28a173f0fbd53a262bdf7eb328531879013006a65e1b8cddbf223fcfb134be50

Resubmissions

02/08/2026, 16:35

260802-t3p1zscg476

02/08/2026, 12:34

260802-prwl6stajd6

Analysis

user interaction
yes
max time kernel
345s
max time network
482s
platform
debian-12_armhf
resource
debian12-armhf-20260513-en
resource tags

arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
02/08/2026, 12:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TCIi
Size 66KB
Sample260802-prwl6stajd
SHA256 28a173f0fbd53a262bdf7eb328531879013006a65e1b8cddbf223fcfb134be50
MD5 b8bf8223dc458d1730d667c7d790881c
SHA1 c6f500ea8d4ac3877ccc51ca3b7db1e9586d69f7
SHA512 96a4190dc785ece9a6ad9b091c20d920c37c440db793e28cb95762f7aa7510c80c264e7323860ccbedc362ac20a34ef58ba50c71146d94553be9377c651d7f9e
SSDEEP 1536:m2nifqkOsgJJ3QpDjorGn1eYiDjAxDimfPBJBtEpaU:+fZy+2Q8Yi43fPBJBQ
TLSH
T176631A2AF9819F15C5D1167AFE1E534E331327BCE3DE7213EE142B65278B46B0E2A406
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

antivm discovery execution persistence privilege_escalation

Malware Config

Signatures

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/etc/cron.d/crond	TCIi
File opened for modification	/etc/crontab	TCIi

Enumerates running processes
Discovers information about currently running processes on the system

Modifies rc script 2 TTPs 1 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/rc.local	TCIi

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/crond.service	TCIi

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	TCIi

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/36/cmdline	TCIi
File opened for reading	/proc/44/cmdline	TCIi
File opened for reading	/proc/56/cmdline	TCIi
File opened for reading	/proc/857/exe	TCIi
File opened for reading	/proc/26/cmdline	TCIi
File opened for reading	/proc/790/cmdline	TCIi
File opened for reading	/proc/846/exe	TCIi
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/370/cmdline	TCIi
File opened for reading	/proc/734/cmdline	TCIi
File opened for reading	/proc/288/exe	TCIi
File opened for reading	/proc/291/exe	TCIi
File opened for reading	/proc/779/exe	TCIi
File opened for reading	/proc/3/cmdline	TCIi
File opened for reading	/proc/42/cmdline	TCIi
File opened for reading	/proc/212/cmdline	TCIi
File opened for reading	/proc/357/exe	TCIi
File opened for reading	/proc/360/exe	TCIi
File opened for reading	/proc/1/cmdline	TCIi
File opened for reading	/proc/18/cmdline	TCIi
File opened for reading	/proc/642/cmdline	TCIi
File opened for reading	/proc/821/cmdline	TCIi
File opened for reading	/proc/826/exe	TCIi
File opened for reading	/proc/834/exe	TCIi
File opened for reading	/proc/339/exe	TCIi
File opened for reading	/proc/51/cmdline	TCIi
File opened for reading	/proc/728/cmdline	TCIi
File opened for reading	/proc/823/exe	TCIi
File opened for reading	/proc/840/exe	TCIi
File opened for reading	/proc/843/exe	TCIi
File opened for reading	/proc/847/exe	TCIi
File opened for reading	/proc/858/cmdline	TCIi
File opened for reading	/proc/342/exe	TCIi
File opened for reading	/proc/623/exe	TCIi
File opened for reading	/proc/29/cmdline	TCIi
File opened for reading	/proc/200/cmdline	TCIi
File opened for reading	/proc/675/cmdline	TCIi
File opened for reading	/proc/848/cmdline	TCIi
File opened for reading	/proc/855/cmdline	TCIi
File opened for reading	/proc/860/cmdline	TCIi
File opened for reading	/proc/4/cmdline	TCIi
File opened for reading	/proc/57/cmdline	TCIi
File opened for reading	/proc/342/cmdline	TCIi
File opened for reading	/proc/623/cmdline	TCIi
File opened for reading	/proc/789/cmdline	TCIi
File opened for reading	/proc/825/cmdline	TCIi
File opened for reading	/proc/841/cmdline	TCIi
File opened for reading	/proc/6/cmdline	TCIi
File opened for reading	/proc/772/cmdline	TCIi
File opened for reading	/proc/832/cmdline	TCIi
File opened for reading	/proc/836/cmdline	TCIi
File opened for reading	/proc/831/cmdline	TCIi
File opened for reading	/proc/864/cmdline	TCIi
File opened for reading	/proc/5/cmdline	TCIi
File opened for reading	/proc/13/cmdline	TCIi
File opened for reading	/proc/32/cmdline	TCIi
File opened for reading	/proc/198/cmdline	TCIi
File opened for reading	/proc/368/cmdline	TCIi
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/838/cmdline	TCIi
File opened for reading	/proc/841/exe	TCIi
File opened for reading	/proc/731/exe	TCIi
File opened for reading	/proc/20/cmdline	TCIi
File opened for reading	/proc/839/exe	TCIi

/tmp/TCIi
/tmp/TCIi
1⤵
- Creates/modifies Cron job
- Modifies rc script
- Modifies systemd
- Checks CPU configuration
- Reads runtime system information
PID:788
- /usr/local/sbin/systemctl
  systemctl daemon-reload
  2⤵
  PID:811
- /usr/local/sbin/systemctl
  systemctl enable crond.service
  2⤵
  PID:812
- /usr/local/bin/systemctl
  systemctl daemon-reload
  2⤵
  PID:811
- /usr/local/bin/systemctl
  systemctl enable crond.service
  2⤵
  PID:812
- /usr/sbin/systemctl
  systemctl enable crond.service
  2⤵
  PID:812
- /usr/sbin/systemctl
  systemctl daemon-reload
  2⤵
  PID:811
- /usr/bin/systemctl
  systemctl daemon-reload
  2⤵
  - Reads runtime system information
  PID:811
- /usr/local/sbin/chattr
  chattr +i /data/crond
  2⤵
  PID:856
- /usr/local/sbin/chattr
  chattr +i /home/crond
  2⤵
  PID:857
- /usr/local/sbin/chattr
  chattr +i /var/crond
  2⤵
  PID:855
- /usr/local/sbin/chattr
  chattr +i /usr/local/sbin/crond
  2⤵
  PID:854
- /usr/local/bin/chattr
  chattr +i /home/crond
  2⤵
  PID:857
- /usr/local/bin/chattr
  chattr +i /var/crond
  2⤵
  PID:855
- /usr/local/bin/chattr
  chattr +i /data/crond
  2⤵
  PID:856
- /usr/local/bin/chattr
  chattr +i /usr/local/sbin/crond
  2⤵
  PID:854
- /usr/sbin/chattr
  chattr +i /home/crond
  2⤵
  PID:857
- /usr/local/sbin/chattr
  chattr +i /mnt/flash/crond
  2⤵
  PID:858
- /usr/sbin/chattr
  chattr +i /var/crond
  2⤵
  PID:855
- /usr/sbin/chattr
  chattr +i /data/crond
  2⤵
  PID:856
- /usr/sbin/chattr
  chattr +i /usr/local/sbin/crond
  2⤵
  PID:854
- /usr/bin/chattr
  chattr +i /home/crond
  2⤵
  PID:857
- /usr/bin/chattr
  chattr +i /data/crond
  2⤵
  PID:856
- /usr/local/bin/chattr
  chattr +i /mnt/flash/crond
  2⤵
  PID:858
- /usr/bin/chattr
  chattr +i /usr/local/sbin/crond
  2⤵
  PID:854
- /usr/sbin/chattr
  chattr +i /mnt/flash/crond
  2⤵
  PID:858
- /usr/bin/chattr
  chattr +i /var/crond
  2⤵
  PID:855
- /usr/local/sbin/chattr
  chattr +i /root/crond
  2⤵
  PID:859
- /usr/local/bin/chattr
  chattr +i /root/crond
  2⤵
  PID:859
- /usr/bin/chattr
  chattr +i /mnt/flash/crond
  2⤵
  PID:858
- /usr/local/sbin/chattr
  chattr +i /etc/crond
  2⤵
  PID:860
- /usr/sbin/chattr
  chattr +i /root/crond
  2⤵
  PID:859
- /usr/local/bin/chattr
  chattr +i /etc/crond
  2⤵
  PID:860
- /usr/bin/chattr
  chattr +i /root/crond
  2⤵
  PID:859
- /usr/local/sbin/chattr
  chattr +i //crond
  2⤵
  PID:861
- /usr/sbin/chattr
  chattr +i /etc/crond
  2⤵
  PID:860
- /usr/bin/chattr
  chattr +i /etc/crond
  2⤵
  PID:860
- /usr/local/bin/chattr
  chattr +i //crond
  2⤵
  PID:861
- /usr/local/sbin/chattr
  chattr +i /var/lib/crond
  2⤵
  PID:862
- /usr/sbin/chattr
  chattr +i //crond
  2⤵
  PID:861
- /usr/bin/chattr
  chattr +i //crond
  2⤵
  PID:861
- /usr/local/bin/chattr
  chattr +i /var/lib/crond
  2⤵
  PID:862
- /usr/local/sbin/chattr
  chattr +i /var/spool/crond
  2⤵
  PID:863
- /usr/sbin/chattr
  chattr +i /var/lib/crond
  2⤵
  PID:862
- /usr/local/bin/chattr
  chattr +i /var/spool/crond
  2⤵
  PID:863
- /usr/local/sbin/chattr
  chattr +i /var/cache/crond
  2⤵
  PID:864
- /usr/sbin/chattr
  chattr +i /var/spool/crond
  2⤵
  PID:863
- /usr/bin/chattr
  chattr +i /var/spool/crond
  2⤵
  PID:863
- /usr/local/bin/chattr
  chattr +i /var/cache/crond
  2⤵
  PID:864
