py test\" \\ dh_auto_test"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:685

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Unix Shell

T1059.004

Software Deployment Tools

T1072

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Software Deployment Tools

T1072

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads