4936c6eb00a2ae750bd75b4a0e63755f7324246ef6fd95921eac77fdd6242aa5

Analysis

max time kernel
0s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
10/08/2026, 18:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
crontab
Size 336B
Sample260810-wyy47seq2z
SHA256 4936c6eb00a2ae750bd75b4a0e63755f7324246ef6fd95921eac77fdd6242aa5
MD5 4cd0dcda8656930c1919ec2ac62cee03
SHA1 a6400ab145c32200bf19bc007a2cd11675e454eb
SHA512 ce0cc56ab4a77a6efb691bbe7b1b38f93e4d1eaa3784c377db383678b8a9c2bf5b6ba454fb6b0260fa306043aece39580f5d6cfd280aa7f2ea76ac15cf320373
TLSH
T17BE02011E1184C266C6B4F596B01EF06368AB5830D88323124E74D19768C346FAD0635
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
651	sh
654	chmod

/tmp/crontab
/tmp/crontab
1⤵
PID:640
- /usr/bin/power
  /usr/bin/power
  2⤵
  PID:643
- /usr/bin/whoami
  whoami
  2⤵
  PID:644
- /bin/sh
  sh -c "/bin/crond > /dev/null 2>&1 &"
  2⤵
  PID:648
- /bin/sh
  sh -c "chmod 755 /bin/mouse > /dev/null 2>&1 &"
  2⤵
  - File and Directory Permissions Modification
  PID:651

/bin/crond
/bin/crond
1⤵
PID:650

/bin/chmod
chmod 755 /bin/mouse
1⤵
- File and Directory Permissions Modification
PID:654

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads