6498bb42f994d0226238c65118a0fb77fe9fbf0dca5852bfec793f7f86d5a8e2

Analysis

max time kernel
2s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
13/11/2026, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
debian/rules
Size 1KB
Sample261113-pc3f6sad76
SHA256 6498bb42f994d0226238c65118a0fb77fe9fbf0dca5852bfec793f7f86d5a8e2
MD5 5f41d4f21a6fbae552876ae15506189b
SHA1 355b9e5c7a47569ab3d391f34d7a76356c18610f
SHA512 57d67e04b0f6411ad826909ff1d0220ef98ec651fa90596d1bc8c2746cc3e4d9067c9a965bc080ce11d5747a31180592cd94da73e420e9700bb8d957a578ce6a
TLSH
T19121332350212BD0640BAB6CB38493118A1D4196FDFD627231DFAE7B60C77D3C279C06
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg

/tmp/debian/rules
/tmp/debian/rules
1⤵
PID:653
- /usr/local/sbin/dpkg-architecture
  dpkg-architecture -qDEB_BUILD_ARCH
  2⤵
  PID:657
- /usr/local/bin/dpkg-architecture
  dpkg-architecture -qDEB_BUILD_ARCH
  2⤵
  PID:657
- /usr/sbin/dpkg-architecture
  dpkg-architecture -qDEB_BUILD_ARCH
  2⤵
  PID:657
- /usr/bin/dpkg-architecture
  dpkg-architecture -qDEB_BUILD_ARCH
  2⤵
  PID:657
- - /usr/local/sbin/dpkg
    dpkg --print-architecture
    3⤵
    PID:679
- - /usr/local/bin/dpkg
    dpkg --print-architecture
    3⤵
    PID:679
- - /usr/sbin/dpkg
    dpkg --print-architecture
    3⤵
    PID:679
- - /usr/bin/dpkg
    dpkg --print-architecture
    3⤵
    - Reads runtime system information
    PID:679
- /usr/local/sbin/dpkg-architecture
  dpkg-architecture -qDEB_BUILD_ARCH_OS
  2⤵
  PID:680
- /usr/local/bin/dpkg-architecture
  dpkg-architecture -qDEB_BUILD_ARCH_OS
  2⤵
  PID:680
- /usr/sbin/dpkg-architecture
  dpkg-architecture -qDEB_BUILD_ARCH_OS
  2⤵
  PID:680
- /usr/bin/dpkg-architecture
  dpkg-architecture -qDEB_BUILD_ARCH_OS
  2⤵
  PID:680
- - /usr/local/sbin/dpkg
    dpkg --print-architecture
    3⤵
    PID:681
- - /usr/local/bin/dpkg
    dpkg --print-architecture
    3⤵
    PID:681
- - /usr/sbin/dpkg
    dpkg --print-architecture
    3⤵
    PID:681
- - /usr/bin/dpkg
    dpkg --print-architecture
    3⤵
    - Reads runtime system information
    PID:681
- /usr/local/sbin/make
  make all doc
  2⤵
  PID:682
- /usr/local/bin/make
  make all doc
  2⤵
  PID:682
- /usr/sbin/make
  make all doc
  2⤵
  PID:682
- /usr/bin/make
  make all doc
  2⤵
  PID:682

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads