7418e5dc64edce93398ac06921df53dbe29179faa600dbe936fdfc5a9fe1f8f7

Analysis

max time kernel
0s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20261019-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20261019-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
13/11/2026, 17:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
debian/rules
Size 1KB
Sample261113-vrvyjayv5r
SHA256 7418e5dc64edce93398ac06921df53dbe29179faa600dbe936fdfc5a9fe1f8f7
MD5 bc055ab1cbc89725b7ea87dddbe8c330
SHA1 505a3b649e0065a7c4f178b2a60d24a0e69ade1c
SHA512 634221203a49b67c8f5bf90673222514a060c0fef5e3f118f09ee7154802518a4dbc79058205b9a030be7211c6b9d0e492cf30ec9afc01da6ae8b2a89b8b8e7b
TLSH
T12431653384B0A2AF91486707B7D54262EF1B95E0EAFF72735345972372C9933412786A
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: Unix Shell 1 TTPs 1 IoCs

Execute scripts via Unix Shell.

execution

Unix Shell

T1059.004

pid	Process
1546	sh

Reads runtime system information 3 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/meminfo	awk

Software Deployment Tools 1 TTPs 4 IoCs

Use software deployment tools to execute code.

execution

Software Deployment Tools

T1072

pid	Process
1529	dpkg-buildflags
1537	dpkg-buildflags
1540	dpkg-buildflags
1543	dpkg-buildflags

/tmp/debian/rules
/tmp/debian/rules
1⤵
PID:1523
- /usr/local/sbin/dpkg-architecture
  dpkg-architecture -qDEB_BUILD_ARCH
  2⤵
  PID:1524
- /usr/local/bin/dpkg-architecture
  dpkg-architecture -qDEB_BUILD_ARCH
  2⤵
  PID:1524
- /usr/sbin/dpkg-architecture
  dpkg-architecture -qDEB_BUILD_ARCH
  2⤵
  PID:1524
- /usr/bin/dpkg-architecture
  dpkg-architecture -qDEB_BUILD_ARCH
  2⤵
  PID:1524
- - /usr/local/sbin/dpkg
    dpkg --print-architecture
    3⤵
    PID:1527
- - /usr/local/bin/dpkg
    dpkg --print-architecture
    3⤵
    PID:1527
- - /usr/sbin/dpkg
    dpkg --print-architecture
    3⤵
    PID:1527
- - /usr/bin/dpkg
    dpkg --print-architecture
    3⤵
    - Reads runtime system information
    PID:1527
- /usr/local/sbin/awk
  awk "/^MemTotal/ { print int(\$2/(2048*1024)+0.5) }" /proc/meminfo
  2⤵
  PID:1528
- /usr/local/bin/awk
  awk "/^MemTotal/ { print int(\$2/(2048*1024)+0.5) }" /proc/meminfo
  2⤵
  PID:1528
- /usr/sbin/awk
  awk "/^MemTotal/ { print int(\$2/(2048*1024)+0.5) }" /proc/meminfo
  2⤵
  PID:1528
- /usr/bin/awk
  awk "/^MemTotal/ { print int(\$2/(2048*1024)+0.5) }" /proc/meminfo
  2⤵
  - Reads runtime system information
  PID:1528
- /usr/local/sbin/dpkg-buildflags
  dpkg-buildflags --get CPPFLAGS
  2⤵
  PID:1529
- /usr/local/bin/dpkg-buildflags
  dpkg-buildflags --get CPPFLAGS
  2⤵
  PID:1529
- /usr/sbin/dpkg-buildflags
  dpkg-buildflags --get CPPFLAGS
  2⤵
  PID:1529
- /usr/bin/dpkg-buildflags
  dpkg-buildflags --get CPPFLAGS
  2⤵
  - Software Deployment Tools
  PID:1529
- - /usr/local/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:1535
- - /usr/local/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:1535
- - /usr/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:1535
- - /usr/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:1535
- - /bin/pwd
    /bin/pwd
    3⤵
    PID:1536
- /usr/local/sbin/dpkg-buildflags
  dpkg-buildflags --get CFLAGS
  2⤵
  PID:1537
- /usr/local/bin/dpkg-buildflags
  dpkg-buildflags --get CFLAGS
  2⤵
  PID:1537
- /usr/sbin/dpkg-buildflags
  dpkg-buildflags --get CFLAGS
  2⤵
  PID:1537
- /usr/bin/dpkg-buildflags
  dpkg-buildflags --get CFLAGS
  2⤵
  - Software Deployment Tools
  PID:1537
- - /usr/local/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:1538
- - /usr/local/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:1538
- - /usr/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:1538
- - /usr/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:1538
- - /bin/pwd
    /bin/pwd
    3⤵
    PID:1539
- /usr/local/sbin/dpkg-buildflags
  dpkg-buildflags --get CXXFLAGS
  2⤵
  PID:1540
- /usr/local/bin/dpkg-buildflags
  dpkg-buildflags --get CXXFLAGS
  2⤵
  PID:1540
- /usr/sbin/dpkg-buildflags
  dpkg-buildflags --get CXXFLAGS
  2⤵
  PID:1540
- /usr/bin/dpkg-buildflags
  dpkg-buildflags --get CXXFLAGS
  2⤵
  - Software Deployment Tools
  PID:1540
- - /usr/local/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:1541
- - /usr/local/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:1541
- - /usr/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:1541
- - /usr/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:1541
- - /bin/pwd
    /bin/pwd
    3⤵
    PID:1542
- /usr/local/sbin/dpkg-buildflags
  dpkg-buildflags --get LDFLAGS
  2⤵
  PID:1543
- /usr/local/bin/dpkg-buildflags
  dpkg-buildflags --get LDFLAGS
  2⤵
  PID:1543
- /usr/sbin/dpkg-buildflags
  dpkg-buildflags --get LDFLAGS
  2⤵
  PID:1543
- /usr/bin/dpkg-buildflags
  dpkg-buildflags --get LDFLAGS
  2⤵
  - Software Deployment Tools
  PID:1543
- - /usr/local/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:1544
- - /usr/local/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:1544
- - /usr/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:1544
- - /usr/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:1544
- - /bin/pwd
    /bin/pwd
    3⤵
    PID:1545
- /bin/sh
  /bin/sh -c "dh build --max-parallel=\"1\""
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:1546

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Unix Shell

T1059.004

Software Deployment Tools

T1072

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Software Deployment Tools

T1072

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads