7f186d825e5100e13ec97849b788e0af60597ed85bad3624e980753fb421f0e2

Analysis

max time kernel
9s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
13/11/2026, 18:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
debian/rules
Size 559B
Sample261113-wr1z8aev3x
SHA256 7f186d825e5100e13ec97849b788e0af60597ed85bad3624e980753fb421f0e2
MD5 0dd4559818a85729f54ee8cbbac1719b
SHA1 da8e3c32b2d89d93257dbe8ec652fd35fbc96c27
SHA512 1bf9ab11e71789ac2937d7564984a4e77a2fad49a95a6a1eb7cd90e7f2ea14d84b09f0f2d75c328b1f157b8ef95e053f5ef065f958490ca8628b898c82efba16
TLSH
T1D3F08116D13884FA980649515302179635DD10F9CDED3513B3DD0F14628998BA1C7E95
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: Unix Shell 1 TTPs 9 IoCs

Execute scripts via Unix Shell.

execution

Unix Shell

T1059.004

pid	Process
700	sh
731	sh
745	sh
767	sh
787	sh
680	sh
684	sh
741	sh
783	sh

Software Deployment Tools 1 TTPs 9 IoCs

Use software deployment tools to execute code.

execution

Software Deployment Tools

T1072

pid	Process
746	dpkg-buildflags
768	dpkg-buildflags
788	dpkg-buildflags
742	dpkg-buildflags
784	dpkg-buildflags
681	dpkg-buildflags
685	dpkg-buildflags
702	dpkg-buildflags
733	dpkg-buildflags

