6498bb42f994d0226238c65118a0fb77fe9fbf0dca5852bfec793f7f86d5a8e2

Analysis

max time kernel
0s
max time network
128s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20261019-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20261019-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
13/11/2026, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
debian/rules
Size 1KB
Sample261113-pc3f6sad76
SHA256 6498bb42f994d0226238c65118a0fb77fe9fbf0dca5852bfec793f7f86d5a8e2
MD5 5f41d4f21a6fbae552876ae15506189b
SHA1 355b9e5c7a47569ab3d391f34d7a76356c18610f
SHA512 57d67e04b0f6411ad826909ff1d0220ef98ec651fa90596d1bc8c2746cc3e4d9067c9a965bc080ce11d5747a31180592cd94da73e420e9700bb8d957a578ce6a
TLSH
T19121332350212BD0640BAB6CB38493118A1D4196FDFD627231DFAE7B60C77D3C279C06
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg

/tmp/debian/rules
/tmp/debian/rules
1⤵
PID:1509
- /usr/local/sbin/dpkg-architecture
  dpkg-architecture -qDEB_BUILD_ARCH
  2⤵
  PID:1510
- /usr/local/bin/dpkg-architecture
  dpkg-architecture -qDEB_BUILD_ARCH
  2⤵
  PID:1510
- /usr/sbin/dpkg-architecture
  dpkg-architecture -qDEB_BUILD_ARCH
  2⤵
  PID:1510
- /usr/bin/dpkg-architecture
  dpkg-architecture -qDEB_BUILD_ARCH
  2⤵
  PID:1510
- - /usr/local/sbin/dpkg
    dpkg --print-architecture
    3⤵
    PID:1511
- - /usr/local/bin/dpkg
    dpkg --print-architecture
    3⤵
    PID:1511
- - /usr/sbin/dpkg
    dpkg --print-architecture
    3⤵
    PID:1511
- - /usr/bin/dpkg
    dpkg --print-architecture
    3⤵
    - Reads runtime system information
    PID:1511
- /usr/local/sbin/dpkg-architecture
  dpkg-architecture -qDEB_BUILD_ARCH_OS
  2⤵
  PID:1512
- /usr/local/bin/dpkg-architecture
  dpkg-architecture -qDEB_BUILD_ARCH_OS
  2⤵
  PID:1512
- /usr/sbin/dpkg-architecture
  dpkg-architecture -qDEB_BUILD_ARCH_OS
  2⤵
  PID:1512
- /usr/bin/dpkg-architecture
  dpkg-architecture -qDEB_BUILD_ARCH_OS
  2⤵
  PID:1512
- - /usr/local/sbin/dpkg
    dpkg --print-architecture
    3⤵
    PID:1517
- - /usr/local/bin/dpkg
    dpkg --print-architecture
    3⤵
    PID:1517
- - /usr/sbin/dpkg
    dpkg --print-architecture
    3⤵
    PID:1517
- - /usr/bin/dpkg
    dpkg --print-architecture
    3⤵
    - Reads runtime system information
    PID:1517
- /usr/local/sbin/make
  make all doc
  2⤵
  PID:1518
- /usr/local/bin/make
  make all doc
  2⤵
  PID:1518
- /usr/sbin/make
  make all doc
  2⤵
  PID:1518
- /usr/bin/make
  make all doc
  2⤵
  PID:1518

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads