69ad33f540131258c479e2045ba875ca1bdf0f83932c6c5c3d0d99b262966ef3

Analysis

max time kernel
0s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
03/06/2026, 12:19

Target
install-tl-20260603/texmf-dist/scripts/texlive/mktexlsr
Size 8KB
Sample260603-pg6dmaex2w
SHA256 69ad33f540131258c479e2045ba875ca1bdf0f83932c6c5c3d0d99b262966ef3
MD5 2e3ea4872d1461d2607b6149c574054e
SHA1 6ad3fd8bd9210ae1c6962467e60c24f68f6aa2b3
SHA512 c3cc5f3b22c9e6d88ecfc3b788b89434a014dcd22c4615dcc74e3b2949e6f2038b6239c99a4f3d75af7d977f448228e7ffb31ebbd751eaf8084dbb92b40327ea
SSDEEP 192:Tma0T1WxNzyO3a+2Vp8jpdLvC2U4qa5frKx/uXVd2Q7GE7pRJTL:aaCWxN+O3a+MWpdLvdU4/5T0/u7HKE7p
TLSH
T1F402D806BFC4A770045382B56646B081FB18D12F8869AB3CF1ECD1495B62B6461FB3BD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/mktexlsrtrees.CzeWjQUPFK	mktemp

/tmp/install-tl-20260603/texmf-dist/scripts/texlive/mktexlsr
/tmp/install-tl-20260603/texmf-dist/scripts/texlive/mktexlsr
1⤵
PID:756
- /bin/sed
  sed "s%.*/%%"
  2⤵
  - