Oracle Linux malware

Netgear Armor Bitdefender Total Security for Microsoft Windows 11 flags as malware the Oracle Linux 10.1 ISO "OracleLinux-R10-U1-x86_64-dvd.iso". Is this a false positive? The supposed malware is identified as "Gen:Application.WinexeSvc.1". Oracle Linux is a fork of Red Hat (Fedora) Linux but the Red Hat version does not have any malware detected by Bitdefender. The ISO file can be downloaded from "Oracle.com/Linux".

Find more posts tagged with

malware false positive

malware

bitdefender total security

linux

Comments

Flexx

https://community.bitdefender.com/en/discussion/106038/oracle-linux-malware

The OracleLinux-R10-U1-x86_64-dvd.iso file size is around 10 GB. If you already have the ISO downloaded, use 7-Zip (https://www.7-zip.org/) to extract the ISO files into a folder, scan that folder with Bitdefender, then upload the malicious file detected by Bitdefender to VirusTotal (https://www.virustotal.com/gui/home/upload) and share the VirusTotal hash here.

Regards

NicoleSharp3000

What might be malicious is labeling an ISO file of 9.54 GB as a "DVD"…. 😕

NicoleSharp3000

It took a long time to scan. The flagged file is "D:\AppStream\Packages\samba-winexe-4.22.4-106.el10_1.x86_64.rpm". The Fedora Workstation ISO does not appear to have an "AppStream" directory in root so this is something that Oracle added which Bitdefender finds malicious. I have read about corrupted/hacked Linux distro ISOs though (notoriously from Linux Mint) so I would not recommend to automatically assume the file is safe simply because it is released from a well-known publisher such as Oracle.

NicoleSharp3000

Basic properties
MD5
e301beb431e256b28319d66f153830a2
SHA-1
9acccd5db86325e16002a882ee07d3186eed3889
SHA-256
622ee4dfe2452818c0137d141b8afe245ccf9647ee1ac8db9b2999c3be2b7a41
SSDEEP
3072:pg8RxaIxWcBLxu6pb49OjAQ7mEl51g3WLT9xj1d5YyAea+B4IM8a:pgsxD4cBLxugMOchED2GLT9xjJYyHa+e
TLSH
T1D9042B952A497D76EF872B3FD03D3832855E6ABDE20BC4F4A04DC85A290359C3A3E552
File type
Linux RPM package
linux
rpm

Magic
RPM v3.0 bin i386/x86_64
TrID
RPM Package (generic) (100%)
Magika
RPM
File size
183.43 KB (187836 bytes)
History
First Submission
2026-01-26 20:41:48 UTC
Last Submission
2026-01-26 20:41:48 UTC
Last Analysis
2026-01-26 20:41:48 UTC
Names
samba-winexe-4.22.4-106.el10_1.x86_64.rpm

NicoleSharp3000

Scan Results Summary
Resolved issues

Item path Threat Name Action taken

D:\OracleLinux-R10-U1-x86_64-dvd.iso=>BaseOS=>Packages=>linux-firmware-20251030-999.44.1.gite9292517.el10.noarch.rpm=>linux-firmware-999:20251030-999.44.1.gite9292517.el10.gz=>(zstd)=>.=>usr=>lib=>firmware=>vxge=>X3fw.ncf.xz=>(xz stream)=>T1A:X3_101025_1_8_1_expROM_FW_uni_template_flash0.bin Moved to Quarantine

D:\AppStream\Packages\samba-winexe-4.22.4-106.el10_1.x86_64.rpm=>samba-winexe-0:4.22.4-106.el10_1.gz=>(zstd)=>(Embedded EXE g) Gen:Application.WinexeSvc.1 Moved to Quarantine

D:\OracleLinux-R10-U1-x86_64-dvd.iso=>AppStream=>Packages=>samba-winexe-4.22.4-106.el10_1.x86_64.rpm=>samba-winexe-0:4.22.4-106.el10_1.gz=>(zstd)=>(Embedded EXE g) Gen:Application.WinexeSvc.1 Moved to Quarantine

D:\AppStream\Packages\samba-winexe-4.22.4-106.el10_1.x86_64.rpm=>samba-winexe-0:4.22.4-106.el10_1.gz=>(zstd)=>(Embedded EXE 2g) Gen:Application.WinexeSvc.1 Moved to Quarantine

D:\OracleLinux-R10-U1-x86_64-dvd.iso=>BaseOS=>Packages=>linux-firmware-20251030-999.44.1.gite9292517.el10.noarch.rpm=>linux-firmware-999:20251030-999.44.1.gite9292517.el10.gz=>(zstd)=>.=>usr=>lib=>firmware=>vxge=>X3fw-pxe.ncf.xz=>(xz stream)=>T1:X3_101115_1_8_1_expROM_FW_uni_template_rmt_cmd_line.txt Moved to Quarantine

D:\OracleLinux-R10-U1-x86_64-dvd.iso=>BaseOS=>Packages=>linux-firmware-20251030-999.44.1.gite9292517.el10.noarch.rpm=>linux-firmware-999:20251030-999.44.1.gite9292517.el10.gz=>(zstd)=>.=>usr=>lib=>firmware=>vxge=>X3fw.ncf.xz=>(xz stream)=>T1:X3_101025_1_8_1_expROM_FW_uni_template_eeprom0.bin Moved to Quarantine

