78df2b13a594b70ea98efdcc50598d3ded2ffc2aa807bf95e99db50df5ea7c31 | Triage™

Analysis

max time kernel
0s
max time network
4s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
22/08/2026, 16:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
debian/dvdswitch_readdvd
Size 366B
Sample260822-tkatca1td1
SHA256 78df2b13a594b70ea98efdcc50598d3ded2ffc2aa807bf95e99db50df5ea7c31
MD5 3d6a5b37155c1531f3a8a890b9ccd37a
SHA1 2ced500254b7631e6194cf9b8912cb0fe0b6601c
SHA512 2208a992be9c46c8790216d72f8ef462cd8b176a84f920c1834f7c47b15814c649588f2171499c70b269e88d0e063e5a9ebfe76af495cd944e210b32b859dcdd
TLSH
T1DAE0682629DD1A31415E3B62A40E42FD74D96AD1B33DAC046D540C80A425EF9EAE3954
MD5 SHA1 SHA512 TLSH

Score

6^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

description	ioc	Process
File opened for modification	/var/spool/cron/atjobs/.SEQ	at
File opened for modification	/var/spool/cron/atjobs/a0000101c69028	at

Schedules an At job 1 TTPs 1 IoCs

Schedules a job to be run using the at command.

execution persistence privilege_escalation

At

pid	Process
723	at

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/self/loginuid	at

/tmp/debian/dvdswitch_readdvd
/tmp/debian/dvdswitch_readdvd
1⤵
PID:715
- /bin/rm
  rm -f "\$1/\$2.iso"
  2⤵
  PID:718
- /bin/mkdir
  mkdir -p "\$1/"
  2⤵
  - Reads runtime system information
  PID:720
- /usr/bin/at
  at now
  2⤵
  - Creates/modifies Cron job
  - Schedules an At job
  - Reads runtime system information
  PID:723

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

At

Cron

Persistence

Scheduled Task/Job

At

Cron

Privilege Escalation

Scheduled Task/Job

At

Cron

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

a0000101c69028

Path /var/spool/cron/atjobs/a0000101c69028
Size 432B
SHA256 488c72ff663352e91dc59f542f3ef225dec63d3ee93a6e16c6aa6d63f6e8b359
MD5 05e1eb992691398f351c359b894689db
SHA1 e176c3cbdb383adc159d193cc944458348ed374f
SHA512 832e5c15e29aa50e92f6996585e289df310a9b391b1ea50d0f348fc88818482bc1536011a3fd828118444c96b278343d514b94a5df639adfaa3375580977f78a
TLSH
T121E0A3FDA2D93A69C216B5E60F19C5CF33D901412E5C3D4194B01336C51439E2587172
MD5 SHA1 SHA512 TLSH

Submit Download