/tmp/debian/rules
/tmp/debian/rules
1⤵
PID:652
- /usr/local/sbin/dpkg-architecture
  dpkg-architecture -qDEB_HOST_ARCH
  2⤵
  PID:657
- /usr/local/bin/dpkg-architecture
  dpkg-architecture -qDEB_HOST_ARCH
  2⤵
  PID:657
- /usr/sbin/dpkg-architecture
  dpkg-architecture -qDEB_HOST_ARCH
  2⤵
  PID:657
- /usr/bin/dpkg-architecture
  dpkg-architecture -qDEB_HOST_ARCH
  2⤵
  PID:657
- - /usr/local/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:679
- - /usr/local/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:679
- - /usr/sbin/gcc
    gcc -dumpmachine
    3⤵
    PID:679
- - /usr/bin/gcc
    gcc -dumpmachine
    3⤵
    PID:679
- /bin/sh
  /bin/sh -c "DEB_BUILD_MAINT_OPTIONS=\"hardening=+all\" dpkg-buildflags --get OBJCXXFLAGS"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:680
- - /usr/bin/dpkg-buildflags
    dpkg-buildflags --get OBJCXXFLAGS
    3⤵
    - Software Deployment Tools
    PID:681
  - - /bin/pwd
      /bin/pwd
      4⤵
      PID:682
  - - /usr/local/sbin/gcc
      gcc -dumpmachine
      4⤵
      PID:683
  - - /usr/local/bin/gcc
      gcc -dumpmachine
      4⤵
      PID:683
  - - /usr/sbin/gcc
      gcc -dumpmachine
      4⤵
      PID:683
  - - /usr/bin/gcc
      gcc -dumpmachine
      4⤵
      PID:683
- /bin/sh
  /bin/sh -c "DEB_BUILD_MAINT_OPTIONS=\"hardening=+all\" dpkg-buildflags --get CPPFLAGS"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:684
- - /usr/bin/dpkg-buildflags
    dpkg-buildflags --get CPPFLAGS
    3⤵
    - Software Deployment Tools
    PID:685
  - - /bin/pwd
      /bin/pwd
      4⤵
      PID:696
  - - /usr/local/sbin/gcc
      gcc -dumpmachine
      4⤵
      PID:697
  - - /usr/local/bin/gcc
      gcc -dumpmachine
      4⤵
      PID:697
  - - /usr/sbin/gcc
      gcc -dumpmachine
      4⤵
      PID:697
  - - /usr/bin/gcc
      gcc -dumpmachine
      4⤵
      PID:697
- /bin/sh
  /bin/sh -c "DEB_BUILD_MAINT_OPTIONS=\"hardening=+all\" dpkg-buildflags --get GCJFLAGS"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:700
- - /usr/bin/dpkg-buildflags
    dpkg-buildflags --get GCJFLAGS
    3⤵
    - Software Deployment Tools
    PID:702
  - - /bin/pwd
      /bin/pwd
      4⤵
      PID:725
  - - /usr/local/sbin/gcc
      gcc -dumpmachine
      4⤵
      PID:728
  - - /usr/local/bin/gcc
      gcc -dumpmachine
      4⤵
      PID:728
  - - /usr/sbin/gcc
      gcc -dumpmachine
      4⤵
      PID:728
  - - /usr/bin/gcc
      gcc -dumpmachine
      4⤵
      PID:728
- /bin/sh
  /bin/sh -c "DEB_BUILD_MAINT_OPTIONS=\"hardening=+all\" dpkg-buildflags --get CFLAGS"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:731
- - /usr/bin/dpkg-buildflags
    dpkg-buildflags --get CFLAGS
    3⤵
    - Software Deployment Tools
    PID:733
  - - /bin/pwd
      /bin/pwd
      4⤵
      PID:739
  - - /usr/local/sbin/gcc
      gcc -dumpmachine
      4⤵
      PID:740
  - - /usr/local/bin/gcc
      gcc -dumpmachine
      4⤵
      PID:740
  - - /usr/sbin/gcc
      gcc -dumpmachine
      4⤵
      PID:740
  - - /usr/bin/gcc
      gcc -dumpmachine
      4⤵
      PID:740
- /bin/sh
  /bin/sh -c "DEB_BUILD_MAINT_OPTIONS=\"hardening=+all\" dpkg-buildflags --get CXXFLAGS"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:741
- - /usr/bin/dpkg-buildflags
    dpkg-buildflags --get CXXFLAGS
    3⤵
    - Software Deployment Tools
    PID:742
  - - /bin/pwd
      /bin/pwd
      4⤵
      PID:743
  - - /usr/local/sbin/gcc
      gcc -dumpmachine
      4⤵
      PID:744
  - - /usr/local/bin/gcc
      gcc -dumpmachine
      4⤵
      PID:744
  - - /usr/sbin/gcc
      gcc -dumpmachine
      4⤵
      PID:744
  - - /usr/bin/gcc
      gcc -dumpmachine
      4⤵
      PID:744
- /bin/sh
  /bin/sh -c "DEB_BUILD_MAINT_OPTIONS=\"hardening=+all\" dpkg-buildflags --get FFLAGS"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:745
- - /usr/bin/dpkg-buildflags
    dpkg-buildflags --get FFLAGS
    3⤵
    - Software Deployment Tools
    PID:746
  - - /bin/pwd
      /bin/pwd
      4⤵
      PID:762
  - - /usr/local/sbin/gcc
      gcc -dumpmachine
      4⤵
      PID:764
  - - /usr/local/bin/gcc
      gcc -dumpmachine
      4⤵
      PID:764
  - - /usr/sbin/gcc
      gcc -dumpmachine
      4⤵
      PID:764
  - - /usr/bin/gcc
      gcc -dumpmachine
      4⤵
      PID:764
- /bin/sh
  /bin/sh -c "DEB_BUILD_MAINT_OPTIONS=\"hardening=+all\" dpkg-buildflags --get LDFLAGS"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:767
- - /usr/bin/dpkg-buildflags
    dpkg-buildflags --get LDFLAGS
    3⤵
    - Software Deployment Tools
    PID:768
  - - /bin/pwd
      /bin/pwd
      4⤵
      PID:781
  - - /usr/local/sbin/gcc
      gcc -dumpmachine
      4⤵
      PID:782
  - - /usr/local/bin/gcc
      gcc -dumpmachine
      4⤵
      PID:782
  - - /usr/sbin/gcc
      gcc -dumpmachine
      4⤵
      PID:782
  - - /usr/bin/gcc
      gcc -dumpmachine
      4⤵
      PID:782
- /bin/sh
  /bin/sh -c "DEB_BUILD_MAINT_OPTIONS=\"hardening=+all\" dpkg-buildflags --get FCFLAGS"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:783
- - /usr/bin/dpkg-buildflags
    dpkg-buildflags --get FCFLAGS
    3⤵
    - Software Deployment Tools
    PID:784
  - - /bin/pwd
      /bin/pwd
      4⤵
      PID:785
  - - /usr/local/sbin/gcc
      gcc -dumpmachine
      4⤵
      PID:786
  - - /usr/local/bin/gcc
      gcc -dumpmachine
      4⤵
      PID:786
  - - /usr/sbin/gcc
      gcc -dumpmachine
      4⤵
      PID:786
  - - /usr/bin/gcc
      gcc -dumpmachine
      4⤵
      PID:786
- /bin/sh
  /bin/sh -c "DEB_BUILD_MAINT_OPTIONS=\"hardening=+all\" dpkg-buildflags --get OBJCFLAGS"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:787
- - /usr/bin/dpkg-buildflags
    dpkg-buildflags --get OBJCFLAGS
    3⤵
    - Software Deployment Tools
    PID:788
  - - /bin/pwd
      /bin/pwd
      4⤵
      PID:789
  - - /usr/local/sbin/gcc
      gcc -dumpmachine
      4⤵
      PID:790
  - - /usr/local/bin/gcc
      gcc -dumpmachine
      4⤵
      PID:790
  - - /usr/sbin/gcc
      gcc -dumpmachine
      4⤵
      PID:790
  - - /usr/bin/gcc
      gcc -dumpmachine
      4⤵
      PID:790
- /usr/bin/yorick
  /usr/bin/yorick -batch make.i
  2⤵
  PID:791

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Unix Shell

T1059.004

Software Deployment Tools

T1072

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Software Deployment Tools

T1072

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads