0cb9f1d9e8781f7a4771da0c3544e40a091cfb2b444d809d74f9f510147e769e

Analysis

max time kernel
34s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
03/06/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install-tl-20260603/install-tl
Size 124KB
Sample260603-pg6dmaex2w
SHA256 0cb9f1d9e8781f7a4771da0c3544e40a091cfb2b444d809d74f9f510147e769e
MD5 a6c8931d03e927858853e75b48b22aba
SHA1 936521033b2a525f850d18da202ea4c1dd923bd1
SHA512 ac25776be58d7821a2d0203e5a28ec73c2683b7a47c7c35ec0d0818b03c3e97a416382ce43ad36fb6178f278ba3253f8f4de78a358d815bf68bf4e70251b7721
SSDEEP 3072:0p4+IT8QZv9yxymOLpG3gEce5SpP0QmLmlXYx:0tIT8QZvdXLggEce5SB32hx
TLSH
T1DBC3F9063AD6A73326A361FA7FCF9095F719D0671016EB24788D82981F4717C42F7DA2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: Unix Shell 1 TTPs 1 IoCs

Execute scripts via Unix Shell.

execution

Unix Shell

T1059.004

pid	Process
1476	sh

Reads runtime system information 6 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/mountinfo	df
File opened for reading	/proc/self/mountinfo	df
File opened for reading	/proc/filesystems	sed

System Network Configuration Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1512	sh
1513	gzip

Writes file to tmp directory 15 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/install-tl-20260603/tlpkg/gpg/trustdb.gpg	gpg
File opened for modification	/tmp/ccas8MRl.s	cc1
File opened for modification	/tmp/cgw0JwSK/dummy.o	as
File opened for modification	/tmp/86YEXUfCoA/0Auzy7V5SQ	perl
File opened for modification	/tmp/86YEXUfCoA/0Auzy7V5SQ	curl
File opened for modification	/tmp/86YEXUfCoA/H0Vu6OJg0R	curl
File opened for modification	/tmp/86YEXUfCoA/3SJpEb2GDS	perl
File opened for modification	/tmp/cgw0JwSK/dummy.c	sh
File opened for modification	/tmp/ccas8MRl.s	cc
File opened for modification	/tmp/86YEXUfCoA/GwzPtN0TEu	perl
File opened for modification	/tmp/86YEXUfCoA/xYW3HOrJIO	perl
File opened for modification	/tmp/86YEXUfCoA/xYW3HOrJIO	curl
File opened for modification	/tmp/86YEXUfCoA/GwzPtN0TEu	sh
File opened for modification	/tmp/86YEXUfCoA/H0Vu6OJg0R	perl
File opened for modification	/tmp/86YEXUfCoA/3SJpEb2GDS	gpg

/tmp/install-tl-20260603/install-tl
/tmp/install-tl-20260603/install-tl
1⤵
PID:1469

/usr/local/sbin/perl
perl /tmp/install-tl-20260603/install-tl
1⤵
PID:1469

/usr/local/bin/perl
perl /tmp/install-tl-20260603/install-tl
1⤵
PID:1469

/usr/sbin/perl
perl /tmp/install-tl-20260603/install-tl
1⤵
PID:1469

/usr/bin/perl
perl /tmp/install-tl-20260603/install-tl
1⤵
- Writes file to tmp directory
PID:1469
- /bin/sh
  sh -c "gpg --version >/dev/null 2>&1"
  2⤵
  PID:1473
- - /usr/bin/gpg
    gpg --version
    3⤵
    PID:1474
- /bin/sh
  sh -c "'/bin/sh' -c 'echo \$(echo foo)' 2>/dev/null"
  2⤵
  PID:1475
- - /bin/sh
    /bin/sh -c "echo \$(echo foo)"
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    PID:1476
- /bin/sh
  sh -c "'/bin/sh' '/tmp/install-tl-20260603/tlpkg/installer/config.guess'"
  2⤵
  PID:1478
- - /bin/sh
    /bin/sh /tmp/install-tl-20260603/tlpkg/installer/config.guess
    3⤵
    - Writes file to tmp directory
    PID:1479
  - - /bin/sed
      sed -e "s,.*/,,"
      4⤵
      Reads runtime system information
      PID:1482
  - - /bin/uname
      uname -m
      4⤵
      PID:1483
  - - /bin/uname
      uname -r
      4⤵
      PID:1484
  - - /bin/uname
      uname -s
      4⤵
      PID:1485
  - - /bin/uname
      uname -v
      4⤵
      PID:1486
  - - /bin/mktemp
      mktemp -d /tmp/cgXXXXXX
      4⤵
      PID:1487
  - - /usr/bin/cc
      cc -c -o /tmp/cgw0JwSK/dummy.o /tmp/cgw0JwSK/dummy.c
      4⤵
      Writes file to tmp directory
      PID:1488
    - - /usr/lib/gcc/x86_64-linux-gnu/7/cc1
        
        /usr/lib/gcc/x86_64-linux-gnu/7/cc1 -quiet -imultiarch x86_64-linux-gnu /tmp/cgw0JwSK/dummy.c -quiet -dumpbase dummy.c "-mtune=generic" "-march=x86-64" -auxbase-strip /tmp/cgw0JwSK/dummy.o -fstack-protector-strong -Wformat -Wformat-security -o /tmp/ccas8MRl.s
        5⤵
        Writes file to tmp directory
        
        PID:1489
    - - /usr/local/sbin/as
        
        as --64 -o /tmp/cgw0JwSK/dummy.o /tmp/ccas8MRl.s
        5⤵
        
        PID:1490
    - - /usr/local/bin/as
        
        as --64 -o /tmp/cgw0JwSK/dummy.o /tmp/ccas8MRl.s
        5⤵
        
        PID:1490
    - - /usr/sbin/as
        
        as --64 -o /tmp/cgw0JwSK/dummy.o /tmp/ccas8MRl.s
        5⤵
        
        PID:1490
    - - /usr/bin/as
        
        as --64 -o /tmp/cgw0JwSK/dummy.o /tmp/ccas8MRl.s
        5⤵
        Writes file to tmp directory
        
        PID:1490
  - - /bin/cat
      cat
      4⤵
      PID:1491
  - - /bin/sed
      sed "s, ,,g"
      4⤵
      Reads runtime system information
      PID:1495
  - - /bin/grep
      grep "^LIBC"
      4⤵
      PID:1494
  - - /usr/bin/cc
      cc -E /tmp/cgw0JwSK/dummy.c
      4⤵
      PID:1493
    - - /usr/lib/gcc/x86_64-linux-gnu/7/cc1
        
        /usr/lib/gcc/x86_64-linux-gnu/7/cc1 -E -quiet -imultiarch x86_64-linux-gnu /tmp/cgw0JwSK/dummy.c "-mtune=generic" "-march=x86-64" -fstack-protector-strong -Wformat -Wformat-security
        5⤵
        
        PID:1496
  - - /bin/sed
      sed "s/^ //"
      4⤵
      Reads runtime system information
      PID:1497
  - - /bin/sed
      sed "s, ,,g"
      4⤵
      Reads runtime system information
      PID:1501
  - - /bin/grep
      grep "^ABI"
      4⤵
      PID:1500
  - - /usr/bin/cc
      cc -E /tmp/cgw0JwSK/dummy.c
      4⤵
      PID:1499
    - - /usr/lib/gcc/x86_64-linux-gnu/7/cc1
        
        /usr/lib/gcc/x86_64-linux-gnu/7/cc1 -E -quiet -imultiarch x86_64-linux-gnu /tmp/cgw0JwSK/dummy.c "-mtune=generic" "-march=x86-64" -fstack-protector-strong -Wformat -Wformat-security
        5⤵
        
        PID:1502
  - - /bin/rm
      rm -fr /tmp/cgw0JwSK
      4⤵
      PID:1503
- /bin/sh
  sh -c "df -P . >/dev/null 2>&1"
  2⤵
  PID:1504
- - /bin/df
    df -P .
    3⤵
    - Reads runtime system information
    PID:1505
- /bin/sh
  sh -c "curl --version >/dev/null 2>&1"
  2⤵
  PID:1506
- - /usr/bin/curl
    curl --version
    3⤵
    PID:1507
- /bin/sh
  sh -c "wget --version >/dev/null 2>&1"
  2⤵
  PID:1508
- - /usr/bin/wget
    wget --version
    3⤵
    PID:1509
- /usr/local/sbin/wget
  wget --version
  2⤵
  PID:1510
- /usr/local/bin/wget
  wget --version
  2⤵
  PID:1510
- /usr/sbin/wget
  wget --version
  2⤵
  PID:1510
- /usr/bin/wget
  wget --version
  2⤵
  PID:1510
- /bin/sh
  sh -c "lz4 --version >/dev/null 2>&1"
  2⤵
  PID:1511
- /bin/sh
  sh -c "gzip --version >/dev/null 2>&1"
  2⤵
  - System Network Configuration Discovery
  PID:1512
- - /bin/gzip
    gzip --version
    3⤵
    - System Network Configuration Discovery
    PID:1513
- /bin/sh
  sh -c "xz --version >/dev/null 2>&1"
  2⤵
  PID:1514
- - /usr/bin/xz
    xz --version
    3⤵
    PID:1515
- /bin/sh
  sh -c "curl -Ls -o /dev/null -w '%{url_effective}' --connect-timeout 30 --max-time 30 https://mirror.ctan.org"
  2⤵
  PID:1516
- - /usr/bin/curl
    curl -Ls -o /dev/null -w "%{url_effective}" --connect-timeout 30 --max-time 30 https://mirror.ctan.org
    3⤵
    PID:1517
- /usr/local/sbin/curl
  curl --user-agent texlive/curl --retry 4 --retry-delay 4 --connect-timeout 30 --fail --location --silent --output /tmp/86YEXUfCoA/xYW3HOrJIO https://ctan.math.utah.edu/ctan/tex-archive/systems/texlive/tlnet/tlpkg/texlive.tlpdb.xz
  2⤵
  PID:1521
- /usr/local/bin/curl
  curl --user-agent texlive/curl --retry 4 --retry-delay 4 --connect-timeout 30 --fail --location --silent --output /tmp/86YEXUfCoA/xYW3HOrJIO https://ctan.math.utah.edu/ctan/tex-archive/systems/texlive/tlnet/tlpkg/texlive.tlpdb.xz
  2⤵
  PID:1521
- /usr/sbin/curl
  curl --user-agent texlive/curl --retry 4 --retry-delay 4 --connect-timeout 30 --fail --location --silent --output /tmp/86YEXUfCoA/xYW3HOrJIO https://ctan.math.utah.edu/ctan/tex-archive/systems/texlive/tlnet/tlpkg/texlive.tlpdb.xz
  2⤵
  PID:1521
- /usr/bin/curl
  curl --user-agent texlive/curl --retry 4 --retry-delay 4 --connect-timeout 30 --fail --location --silent --output /tmp/86YEXUfCoA/xYW3HOrJIO https://ctan.math.utah.edu/ctan/tex-archive/systems/texlive/tlnet/tlpkg/texlive.tlpdb.xz
  2⤵
  - Writes file to tmp directory
  PID:1521
- /bin/sh
  sh -c "\"xz\" -dcf < \"/tmp/86YEXUfCoA/xYW3HOrJIO\" > \"/tmp/86YEXUfCoA/GwzPtN0TEu\""
  2⤵
  - Writes file to tmp directory
  PID:1525
- - /usr/bin/xz
    xz -dcf
    3⤵
    PID:1526
- /usr/local/sbin/curl
  2⤵
  PID:1527
- /usr/local/bin/curl
  2⤵
  PID:1527
- /usr/sbin/curl
  2⤵
  PID:1527
- /usr/bin/curl
  2⤵
  - Writes file to tmp directory
  PID:1527
- /usr/local/sbin/curl
  curl --user-agent texlive/curl --retry 4 --retry-delay 4 --connect-timeout 30 --fail --location --silent --output /tmp/86YEXUfCoA/H0Vu6OJg0R https://ctan.math.utah.edu/ctan/tex-archive/systems/texlive/tlnet/tlpkg/texlive.tlpdb.sha512.asc
  2⤵
  PID:1529
- /usr/local/bin/curl
  curl --user-agent texlive/curl --retry 4 --retry-delay 4 --connect-timeout 30 --fail --location --silent --output /tmp/86YEXUfCoA/H0Vu6OJg0R https://ctan.math.utah.edu/ctan/tex-archive/systems/texlive/tlnet/tlpkg/texlive.tlpdb.sha512.asc
  2⤵
  PID:1529
- /usr/sbin/curl
  curl --user-agent texlive/curl --retry 4 --retry-delay 4 --connect-timeout 30 --fail --location --silent --output /tmp/86YEXUfCoA/H0Vu6OJg0R https://ctan.math.utah.edu/ctan/tex-archive/systems/texlive/tlnet/tlpkg/texlive.tlpdb.sha512.asc
  2⤵
  PID:1529
- /usr/bin/curl
  curl --user-agent texlive/curl --retry 4 --retry-delay 4 --connect-timeout 30 --fail --location --silent --output /tmp/86YEXUfCoA/H0Vu6OJg0R https://ctan.math.utah.edu/ctan/tex-archive/systems/texlive/tlnet/tlpkg/texlive.tlpdb.sha512.asc
  2⤵
  - Writes file to tmp directory
  PID:1529
- /bin/sh
  sh -c "gpg --homedir \"/tmp/install-tl-20260603/tlpkg/gpg\" --no-secmem-warning --no-permission-warning --lock-never --status-file \"/tmp/86YEXUfCoA/3SJpEb2GDS\" --verify \"/tmp/86YEXUfCoA/H0Vu6OJg0R\" \"/tmp/86YEXUfCoA/0Auzy7V5SQ\" 2>&1"
  2⤵
  PID:1531
- - /usr/bin/gpg
    gpg --homedir /tmp/install-tl-20260603/tlpkg/gpg --no-secmem-warning --no-permission-warning --lock-never --status-file /tmp/86YEXUfCoA/3SJpEb2GDS --verify /tmp/86YEXUfCoA/H0Vu6OJg0R /tmp/86YEXUfCoA/0Auzy7V5SQ
    3⤵
    - Writes file to tmp directory
    PID:1532
- /bin/sh
  sh -c "df -Pk \"/usr/local/\""
  2⤵
  PID:1533
- - /bin/df
    df -Pk /usr/local/
    3⤵
    - Reads runtime system information
    PID:1534
- /usr/local/sbin/clear
  clear
  2⤵
  PID:1535
- /usr/local/bin/clear
  clear
  2⤵
  PID:1535
- /usr/sbin/clear
  clear
  2⤵
  PID:1535
- /usr/bin/clear
  clear
  2⤵
  PID:1535

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Unix Shell

T1059.004

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0Auzy7V5SQ

Path /tmp/86YEXUfCoA/0Auzy7V5SQ
Size 144B
SHA256 f1a262ca422bd56c1e3d5f829811f124862ca21e771965c75e038ca16f12276b
MD5 5db82b501a067926e69996ec4e59ea72
SHA1 4d23c6198ef95b87579654a753e3b0643e51fe16
SHA512 639079b073edf6c10f716dca2df0154a2408374c2e5725bccaef75ee74d8fd67c7423d6a5e258e48e99978362f284b6feeee6dc5c6ef3efd4f15f88c0ff49422
TLSH
T1BDC08C4600B852012EDC512E071228026AF26BC34FE49A920A8440C0A022A4E8826904
MD5 SHA1 SHA512 TLSH

Submit Download

3SJpEb2GDS

Path /tmp/86YEXUfCoA/3SJpEb2GDS
Size 565B
SHA256 e26b6f7662839205602909503ecca7e90359701f2ee2cbfcf28cfb312889fcc2
MD5 1af16c9705d6fb42e3c20c5bd3879cd0
SHA1 dbec574b896254259e5e09e0729388bc1522db36
SHA512 d8e632701fb2d894c6e7031e0290005dc964ece68fe6f1e21c97556fa1c3d5f2fceafae547e9ae65d6e89dce6724694c5688d4952e03da18d41962bc4ffae580
TLSH
T18FF02B222C1DF2EEA87974AEDD1F120983123124CBFA591976DA52120D0CE2C3E21081
MD5 SHA1 SHA512 TLSH

Submit Download

GwzPtN0TEu

Path /tmp/86YEXUfCoA/GwzPtN0TEu
Size 18.1MB
SHA256 25e9dd3cf4fbf9f51370b7c0bb860d3a38c5fa833ce9238cc2e9dfacf71d3c56
MD5 064f802a63a9d067cf15dd52ab7e524c
SHA1 7074f2cdbf4eae7bd897142fd62b9e59ed96b192
SHA512 a3987ac93fab566d8877d0cce03e2120e26d9e7e783441bd6b207f06be32e7ae2a2e70b58c1a9a3e69f0d13562f31fcdc78c1334d9131dfeb6370dcde9a76a22
SSDEEP 49152:9/XRjATik/NB4zBsJDMwGN653Y8bJKML9GlOuML0z5aSxr0ihbE1tWG65DMwGN6g:O
TLSH
T1AE1730D283E432B3E695BC723A6195A3DD0769E2B68EDD035048A1D980FC75722F8737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

H0Vu6OJg0R

Path /tmp/86YEXUfCoA/H0Vu6OJg0R
Size 488B
SHA256 9523ce585e6ce092ef8c022aa7b3d703068089f6a7c52f21b86ffd8520e0cb87
MD5 3646fc510146da099b15771e9e2cf88e
SHA1 264e617b8855e54ed7e73c83af4f3fe09b2bd879
SHA512 ab4ee31176a250e321f628982ac1253ac4d0970790f63fe343b19087f502c300f269113aaf359a7f56a0c15ea0295eb241c113a58be7e8f6ac789a62607feb7c
TLSH
T1F9F09E14FD0B8251C83DD4292F75A908EED614BD34A252E1F1984653123A0B006BD72B
MD5 SHA1 SHA512 TLSH

Submit Download

xYW3HOrJIO

Path /tmp/86YEXUfCoA/xYW3HOrJIO
Size 2.6MB
SHA256 17a27073e8e13d17ba2eab6806316f500c7edba40a0530327307bcdff5eb45a8
MD5 2799abe4bbdac568c260a1872ef7b5c2
SHA1 131607e97252e9c630039731b4318bd321788bbb
SHA512 d06a16fbdf61abe06489a52090304a1b96cbe1c8e3a3f02b949c7903652dcb7ae7518bdce1bb5bad038da6b3820b9e53c5bc272b02c53dba2aa6836dc7da5979
SSDEEP 49152:VuEL7lmJOaQreHmaDXqWoa8SQwSeJ0kHx8AlJF1fsOhYg6mwJVDyOYnE:kEL7lmJOXiHmaJoHSQwdnHvPeAmknE
TLSH
T162C53318FDD9B5EB1C1C974CCD9E15A87026E9F12CE4BEEC6E20D4C137A94EADB81604
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccas8MRl.s

Path /tmp/ccas8MRl.s
Size 127B
SHA256 f9d335832f12291c7e891c437b56a545e7beccfc0a553a1f0432ad2a905cd1cc
MD5 a35b790822e41afb0e275834d5135924
SHA1 1be675a116952e2aeeac164e7298a4c07f768120
SHA512 6bd5245667a9d61cb9ca4fceac429b69586b59600ab11a17a244a677720e6217fd1152039ef0a3e2dd8313be378a48775cbad6b7056c32a1ad4286add6024e60
TLSH
T1FDB02B0563241C511007DC1D314540005C3F1E720812F50440B0C75081F043100C8C93
MD5 SHA1 SHA512 TLSH

Submit Download

dummy.c

Path /tmp/cgw0JwSK/dummy.c
Size 7B
SHA256 7c725f30854a46033dd94f728ac6b08caf10845993cd3ed48e40079cdb0a76a6
MD5 06c25fe0c80b8959051a62f8f034710a
SHA1 70f09c7c967ce9d6a93907293a3a95b0d10aca3a
SHA512 83f4d63cef08034f74eca9d57841a2771f945d45fd22e31aa38aba17491dcdbfbc1a2c62b01ee9d06d32b4ef03a8e4c95143422eb5c87bbcc9fede4c935991c2
MD5 SHA1 SHA512

Submit Download

dummy.c

Path /tmp/cgw0JwSK/dummy.c
Size 379B
SHA256 2b1e759ee3b84fe2a55a0a1a97ab16a6a3e812f1df80e77e0952ebd99b8bf204
MD5 29b376abbc6d5277899ea5d71da35a1f
SHA1 94d4a1209f6fea4e2d53d268ae037bedf5ca350b
SHA512 89c3485fa2699356e182ae87fa60240b9e58993cadfc2e4c5d4178b2637425a0a0ed1ce132ac3e56d89bdaf8123a744da786ab94d91df86d5457fc8fb8c0662d
TLSH
T1B0E09238DDAE4F70E26B0BB1200D96934801E9EF37835CB511577C897BC4229309932F
MD5 SHA1 SHA512 TLSH

Submit Download

dummy.c

Path /tmp/cgw0JwSK/dummy.c
Size 69B
SHA256 386636696f5110d7c7840ba5593d550f60aca9351fa35570d334378257bc2ef2
MD5 3600a5c56721aea840de94ad7d4c70f8
SHA1 963bbd8e293979e06159bf625a67d14382f7ab66
SHA512 099ae898a447ac94dcb7a011a1bf47a1407214fc93557b746970a341ab0078e3967b292ae4b89a36d698eb695a1ef3137b89c90afef0a596db9a520cc0e4b6c2
TLSH
T123A00234450721F4B9AD53B393AC849CE70F5B87DA05903A3857F4D0934F0175196054
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads