78df2b13a594b70ea98efdcc50598d3ded2ffc2aa807bf95e99db50df5ea7c31 | Triage™

Analysis

max time kernel
0s
max time network
4s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
22/08/2026, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
debian/dvdswitch_readdvd
Size 366B
Sample260822-vtc6haam21
SHA256 78df2b13a594b70ea98efdcc50598d3ded2ffc2aa807bf95e99db50df5ea7c31
MD5 3d6a5b37155c1531f3a8a890b9ccd37a
SHA1 2ced500254b7631e6194cf9b8912cb0fe0b6601c
SHA512 2208a992be9c46c8790216d72f8ef462cd8b176a84f920c1834f7c47b15814c649588f2171499c70b269e88d0e063e5a9ebfe76af495cd944e210b32b859dcdd
TLSH
T1DAE0682629DD1A31415E3B62A40E42FD74D96AD1B33DAC046D540C80A425EF9EAE3954
MD5 SHA1 SHA512 TLSH

Score

6^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

description	ioc	Process
File opened for modification	/var/spool/cron/atjobs/.SEQ	at
File opened for modification	/var/spool/cron/atjobs/a0000101c6906d	at

Schedules an At job 1 TTPs 1 IoCs

Schedules a job to be run using the at command.

execution persistence privilege_escalation

At

pid	Process
724	at

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/self/loginuid	at

/tmp/debian/dvdswitch_readdvd
/tmp/debian/dvdswitch_readdvd
1⤵
PID:718
- /bin/rm
  rm -f "\$1/\$2.iso"
  2⤵
  PID:720
- /bin/mkdir
  mkdir -p "\$1/"
  2⤵
  - Reads runtime system information
  PID:722
- /usr/bin/at
  at now
  2⤵
  - Creates/modifies Cron job
  - Schedules an At job
  - Reads runtime system information
  PID:724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

At

Cron

Persistence

Scheduled Task/Job

At

Cron

Privilege Escalation

Scheduled Task/Job

At

Cron

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

a0000101c6906d

Path /var/spool/cron/atjobs/a0000101c6906d
Size 432B
SHA256 aac2492a01ebe5fe1d88f36710769213615e1578ce1fe29adbe6e8330007ae4d
MD5 593418ba62cbc906e2be762cbc5cff93
SHA1 ddf822d3195431d266e65347d32ba66f8ba3e13b
SHA512 9d308c75e4d584c19aaa3acf35a43797046870769d8a210fce84a5553e89101f9c7d261015007f34128705873c4bf9b48b4d61a9100b1794f81bcec05c978d71
TLSH
T157E0A3FDA2A539698215F9E50B2DC5CB37C901412F9C7E8AD8751275CA1539E258B022
MD5 SHA1 SHA512 TLSH

Submit Download