2d0f8c2543d02622bbcf5b3ad1a29d643febe42d4d426e12ba8239a7bb5a369f

Analysis

max time kernel
1s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20261019-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20261019-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
13/11/2026, 01:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
debian/scripts/install-css.sh
Size 3KB
Sample261113-brvszset7s
SHA256 2d0f8c2543d02622bbcf5b3ad1a29d643febe42d4d426e12ba8239a7bb5a369f
MD5 cb03eac8a3b3fc1befac69e38116cb9e
SHA1 8246127db877994baee38516a0ff33369d3893d4
SHA512 251a5be9248e3ae2594dbf6f43c20e76b33b45b98b8b935adae798da96a2bea337d8ec549ae90a24e3158d56224ae762180ffaee398517cefe6454d13c24893a
TLSH
T1176162E9EDD1C57034D0C22B7311E145E31B4037DAA92A2835AE427C0B1C985A6BFB67
MD5 SHA1 SHA512 TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

ioc	pid	Process
/var/lib/dpkg/info/libdvdcss2.postinst	1535	dpkg

Reads runtime system information 4 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	tar

System Information Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the system, such as OS, hostname, and hardware details.

discovery

System Information Discovery

T1082

pid	Process
1510	lsb_release

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1508	install-css.sh

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/dvdcss-DOj94y/Packages	wget
File opened for modification	/tmp/dvdcss-DOj94y/libdvdcss.deb	wget

Software Deployment Tools 1 TTPs 1 IoCs

Use software deployment tools to execute code.

execution

Software Deployment Tools

T1072

pid	Process
1537	dpkg-trigger

/tmp/debian/scripts/install-css.sh
/tmp/debian/scripts/install-css.sh
1⤵
- System Network Configuration Discovery
PID:1508
- /usr/bin/dpkg
  dpkg --print-architecture
  2⤵
  - Reads runtime system information
  PID:1509
- /usr/bin/lsb_release
  lsb_release -cs
  2⤵
  - System Information Discovery
  PID:1510
- /bin/mktemp
  mktemp -t -d dvdcss-XXXXXX
  2⤵
  PID:1516
- /usr/bin/wget
  wget http://download.videolan.org/pub/debian/stable//Packages -O /tmp/dvdcss-DOj94y/Packages
  2⤵
  - Writes file to tmp directory
  PID:1518
- /bin/sed
  sed "s/Filename: //"
  2⤵
  - Reads runtime system information
  PID:1522
- /usr/bin/head
  head -n 1
  2⤵
  PID:1523
- /bin/grep
  grep "Filename: .*libdvdcss2.*amd64.*\\.deb" /tmp/dvdcss-DOj94y/Packages
  2⤵
  PID:1521
- /usr/bin/wget
  wget http://download.videolan.org/pub/debian/stable/stable/libdvdcss2_1.2.13-0_amd64.deb -O /tmp/dvdcss-DOj94y/libdvdcss.deb
  2⤵
  - Writes file to tmp directory
  PID:1524
- /usr/bin/dpkg
  dpkg -i /tmp/dvdcss-DOj94y/libdvdcss.deb
  2⤵
  - Executes dropped EXE
  - Reads runtime system information
  PID:1525
- - /usr/local/sbin/dpkg-split
    dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/dvdcss-DOj94y/libdvdcss.deb
    3⤵
    PID:1526
- - /usr/local/bin/dpkg-split
    dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/dvdcss-DOj94y/libdvdcss.deb
    3⤵
    PID:1526
- - /usr/sbin/dpkg-split
    dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/dvdcss-DOj94y/libdvdcss.deb
    3⤵
    PID:1526
- - /usr/bin/dpkg-split
    dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/dvdcss-DOj94y/libdvdcss.deb
    3⤵
    PID:1526
- - /usr/local/sbin/dpkg-deb
    dpkg-deb --control /tmp/dvdcss-DOj94y/libdvdcss.deb /var/lib/dpkg/tmp.ci
    3⤵
    PID:1527
- - /usr/local/bin/dpkg-deb
    dpkg-deb --control /tmp/dvdcss-DOj94y/libdvdcss.deb /var/lib/dpkg/tmp.ci
    3⤵
    PID:1527
- - /usr/sbin/dpkg-deb
    dpkg-deb --control /tmp/dvdcss-DOj94y/libdvdcss.deb /var/lib/dpkg/tmp.ci
    3⤵
    PID:1527
- - /usr/bin/dpkg-deb
    dpkg-deb --control /tmp/dvdcss-DOj94y/libdvdcss.deb /var/lib/dpkg/tmp.ci
    3⤵
    PID:1527
  - - /usr/local/sbin/tar
      tar -x -f - "--warning=no-timestamp"
      4⤵
      PID:1530
  - - /usr/local/bin/tar
      tar -x -f - "--warning=no-timestamp"
      4⤵
      PID:1530
  - - /usr/sbin/tar
      tar -x -f - "--warning=no-timestamp"
      4⤵
      PID:1530
  - - /usr/bin/tar
      tar -x -f - "--warning=no-timestamp"
      4⤵
      PID:1530
  - - /sbin/tar
      tar -x -f - "--warning=no-timestamp"
      4⤵
      PID:1530
  - - /bin/tar
      tar -x -f - "--warning=no-timestamp"
      4⤵
      Reads runtime system information
      PID:1530
- - /usr/local/sbin/dpkg-deb
    dpkg-deb --fsys-tarfile /tmp/dvdcss-DOj94y/libdvdcss.deb
    3⤵
    PID:1531
- - /usr/local/bin/dpkg-deb
    dpkg-deb --fsys-tarfile /tmp/dvdcss-DOj94y/libdvdcss.deb
    3⤵
    PID:1531
- - /usr/sbin/dpkg-deb
    dpkg-deb --fsys-tarfile /tmp/dvdcss-DOj94y/libdvdcss.deb
    3⤵
    PID:1531
- - /usr/bin/dpkg-deb
    dpkg-deb --fsys-tarfile /tmp/dvdcss-DOj94y/libdvdcss.deb
    3⤵
    PID:1531
- - /usr/local/sbin/rm
    rm -rf -- /var/lib/dpkg/tmp.ci
    3⤵
    PID:1534
- - /usr/local/bin/rm
    rm -rf -- /var/lib/dpkg/tmp.ci
    3⤵
    PID:1534
- - /usr/sbin/rm
    rm -rf -- /var/lib/dpkg/tmp.ci
    3⤵
    PID:1534
- - /usr/bin/rm
    rm -rf -- /var/lib/dpkg/tmp.ci
    3⤵
    PID:1534
- - /sbin/rm
    rm -rf -- /var/lib/dpkg/tmp.ci
    3⤵
    PID:1534
- - /bin/rm
    rm -rf -- /var/lib/dpkg/tmp.ci
    3⤵
    PID:1534
- - /var/lib/dpkg/info/libdvdcss2.postinst
    /var/lib/dpkg/info/libdvdcss2.postinst configure
    3⤵
    PID:1535
  - - /sbin/ldconfig
      ldconfig
      4⤵
      PID:1536
    - - /usr/bin/dpkg-trigger
        
        dpkg-trigger --check-supported
        5⤵
        Software Deployment Tools
        
        PID:1537
    - - /usr/bin/dpkg-trigger
        
        dpkg-trigger --no-await ldconfig
        5⤵
        
        PID:1538
- - /var/lib/dpkg/info/libc-bin.postinst
    /var/lib/dpkg/info/libc-bin.postinst triggered ldconfig
    3⤵
    PID:1539
  - - /sbin/ldconfig
      ldconfig
      4⤵
      PID:1540
  - - /sbin/ldconfig.real
      /sbin/ldconfig.real
      4⤵
      PID:1540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Software Deployment Tools

T1072

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Software Deployment Tools

T1072

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Packages

Path /tmp/dvdcss-DOj94y/Packages
Size 3KB
SHA256 fe006d36dc09da986524c2b1c7685253435af8ccc5650ef3eb3de4d74a1a88ab
MD5 e4ea1d5d2adeff97f44b2f32f4d6b070
SHA1 94eb3b6f367675761982e758a954f9611a5aec5e
SHA512 c5a13a247468b20e3f0dbfe4b388b99e9d7ab21eaecc2befa856d4bba55ba7cfc38c470d57fb284b3a18acd07677b6efa080f67d20da2986d423bb3e9bd12374
TLSH
T192714437C984E1B533C60E0BBF999E991B2F023173F7C8F52BB25499098110B75265EB
MD5 SHA1 SHA512 TLSH

Submit Download

libdvdcss.deb

Path /tmp/dvdcss-DOj94y/libdvdcss.deb
Size 43KB
SHA256 3f856252ef91333f9212e3ae1ee6018d560ef31dd2853902a6979adcc2a06a24
MD5 2a82362626f76f1f667d911c83c1b798
SHA1 2d58bd6c24f87bf70d9fb2525a700afc1077fa18
SHA512 9af0a1f28576ce3f59504a275e18bf60e48e8290cc871120a91be1a02d28cbc87d238082c45cc61e4e63aa788c3a3d9e00456132089b5154455c59110e2d05f4
SSDEEP 768:2gc4QGVscULIxkL8KOMdInliBMqne2XhNL+JjOYuUNoG6DugpypTrK/u8AYJGx7i:v3iI1uIlAMqnDRNL+J6a2G6DtUpYZ
TLSH
T1741302E0EC7F9A62D09A94DD59BF5ECB2250CD635E1A52D2E7FFCC807B0C8839906144
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aux-cache~

Path /var/cache/ldconfig/aux-cache~
Size 50KB
SHA256 469178f441f57f1fbd03fd5d80fef9cd69fb31b45002ae335df2a6e192a71b40
MD5 ac581dcf0b025234c786af2073bcbf3d
SHA1 201db0ab1fe92f67a0e6b988c0c4a56e49add90e
SHA512 a08df8847de56c8eea099495988a7a05a43d2748e6658f2b9144ab04d34d363380a90ab8c644422dd8e13988fab3851fbf65b4d7ef49df319168abf2481a59ab
SSDEEP 384:0V1tFJYlniWjREAuDyhEGb8qOvJtsX4/dUHjDTc1Fv4RRVcu8rHR3X2pNln5tEfz:SrCiWjOj/7qsXsXeqHjMFvWOcmkq
TLSH
T16C33D7C6E7C4ADA9FAC4CEB1945607C8EBAD3844CA95DB0701C4AC3227462E7BF95C70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

status-new

Path /var/lib/dpkg/status-new
Size 1.6MB
SHA256 eb1db6f44588e3469a6eab6fa7c0a788e8e6b7401bce0d6be6416df0d9e97883
MD5 abda9611000108c9ede9768504a33477
SHA1 b1112bdbdbb3f0772eba49bc640c86ae57f7b843
SHA512 d0eff687d38ffad9f1782bee8028b70ae5f11533748e65053dc71dcddfc3eb1d78e1c6d748b42e3bee4def45c1c6d2dde32b04cfc47d6e3478e40c4277072cfc
SSDEEP 12288:HKgarGVS90fvATnQpiHuNprmQaM0R9PtMs8AXnXpcQ66yVsZwgECtpEMt:HKgMG9voQwHEprmQOPnlXZG6ynKtpEMt
TLSH
T1147508736B8063B07AC25B5A7667D7001F3F525076B3C1EC66A6439C9AC309A633F64B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

control

Path /var/lib/dpkg/tmp.ci/control
Size 489B
SHA256 befeab84ff133d009c5df6c8de667e13b8d5dcad3b6836fdda567d20c88e08e1
MD5 1996273efa8a9e5c63072f48b349bf91
SHA1 964eb98a0a729e27da9165444e7cca9e2d1e5633
SHA512 ba8bf8f1c6f63515bc1f82c524b0aabbcaff8d08dabbf0035bb5ac7dee6fd2ebad0222c7a9936143abd0fb786f9a7c270346249af60b41a62d4d86bbf2380ae0
TLSH
T11CF09E37D944E0B933CB4E077F59CA49172B467123F7C5F82B6245984D80187253A5EF
MD5 SHA1 SHA512 TLSH

Submit Download

md5sums

Path /var/lib/dpkg/tmp.ci/md5sums
Size 281B
SHA256 96e0d9987992d8aa4872278cf43a0d42a41ef643aa03dbc94d9079bd269e84e9
MD5 ff0086679eab72bb1423eb65b1330429
SHA1 ab5b8e79c4e214e9538cfd3ac1bb1dea7e1ae839
SHA512 5caa720dc7518ea7c556904c81c999c82306a842146645ec2bd763ac69fbb594dae7089eb9f45caca17d4319edcfa614dfe56b3886ca48fb97503a3f4a31baf2
TLSH
T1F3D02B80DCCE41B4F191A43333E1684D938834E5D286F418514C14740D54B69D57F421
MD5 SHA1 SHA512 TLSH

Submit Download

postinst

Path /var/lib/dpkg/tmp.ci/postinst
Size 135B
SHA256 cc77b576922d8a451e97ca9c559b99d52fafbeb71cbb9c46d032889420f44524
MD5 5d0e769df33e016b3c52a0971e8d258c
SHA1 c6e1f43e32591b4aee15db7457b1158690aef1df
SHA512 f6e6dc9189ef56f80f74db0ae0bec4e16084f75b08815b83a0d185521fe37213de1776b511d3380d714712e7e1c68d877c74ac3e2548a215496de09ebbd60d73
TLSH
T1C8C02B1524C321045DCA8E2D0C13B0904C3C72C433A4010C92303C8CED1411118D150F
MD5 SHA1 SHA512 TLSH

Submit Download

postrm

Path /var/lib/dpkg/tmp.ci/postrm
Size 132B
SHA256 3647da82dd08ce3a634e5899575674e78c524a299b6122ff6fcd31be99175943
MD5 dfdc3bad88b6e98080891d6323e2f58e
SHA1 b38e7706479854fdc9b047bbfcb20deb96007b6b
SHA512 0c6c14d7651a69e2d7e79815e738655c298f4018ddee3671977833004ef2fcb9b8fe52de8fd376ba224be8d3ccf23d8a151be8c5884506009e6d1beabe482e24
TLSH
T124C02B1420C321040DC68E2D0C13B0904C3871C033A0011C90303C8CED1421128E510B
MD5 SHA1 SHA512 TLSH

Submit Download

shlibs

Path /var/lib/dpkg/tmp.ci/shlibs
Size 23B
SHA256 d44800605ca5f3c8daaaa22870dcabe8c21ae33cf6269fc24fc6cf8a8f806756
MD5 56090d516233c17dc081e26b867df182
SHA1 981dd5bb2274e9b341c5cf1f97d8879425ebbf3a
SHA512 45b53c11892a1e3caff354ef06b960431d1f70b8e65824cbae7491b86f678ff88d703de8ee02c388ef164315eb90ff2ce2c92afdd3b6cc2f507bd150b28f1812
MD5 SHA1 SHA512

Submit Download

symbols

Path /var/lib/dpkg/tmp.ci/symbols
Size 279B
SHA256 20cebe3413ade2fb148a0b0085d8bb6924605bb537d07d559e8b76e9f1ed18dc
MD5 085ab7b517e1f8fcc8531a7303ce30ad
SHA1 635e76c0fec87436d7e20436546640062916f0ba
SHA512 b1e8aeaa76c7af6ed25b28f159ece9a5eab8009264870ef77c4e2f7f6e646f3060ae6b1bba8cc72a80ef5f98ced4f16496924b908d06b86b15a68432abad8cc2
TLSH
T1EDD048464D0CC62B30D450343B7091ED6B806C601EEB087A17E0CE3A504CBBDB4765BF
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.i

Path /var/lib/dpkg/updates/tmp.i
Size 4KB
SHA256 2037a8300c3e722be5c053c1d8bd92465fb0c542ed4e8cb3933bb2064a6ec984
MD5 b9fef7589df738cb6136161e2bffb9d4
SHA1 7d8648d4a223b544ab3762cbb0485bc8c5a47b8d
SHA512 4e73e5caf4815a952514b87bf269f71dd55652ed39b18cc368b24410bc5a50efd2218ce27c9929c6c6f6506f0c2e4b9c0440928fb9ac29f4a4cbe7a787681169
SSDEEP 24:abx4g+GvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvI:abCg+D
TLSH
T1489112309FC0ADE07C0D1AC1E1E357C5C71055406C6630E8D59530A03782388547242E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp.i

Path /var/lib/dpkg/updates/tmp.i
Size 4KB
SHA256 cfa98fcf6b20435a5610bf50d14fbd5f3bd5e198dd9f4c498da2a1ec28efd300
MD5 ee5d05f7684c9f0ed5b73539808bdd0c
SHA1 382c4ef824a0937f0a7ce4dbe41ff92c47564fe3
SHA512 3d47b61c00c48fe3488dee1cc26f7a1cf0c289eaa0e1828ab7d36de6c6e233189b8d61688a5a47cb2d3345683abebfb93082f757b8bfbe3b3c2ac87de032dede
SSDEEP 24:aCxYWZAHKOWzKxLnzBzKyLTlnPvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvQ:aCWWZAqOBLzHA
TLSH
T1029126368FC0DCE43F8E0AC6EA578BC4C71B05202EB6F0E8E66230643B81346143619E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp.i

Path /var/lib/dpkg/updates/tmp.i
Size 4KB
SHA256 e50e167fa37fbb6f953b9b7bd51e021eeef4f444e0e474a6716821002ba0be12
MD5 15a0d19769c4bc2f63c5ebecd1cc9229
SHA1 5fbd3c204bbe9038b57a95af7e510493634bec9b
SHA512 93155a358d99686a5f993a5b0ef32615e619c2d7fc8aa79099a1a19a667524ddd2482f69b6a9374f6fd92aed77ed55d8cd6a9eeb2801dc7a6c85999a30a663ea
SSDEEP 24:aTxYWZAHKOWzKxLnzBzKyLTlnyvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvI:aTWWZAqOBLzHB
TLSH
T18A91D6368FC09DE43F8E0AC6EA5787C5D71B05206FA6F4E8D76234547B81346143619E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp.i

Path /var/lib/dpkg/updates/tmp.i
Size 4KB
SHA256 cf7d2275d2effcc231f426e078582b9665c4a2407e267c9e25546220308dd569
MD5 edae9b7299f2afc09258160786a4dada
SHA1 dd7aa0c8aa29e937efd88b9eb39811e1460b62b9
SHA512 0e3341d862dde54e87b2cea0384cc79a4594f7a22a322d501fbb386559511cc8e6046bf134bc1496d04bddb80c8213dd0438368d3a5d20b82099a5a4c9cc30ff
SSDEEP 24:KvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvI:n
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads