78df2b13a594b70ea98efdcc50598d3ded2ffc2aa807bf95e99db50df5ea7c31 | Triage™

Analysis

max time kernel
0s
max time network
5s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
14/08/2026, 19:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
debian/dvdswitch_readdvd
Size 366B
Sample260814-xtl5hszyhs
SHA256 78df2b13a594b70ea98efdcc50598d3ded2ffc2aa807bf95e99db50df5ea7c31
MD5 3d6a5b37155c1531f3a8a890b9ccd37a
SHA1 2ced500254b7631e6194cf9b8912cb0fe0b6601c
SHA512 2208a992be9c46c8790216d72f8ef462cd8b176a84f920c1834f7c47b15814c649588f2171499c70b269e88d0e063e5a9ebfe76af495cd944e210b32b859dcdd
TLSH
T1DAE0682629DD1A31415E3B62A40E42FD74D96AD1B33DAC046D540C80A425EF9EAE3954
MD5 SHA1 SHA512 TLSH

Score

6^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

description	ioc	Process
File opened for modification	/var/spool/cron/atjobs/.SEQ	at
File opened for modification	/var/spool/cron/atjobs/a0000101c663dc	at

Schedules an At job 1 TTPs 1 IoCs

Schedules a job to be run using the at command.

execution persistence privilege_escalation

At

pid	Process
647	at

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/self/loginuid	at
File opened for reading	/proc/filesystems	mkdir

/tmp/debian/dvdswitch_readdvd
/tmp/debian/dvdswitch_readdvd
1⤵
PID:638
- /bin/rm
  rm -f "\$1/\$2.iso"
  2⤵
  PID:641
- /bin/mkdir
  mkdir -p "\$1/"
  2⤵
  - Reads runtime system information
  PID:643
- /usr/bin/at
  at now
  2⤵
  - Creates/modifies Cron job
  - Schedules an At job
  - Reads runtime system information
  PID:647

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

At

Cron

Persistence

Scheduled Task/Job

At

Cron

Privilege Escalation

Scheduled Task/Job

At

Cron

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

a0000101c663dc

Path /var/spool/cron/atjobs/a0000101c663dc
Size 432B
SHA256 b8818f7a847dfb102fdbe29f93ffa35ff598627812d32d270f6415004e3fb43a
MD5 b8f118797b8cd2536593573f7a933991
SHA1 4aefaf311f6276502bb9791242fcdc492cc1ec72
SHA512 42677853a54d45452a28027e7a467d07d0f9cb1da579190f365144b6c519eaa2dbe859f2617475e7287a432d37212f1aeb749c9753077b18362f5610a16925e1
TLSH
T15DE0A3FDB2D535798659BAE60B19C5CB32CF12022E5D7F4194702279C91439E2547172
MD5 SHA1 SHA512 TLSH

Submit Download