78df2b13a594b70ea98efdcc50598d3ded2ffc2aa807bf95e99db50df5ea7c31 | Triage™

Analysis

max time kernel
0s
max time network
3s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
22/08/2026, 16:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
debian/dvdswitch_readdvd
Size 366B
Sample260822-tkatca1td1
SHA256 78df2b13a594b70ea98efdcc50598d3ded2ffc2aa807bf95e99db50df5ea7c31
MD5 3d6a5b37155c1531f3a8a890b9ccd37a
SHA1 2ced500254b7631e6194cf9b8912cb0fe0b6601c
SHA512 2208a992be9c46c8790216d72f8ef462cd8b176a84f920c1834f7c47b15814c649588f2171499c70b269e88d0e063e5a9ebfe76af495cd944e210b32b859dcdd
TLSH
T1DAE0682629DD1A31415E3B62A40E42FD74D96AD1B33DAC046D540C80A425EF9EAE3954
MD5 SHA1 SHA512 TLSH

Score

6^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

description	ioc	Process
File opened for modification	/var/spool/cron/atjobs/.SEQ	at
File opened for modification	/var/spool/cron/atjobs/a0000101c69028	at

Schedules an At job 1 TTPs 1 IoCs

Schedules a job to be run using the at command.

execution persistence privilege_escalation

At

pid	Process
652	at

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/self/loginuid	at
File opened for reading	/proc/filesystems	mkdir

/tmp/debian/dvdswitch_readdvd
/tmp/debian/dvdswitch_readdvd
1⤵
PID:642
- /bin/rm
  rm -f "\$1/\$2.iso"
  2⤵
  PID:645
- /bin/mkdir
  mkdir -p "\$1/"
  2⤵
  - Reads runtime system information
  PID:648
- /usr/bin/at
  at now
  2⤵
  - Creates/modifies Cron job
  - Schedules an At job
  - Reads runtime system information
  PID:652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

At

Cron

Persistence

Scheduled Task/Job

At

Cron

Privilege Escalation

Scheduled Task/Job

At

Cron

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

a0000101c69028

Path /var/spool/cron/atjobs/a0000101c69028
Size 432B
SHA256 5fd50e314a82d9eb4af7b45871d4bdab28f10de8abd9226a0ffe40735e77e89c
MD5 84f327dcb9aa2fa8b552dbc88a4f10c7
SHA1 87ec2c799ca7e3edcc96a4c55582730a9fd1299f
SHA512 6e3bc650e3fc8419c3da0af721245202afadca5a929cbc53f1a19d002500f5b085b696518de7e3ff825efee5af5b94068b8a580321c6d84e11ab5847ddd75773
TLSH
T149E0A3FDB19536A94225F5E60B1D81CF36DD01012E5C7E4194611235CB5839E3587133
MD5 SHA1 SHA512 TLSH

Submit Download