9d8c179b8f759843b43787dc2ee1c3fed9a5f32160e77e1046214bd07ce71051

Analysis

max time kernel
31s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
13/11/2026, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
debian/rules
Size 4KB
Sample261113-pcv24abs3s
SHA256 9d8c179b8f759843b43787dc2ee1c3fed9a5f32160e77e1046214bd07ce71051
MD5 d068fe3d714de0acc0efe53f34779180
SHA1 46af2adb6de37ec23552979f19cc9b1e37cc8b4a
SHA512 64e9ac164f169cf696915580e5a3b9fe909fea45d247d3a6325b5370e9c962bc5ccbd9024bfbb1aa70698976e05231a44015b609a5229ce00e7bc1a99544b18a
SSDEEP 96:0asUyJLxjratKydlys+wHu1+P9IA1AvD5xWd9fXUxuSgnRRX1Zv0:0az4LxHatKyXP9vdQgnRRXf0
TLSH
T1FF91236BD0CC12392CD72347662BF3DAF344D12599925A52D3EE4EAAD307A392037A47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: Unix Shell 1 TTPs 1 IoCs

Execute scripts via Unix Shell.

execution

Unix Shell

T1059.004

pid	Process
746	sh

Software Deployment Tools 1 TTPs 3 IoCs

Use software deployment tools to execute code.

execution

Software Deployment Tools

T1072

pid	Process
721	dpkg-buildflags
747	dpkg-buildflags
763	dpkg-buildflags

/tmp/debian/rules
/tmp/debian/rules
1⤵
PID:718
- /usr/local/sbin/dpkg-buildflags
  dpkg-buildflags --get LDFLAGS
  2⤵
  PID:721
- /usr/local/bin/dpkg-buildflags
  dpkg-buildflags --get LDFLAGS
  2⤵
  PID:721
- /usr/sbin/dpkg-buildflags
  dpkg-buildflags --get LDFLAGS
  2⤵
  PID:721
- /usr/bin/dpkg-buildflags
  dpkg-buildflags --get LDFLAGS
  2⤵
  - Software Deployment Tools
  PID:721
- - /bin/pwd
    /bin/pwd
    3⤵
    PID:744
- - /usr/local/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:745
- - /usr/local/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:745
- - /usr/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:745
- - /usr/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:745
- /bin/sh
  /bin/sh -c "dpkg-buildflags --get CPPFLAGS; dpkg-buildflags --get CFLAGS"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:746
- - /usr/bin/dpkg-buildflags
    dpkg-buildflags --get CPPFLAGS
    3⤵
    - Software Deployment Tools
    PID:747
  - - /bin/pwd
      /bin/pwd
      4⤵
      PID:760
  - - /usr/local/sbin/gcc
      gcc -dumpmachine
      4⤵
      PID:761
  - - /usr/local/bin/gcc
      gcc -dumpmachine
      4⤵
      PID:761
  - - /usr/sbin/gcc
      gcc -dumpmachine
      4⤵
      PID:761
  - - /usr/bin/gcc
      gcc -dumpmachine
      4⤵
      PID:761
- - /usr/bin/dpkg-buildflags
    dpkg-buildflags --get CFLAGS
    3⤵
    - Software Deployment Tools
    PID:763
  - - /bin/pwd
      /bin/pwd
      4⤵
      PID:779
  - - /usr/local/sbin/gcc
      gcc -dumpmachine
      4⤵
      PID:781
  - - /usr/local/bin/gcc
      gcc -dumpmachine
      4⤵
      PID:781
  - - /usr/sbin/gcc
      gcc -dumpmachine
      4⤵
      PID:781
  - - /usr/bin/gcc
      gcc -dumpmachine
      4⤵
      PID:781
- /usr/local/sbin/dpkg-architecture
  dpkg-architecture -qDEB_HOST_ARCH
  2⤵
  PID:784
- /usr/local/bin/dpkg-architecture
  dpkg-architecture -qDEB_HOST_ARCH
  2⤵
  PID:784
- /usr/sbin/dpkg-architecture
  dpkg-architecture -qDEB_HOST_ARCH
  2⤵
  PID:784
- /usr/bin/dpkg-architecture
  dpkg-architecture -qDEB_HOST_ARCH
  2⤵
  PID:784
- - /usr/local/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:798
- - /usr/local/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:798
- - /usr/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:798
- - /usr/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:798
- /usr/local/sbin/dpkg-architecture
  dpkg-architecture -qDEB_HOST_ARCH
  2⤵
  PID:800
- /usr/local/bin/dpkg-architecture
  dpkg-architecture -qDEB_HOST_ARCH
  2⤵
  PID:800
- /usr/sbin/dpkg-architecture
  dpkg-architecture -qDEB_HOST_ARCH
  2⤵
  PID:800
- /usr/bin/dpkg-architecture
  dpkg-architecture -qDEB_HOST_ARCH
  2⤵
  PID:800
- - /usr/local/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:801
- - /usr/local/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:801
- - /usr/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:801
- - /usr/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:801
- /usr/local/sbin/dpkg-architecture
  dpkg-architecture -qDEB_HOST_ARCH
  2⤵
  PID:802
- /usr/local/bin/dpkg-architecture
  dpkg-architecture -qDEB_HOST_ARCH
  2⤵
  PID:802
- /usr/sbin/dpkg-architecture
  dpkg-architecture -qDEB_HOST_ARCH
  2⤵
  PID:802
- /usr/bin/dpkg-architecture
  dpkg-architecture -qDEB_HOST_ARCH
  2⤵
  PID:802
- - /usr/local/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:807
- - /usr/local/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:807
- - /usr/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:807
- - /usr/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:807
- /usr/local/sbin/dh_testdir
  dh_testdir
  2⤵
  PID:809
- /usr/local/bin/dh_testdir
  dh_testdir
  2⤵
  PID:809
- /usr/sbin/dh_testdir
  dh_testdir
  2⤵
  PID:809
- /usr/bin/dh_testdir
  dh_testdir
  2⤵
  PID:809
- /sbin/dh_testdir
  dh_testdir
  2⤵
  PID:809
- /bin/dh_testdir
  dh_testdir
  2⤵
  PID:809

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Unix Shell

T1059.004

Software Deployment Tools

T1072

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Software Deployment Tools

T1072

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads