Overview

overview

3

Static

static

1

debian/rules

ubuntu-18.04-amd64

3

debian/rules

debian-9-armhf

3

debian/rules

debian-9-mips

3

debian/rules

debian-9-mipsel

3

Analysis

  • max time kernel
    8s
  • platform
    debian-9_mipsel
  • resource
    debian9-mipsel-20260513-en
  • resource tags

    arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
  • submitted
    13/11/2026, 17:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    debian/rules
  • Size 1KB
  • Sample261113-vs31jad12t
  • SHA256 5404be72e7cfa25f82d6f22eaf109c4f3be14e1d6aa724ce9151eb311fcc0067
  • MD5 SHA1 SHA512 TLSH
Score
3/10
discoveryexecution

Malware Config

Signatures

  • Reads runtime system information 2 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Software Deployment Tools 1 TTPs 1 IoCs

    Use software deployment tools to execute code.

    execution

Processes

  • /tmp/debian/rules
    /tmp/debian/rules
    1⤵
      PID:720
      • /bin/sh
        /bin/sh -e -c "dpkg-parsechangelog -SSource | sed -e s/php-//"
        2⤵
          PID:722
          • /usr/bin/dpkg-parsechangelog
            dpkg-parsechangelog -SSource
            3⤵
            • Software Deployment Tools
            PID:724
            • /usr/local/sbin/tail
              tail -n 40 debian/changelog
              4⤵
                PID:748
              • /usr/local/bin/tail
                tail -n 40 debian/changelog
                4⤵
                  PID:748
                • /usr/sbin/tail
                  tail -n 40 debian/changelog
                  4⤵
                    PID:748
                  • /usr/bin/tail
                    tail -n 40 debian/changelog
                    4⤵
                      PID:748
                  • /bin/sed
                    sed -e s/php-//
                    3⤵
                    • Reads runtime system information
                    PID:725
                • /bin/sh
                  /bin/sh -e -c "ls -1d -*"
                  2⤵
                    PID:749
                    • /bin/ls
                      ls -1d "-*"
                      3⤵
                      • Reads runtime system information
                      PID:750
                  • /bin/sh
                    /bin/sh -e -c "/usr/sbin/phpquery -V"
                    2⤵
                      PID:751
                      • /usr/sbin/phpquery
                        /usr/sbin/phpquery -V
                        3⤵
                          PID:752
                      • /bin/sh
                        /bin/sh -e -c "for v in ; do \\ cp -a /tmp/debian/ /tmp/debian/build-\$v; \\ cd /tmp/debian/build-\$v; \\ phpize\$v; \\ done"
                        2⤵
                          PID:753
                        • /bin/sh
                          /bin/sh -e -c "cd && phpize"
                          2⤵
                            PID:754

                        Network

                              MITRE ATT&CK Enterprise v16

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads