5951d9a2f554cd5dedc641ca1fb9ca3b2bbb67531e2775bcc92661dd375cdf52

Analysis

max time kernel
1s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
13/11/2026, 18:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
debian/rules
Size 462B
Sample261113-wsjsbsev6w
SHA256 5951d9a2f554cd5dedc641ca1fb9ca3b2bbb67531e2775bcc92661dd375cdf52
MD5 41da9bb800e5185e6d7b983e8bbe0daf
SHA1 b07b7832c47d8540acec26aa33f58fece5ccb7cc
SHA512 207522cb554b114e3f0de9cb9bd9c237648abd54417550b2cf2bf38d048fe5eb142a1fa6f82df410522fc2c431bfee111090e63e2f29863a93651a56f4be684b
TLSH
T156F02774CB25ACE501CDE5193B710290EAB3D1B9AAEC355361E80B366A4230880B75A0
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: Unix Shell 1 TTPs 1 IoCs

Execute scripts via Unix Shell.

execution

Unix Shell

T1059.004

pid	Process
650	sh

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/fd	pybuild

/tmp/debian/rules
/tmp/debian/rules
1⤵
PID:644
- /bin/sh
  /bin/sh -c "CI=true pybuild --test --test-nose"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:650
- - /usr/bin/pybuild
    pybuild --test --test-nose
    3⤵
    - Reads runtime system information
    PID:653
  - - /usr/local/sbin/which
      which cmake
      4⤵
      PID:671
  - - /usr/local/bin/which
      which cmake
      4⤵
      PID:671
  - - /usr/sbin/which
      which cmake
      4⤵
      PID:671
  - - /usr/bin/which
      which cmake
      4⤵
      PID:671

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Unix Shell

T1059.004

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads