ae42b081ffafcc000ccc2e3ab4c213962594755c86d7d128a86b764245e8b241

Analysis

max time kernel
1s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
22/08/2026, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
debian/dvdswitch_writedvd
Size 2KB
Sample260822-vtc6haam21
SHA256 ae42b081ffafcc000ccc2e3ab4c213962594755c86d7d128a86b764245e8b241
MD5 b054bf90f89176a51463ac7743d524dd
SHA1 6019d27ae28d83f182f9d60856dbb85ef8b4112b
SHA512 beca59152d49416949b6299c5bb3b569d0166147dcbfd547830e9c0ad778ae758326495a012d5e612faf232d211b88d501f62f0a978b599ffcfd82b8739235c4
TLSH
T11B412106DA94E6B18B65803414C3D42EA60A8B5B4F6F1F65B15CB9683F5872CB1B0AA8
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads runtime system information 3 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	logger
File opened for reading	/proc/filesystems	logger

System Network Configuration Discovery 1 TTPs 4 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
726	grep
730	grep
735	grep
746	rm

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/tmp.X0HIPqrXXQ	mktemp
File opened for modification	/tmp/tmp.X0HIPqrXXQ	dvdswitch_writedvd

/tmp/debian/dvdswitch_writedvd
/tmp/debian/dvdswitch_writedvd
1⤵
- Writes file to tmp directory
PID:715
- /usr/bin/eject
  eject -t /dev/dvd
  2⤵
  PID:717
- /bin/mktemp
  mktemp
  2⤵
  - Writes file to tmp directory
  PID:722
- /bin/grep
  grep "^:-( no media" /tmp/tmp.X0HIPqrXXQ
  2⤵
  - System Network Configuration Discovery
  PID:726
- /usr/bin/cut
  cut -d: -f2
  2⤵
  PID:731
- /bin/grep
  grep "^ Disc status" /tmp/tmp.X0HIPqrXXQ
  2⤵
  - System Network Configuration Discovery
  PID:730
- /bin/sed
  sed -e " s/ //g"
  2⤵
  - Reads runtime system information
  PID:732
- /usr/bin/cut
  cut "-d " -f13
  2⤵
  PID:736
- /bin/grep
  grep "^ Mounted Media" /tmp/tmp.X0HIPqrXXQ
  2⤵
  - System Network Configuration Discovery
  PID:735
- /usr/bin/svdrpsend
  /usr/bin/svdrpsend mesg
  2⤵
  PID:739
- /usr/bin/logger
  logger -t writedvd.sh
  2⤵
  - Reads runtime system information
  PID:741
- /usr/bin/logger
  logger -t writedvd.sh
  2⤵
  - Reads runtime system information
  PID:743
- /bin/rm
  rm -f /tmp/tmp.X0HIPqrXXQ
  2⤵
  - System Network Configuration Discovery
  PID:746
- /usr/bin/eject
  eject /dev/dvd
  2⤵
  PID:747

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp.X0HIPqrXXQ

Path /tmp/tmp.X0HIPqrXXQ
Size 96B
SHA256 daa20b749242ecabbe5127c8c22437593572afa87a2b01d17ee0d3bf5bf88f7b
MD5 c5f7b8604217424ba021597a23b451f7
SHA1 7deb55994b0deff1b391fc453a675cb35dea7c1f
SHA512 f3675ece6369aaf30978230a269c00340f46af6b74b994c29d315e9f572673f0d5fd76d691c3460b11d0a349c6c3489d03fe536dcabb020ffb3e697b8dae178b
TLSH
T14EB0127DDB83D353C6130070449ED000480FE5E0CDDEC2E111C21030E35051C8842608
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads