ae42b081ffafcc000ccc2e3ab4c213962594755c86d7d128a86b764245e8b241

Analysis

max time kernel
1s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
22/08/2026, 17:16

Target
debian/dvdswitch_writedvd
Size 2KB
Sample260822-vtc6haam21
SHA256 ae42b081ffafcc000ccc2e3ab4c213962594755c86d7d128a86b764245e8b241
MD5 b054bf90f89176a51463ac7743d524dd
SHA1 6019d27ae28d83f182f9d60856dbb85ef8b4112b
SHA512 beca59152d49416949b6299c5bb3b569d0166147dcbfd547830e9c0ad778ae758326495a012d5e612faf232d211b88d501f62f0a978b599ffcfd82b8739235c4
TLSH
T11B412106DA94E6B18B65803414C3D42EA60A8B5B4F6F1F65B15CB9683F5872CB1B0AA8
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Reads runtime system information 3 IoCs

Reads data from /proc virtual filesystem.

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/tmp.Z4LYNbITLm	mktemp
File opened for modification	/tmp/tmp.Z4LYNbITLm	dvdswitch_writedvd

/tmp/debian/dvdswitch_writedvd
/tmp/debian/dvdswitch_writedvd
1⤵
- Writes file to tmp directory
PID:711
- /usr/bin/eject
  eject -t /dev/dvd
  2⤵
  PID:715
- /bin/mktemp
  mktemp
  2⤵
  - Writes file to tmp directory
  PID:717
- /bin/grep
  grep "^:-( no media" /tmp/tmp.Z4LYNbITLm
  2⤵
  PID:720
- /bin/grep
  grep "^ Disc status" /tmp/tmp.Z4LYNbITLm
  2⤵
  PID:727
- /usr/bin/cut
  cut -d: -f2
  2⤵
  PID:728
- /bin/sed
  sed -e " s/ //g"
  2⤵
  - Reads runtime system information
  PID:729
- /usr/bin/cut
  cut "-d " -f13
  2⤵
  PID:734
- /bin/grep
  grep "^ Mounted Media" /tmp/tmp.Z4LYNbITLm
  2⤵
  PID:733
- /usr/bin/svdrpsend
  /usr/bin/svdrpsend mesg
  2⤵
  PID:737
- /usr/bin/logger
  logger -t writedvd.sh
  2⤵
  - Reads runtime system information
  PID:738
- /usr/bin/logger
  logger -t writedvd.sh
  2⤵
  - Reads runtime system information
  PID:741
- /bin/rm
  rm -f /tmp/tmp.Z4LYNbITLm
  2⤵
  PID:743
- /usr/bin/eject
  eject /dev/dvd
  2⤵
  PID:744

tmp.Z4LYNbITLm

Path /tmp/tmp.Z4LYNbITLm
Size 96B
SHA256 daa20b749242ecabbe5127c8c22437593572afa87a2b01d17ee0d3bf5bf88f7b
MD5 c5f7b8604217424ba021597a23b451f7
SHA1 7deb55994b0deff1b391fc453a675cb35dea7c1f
SHA512 f3675ece6369aaf30978230a269c00340f46af6b74b994c29d315e9f572673f0d5fd76d691c3460b11d0a349c6c3489d03fe536dcabb020ffb3e697b8dae178b
TLSH
T14EB0127DDB83D353C6130070449ED000480FE5E0CDDEC2E111C21030E35051C8842608
MD5 SHA1 SHA512 TLSH

Submit Download