ae42b081ffafcc000ccc2e3ab4c213962594755c86d7d128a86b764245e8b241

Analysis

max time kernel
0s
max time network
130s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
22/08/2026, 17:16

Target
debian/dvdswitch_writedvd
Size 2KB
Sample260822-vtc6haam21
SHA256 ae42b081ffafcc000ccc2e3ab4c213962594755c86d7d128a86b764245e8b241
MD5 b054bf90f89176a51463ac7743d524dd
SHA1 6019d27ae28d83f182f9d60856dbb85ef8b4112b
SHA512 beca59152d49416949b6299c5bb3b569d0166147dcbfd547830e9c0ad778ae758326495a012d5e612faf232d211b88d501f62f0a978b599ffcfd82b8739235c4
TLSH
T11B412106DA94E6B18B65803414C3D42EA60A8B5B4F6F1F65B15CB9683F5872CB1B0AA8
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/filesystems	sed

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/tmp.vV48l0eQ4b	dvdswitch_writedvd
File opened for modification	/tmp/tmp.vV48l0eQ4b	mktemp

/tmp/debian/dvdswitch_writedvd
/tmp/debian/dvdswitch_writedvd
1⤵
- Writes file to tmp directory
PID:1489
- /usr/bin/eject
  eject -t /dev/dvd
  2⤵
  PID:1490
- /bin/mktemp
  mktemp
  2⤵
  - Writes file to tmp directory
  PID:1491
- /bin/grep
  grep "^:-( no media" /tmp/tmp.vV48l0eQ4b
  2⤵
  PID:1492
- /bin/grep
  grep "^ Disc status" /tmp/tmp.vV48l0eQ4b
  2⤵
  PID:1495
- /bin/sed
  sed -e " s/ //g"
  2⤵
  - Reads runtime system information
  PID:1498
- /usr/bin/cut
  cut -d: -f2
  2⤵
  PID:1497
- /usr/bin/cut
  cut "-d " -f13
  2⤵
  PID:1501
- /bin/grep
  grep "^ Mounted Media" /tmp/tmp.vV48l0eQ4b
  2⤵
  PID:1500
- /usr/bin/svdrpsend
  /usr/bin/svdrpsend mesg
  2⤵
  PID:1502
- /usr/bin/logger
  logger -t writedvd.sh
  2⤵
  PID:1503
- /usr/bin/logger
  logger -t writedvd.sh
  2⤵
  PID:1504
- /bin/rm
  rm -f /tmp/tmp.vV48l0eQ4b
  2⤵
  PID:1505
- /usr/bin/eject
  eject /dev/dvd
  2⤵
  PID:1506

tmp.vV48l0eQ4b

Path /tmp/tmp.vV48l0eQ4b
Size 96B
SHA256 daa20b749242ecabbe5127c8c22437593572afa87a2b01d17ee0d3bf5bf88f7b
MD5 c5f7b8604217424ba021597a23b451f7
SHA1 7deb55994b0deff1b391fc453a675cb35dea7c1f
SHA512 f3675ece6369aaf30978230a269c00340f46af6b74b994c29d315e9f572673f0d5fd76d691c3460b11d0a349c6c3489d03fe536dcabb020ffb3e697b8dae178b
TLSH
T14EB0127DDB83D353C6130070449ED000480FE5E0CDDEC2E111C21030E35051C8842608
MD5 SHA1 SHA512 TLSH

Submit Download