D:\OracleLinux-R10-U1-x86_64-dvd.iso=>BaseOS=>Packages=>linux-firmware-20251030-999.44.1.gite9292517.el10.noarch.rpm=>linux-firmware-999:20251030-999.44.1.gite9292517.el10.gz=>(zstd)=>.=>usr=>lib=>firmware=>vxge=>X3fw-pxe.ncf.xz=>(xz stream)=>T1:X3_101115_1_8_1_expROM_FW_uni_template_flash0.bin Moved to Quarantine

D:\OracleLinux-R10-U1-x86_64-dvd.iso=>BaseOS=>Packages=>linux-firmware-20251030-999.44.1.gite9292517.el10.noarch.rpm=>linux-firmware-999:20251030-999.44.1.gite9292517.el10.gz=>(zstd)=>.=>usr=>lib=>firmware=>vxge=>X3fw-pxe.ncf.xz=>(xz stream)=>T1:X3_101115_1_8_1_expROM_FW_uni_template_eeprom0.bin Moved to Quarantine

D:\OracleLinux-R10-U1-x86_64-dvd.iso=>BaseOS=>Packages=>linux-firmware-20251030-999.44.1.gite9292517.el10.noarch.rpm=>linux-firmware-999:20251030-999.44.1.gite9292517.el10.gz=>(zstd)=>.=>usr=>lib=>firmware=>vxge=>X3fw.ncf.xz=>T1A:X3_101025_1_8_1_expROM_FW_uni_template_eeprom0.bin Moved to Quarantine

D:\OracleLinux-R10-U1-x86_64-dvd.iso=>BaseOS=>Packages=>linux-firmware-20251030-999.44.1.gite9292517.el10.noarch.rpm=>linux-firmware-999:20251030-999.44.1.gite9292517.el10.gz=>(zstd)=>.=>usr=>lib=>firmware=>vxge=>X3fw-pxe.ncf.xz=>(xz stream)=>T1A:X3_101115_1_8_1_expROM_FW_uni_template_rmt_cmd_line.txt Moved to Quarantine

D:\OracleLinux-R10-U1-x86_64-dvd.iso=>BaseOS=>Packages=>linux-firmware-20251030-999.44.1.gite9292517.el10.noarch.rpm=>linux-firmware-999:20251030-999.44.1.gite9292517.el10.gz=>(zstd)=>.=>usr=>lib=>firmware=>vxge=>X3fw-pxe.ncf.xz=>(xz stream)=>T1A:X3_101115_1_8_1_expROM_FW_uni_template_flash0.bin Moved to Quarantine

D:\OracleLinux-R10-U1-x86_64-dvd.iso=>BaseOS=>Packages=>linux-firmware-20251030-999.44.1.gite9292517.el10.noarch.rpm=>linux-firmware-999:20251030-999.44.1.gite9292517.el10.gz=>(zstd)=>.=>usr=>lib=>firmware=>vxge=>X3fw-pxe.ncf.xz=>(xz stream)=>T1A:X3_101115_1_8_1_expROM_FW_uni_template_eeprom0.bin Moved to Quarantine

D:\OracleLinux-R10-U1-x86_64-dvd.iso=>BaseOS=>Packages=>linux-firmware-20251030-999.44.1.gite9292517.el10.noarch.rpm=>linux-firmware-999:20251030-999.44.1.gite9292517.el10.gz=>(zstd)=>.=>usr=>lib=>firmware=>vxge=>X3fw-pxe.ncf.xz=>T1A:X3_101115_1_8_1_expROM_FW_uni_template_eeprom0.bin Moved to Quarantine

D:\OracleLinux-R10-U1-x86_64-dvd.iso=>BaseOS=>Packages=>linux-firmware-20251030-999.44.1.gite9292517.el10.noarch.rpm=>linux-firmware-999:20251030-999.44.1.gite9292517.el10.gz=>(zstd)=>.=>usr=>lib=>firmware=>vxge=>X3fw.ncf.xz=>(xz stream)=>T1:X3_101025_1_8_1_expROM_FW_uni_template_rmt_cmd_line.txt Moved to Quarantine

D:\OracleLinux-R10-U1-x86_64-dvd.iso=>BaseOS=>Packages=>linux-firmware-20251030-999.44.1.gite9292517.el10.noarch.rpm=>linux-firmware-999:20251030-999.44.1.gite9292517.el10.gz=>(zstd)=>.=>usr=>lib=>firmware=>vxge=>X3fw.ncf.xz=>(xz stream)=>T1:X3_101025_1_8_1_expROM_FW_uni_template_flash0.bin Moved to Quarantine

Flexx

If you believe a website or file has been incorrectly blocked by Bitdefender, you can submit the details to Bitdefender malware researchers by filling out the form at the link below:

https://www.bitdefender.com/consumer/support/answer/29358/

If the website or file is found to be incorrectly blocked, the detection will be removed within a maximum of 72 hours. However, if the detection persists after 72 hours, the website or file will be considered malicious, as determined by Bitdefender malware research team, and the detection will remain.

NOTE: Kindly share the file with the above hash you stated with the Bitdefender Malware Research team.

Regards