- /usr/local/sbin/chattr
  chattr +i /var/backups/crond
  2⤵
  PID:865
- /usr/sbin/chattr
  chattr +i /var/cache/crond
  2⤵
  PID:864
- /usr/local/bin/chattr
  chattr +i /var/backups/crond
  2⤵
  PID:865
- /usr/local/sbin/chattr
  chattr +i /data/local/crond
  2⤵
  PID:866
- /usr/sbin/chattr
  chattr +i /var/backups/crond
  2⤵
  PID:865
- /usr/bin/chattr
  chattr +i /var/cache/crond
  2⤵
  PID:864
- /usr/bin/chattr
  chattr +i /var/backups/crond
  2⤵
  PID:865
- /usr/local/sbin/chattr
  chattr +i /data/misc/crond
  2⤵
  PID:867
- /usr/local/bin/chattr
  chattr +i /data/local/crond
  2⤵
  PID:866
- /usr/bin/chattr
  chattr +i /var/lib/crond
  2⤵
  PID:862
- /usr/sbin/chattr
  chattr +i /data/local/crond
  2⤵
  PID:866
- /usr/local/bin/chattr
  chattr +i /data/misc/crond
  2⤵
  PID:867
- /usr/local/sbin/chattr
  chattr +i /home/root/crond
  2⤵
  PID:868
- /usr/bin/chattr
  chattr +i /data/local/crond
  2⤵
  PID:866
- /usr/sbin/chattr
  chattr +i /data/misc/crond
  2⤵
  PID:867
- /usr/local/bin/chattr
  chattr +i /home/root/crond
  2⤵
  PID:868
- /usr/local/sbin/chattr
  chattr +i /home/admin/crond
  2⤵
  PID:869
- /usr/sbin/chattr
  chattr +i /home/root/crond
  2⤵
  PID:868
- /usr/local/bin/chattr
  chattr +i /home/admin/crond
  2⤵
  PID:869
- /usr/local/sbin/chattr
  chattr +i /mnt/flash/data/crond
  2⤵
  PID:870
- /usr/bin/chattr
  chattr +i /data/misc/crond
  2⤵
  PID:867
- /usr/local/sbin/chattr
  chattr +i /usr/local/bin/crond
  2⤵
  PID:871
- /usr/sbin/chattr
  chattr +i /home/admin/crond
  2⤵
  PID:869
- /usr/bin/chattr
  chattr +i /home/root/crond
  2⤵
  PID:868
- /usr/local/bin/chattr
  chattr +i /mnt/flash/data/crond
  2⤵
  PID:870
- /usr/sbin/chattr
  chattr +i /mnt/flash/data/crond
  2⤵
  PID:870
- /usr/local/bin/chattr
  chattr +i /usr/local/bin/crond
  2⤵
  PID:871
- /usr/local/sbin/chattr
  chattr +i /opt/crond
  2⤵
  PID:872
- /usr/sbin/chattr
  chattr +i /usr/local/bin/crond
  2⤵
  PID:871
- /usr/bin/chattr
  chattr +i /home/admin/crond
  2⤵
  PID:869
- /usr/local/sbin/chattr
  chattr +i /srv/crond
  2⤵
  PID:873
- /usr/bin/chattr
  chattr +i /usr/local/bin/crond
  2⤵
  PID:871
- /usr/bin/chattr
  chattr +i /mnt/flash/data/crond
  2⤵
  PID:870
- /usr/local/bin/chattr
  chattr +i /opt/crond
  2⤵
  PID:872
- /usr/local/bin/chattr
  chattr +i /srv/crond
  2⤵
  PID:873
- /usr/sbin/chattr
  chattr +i /opt/crond
  2⤵
  PID:872
- /usr/local/sbin/systemctl
  systemctl stop crond.service
  2⤵
  PID:874
- /usr/sbin/chattr
  chattr +i /srv/crond
  2⤵
  PID:873
- /usr/bin/chattr
  chattr +i /opt/crond
  2⤵
  PID:872
- /usr/local/sbin/systemctl
  systemctl disable crond.service
  2⤵
  PID:875
- /usr/bin/chattr
  chattr +i /srv/crond
  2⤵
  PID:873
- /usr/local/bin/systemctl
  systemctl stop crond.service
  2⤵
  PID:874
- /usr/local/bin/systemctl
  systemctl disable crond.service
  2⤵
  PID:875
- /usr/sbin/systemctl
  systemctl stop crond.service
  2⤵
  PID:874
- /usr/sbin/systemctl
  systemctl disable crond.service
  2⤵
  PID:875
- /usr/bin/systemctl
  systemctl disable crond.service
  2⤵
  PID:875
- /usr/bin/systemctl
  systemctl stop crond.service
  2⤵
  PID:874
- /usr/local/sbin/systemctl
  systemctl daemon-reload
  2⤵
  PID:876
- /usr/local/bin/systemctl
  systemctl daemon-reload
  2⤵
  PID:876

/usr/bin/systemctl
systemctl enable crond.service
1⤵
PID:812

/usr/sbin/systemctl
systemctl daemon-reload
1⤵
PID:876

/usr/bin/systemctl
systemctl daemon-reload
1⤵
- Reads runtime system information
PID:876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

crond

Path /etc/cron.d/crond
Size 26B
SHA256 bd927e9740f0e3a2902e0d9dc09e65cba7e1583d384385be79671d8544051674
MD5 1635803dbb42c93ef281c62ad4a5819f
SHA1 095622d75e96abd520955ec75c1e22dfcfeda034
SHA512 9dfbf73e07d606a05679f13fc7b8898c8a617651477b90cf75c3cb8fd7ce7ddfa6e32a0fc874fe249f4f1150d14d8317dacaad00752a1ca29e38a059540a8e4c
MD5 SHA1 SHA512

Submit Download

rc.local

Path /etc/rc.local
Size 10B
SHA256 a8076d3d28d21e02012b20eaf7dbf75409a6277134439025f282e368e3305abf
MD5 3e2b31c72181b87149ff995e7202c0e3
SHA1 bd971bec88149956458a10fc9c5ecb3eb99dd452
SHA512 543f39af1ae7a2382ed869cbd1ee1ac598a88eb4e213cd64487c54b5c37722c6207ee6db4fa7e2ed53064259a44115c6da7bbc8c068378bb52a25e7088eeebd6
MD5 SHA1 SHA512

Submit Download

rc.local

Path /etc/rc.local
Size 30B
SHA256 dc98315344bfaadad84118bad17cf15440294d587867ea719ef7d93f49e28ab3
MD5 4ae7e946eb4a81f25d10dcbd667a645c
SHA1 294d855e262d1045fc6dbbb5b9e7a7cb29e42f5f
SHA512 76c8063107c7df647390eafa8b3a804317298541b1c9f511921a940b9959e8dd43d055e15e9bbafa1a305204e171b3b31f9c20d2f75900072db0963b6827b9ff
MD5 SHA1 SHA512

Submit Download

crond.service

Path /etc/systemd/system/crond.service
Size 189B
SHA256 6381e08a5b8808bafb1df384f5caeefb537cea7c7c02d17618f1dc01dac37335
MD5 dcc29015ff220c4be3ee3dbf82614679
SHA1 9ea3cc2b6f8e4f7adebaa015953fa006bf7c2979
SHA512 2903657c5b7e3a18ab68f7cfcdd3b7a4c1b018d20446023c03c9306517600bfa2d983fd7224fcd445b8cd3a0cd917bb0cfac53b5fea2848f8f2bf60ed5da5bc6
TLSH
T125C02223942114A08D4F39A2AEA62B448CA202010ACFA2B00BC019291EE24E752218AE
MD5 SHA1 SHA512 TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads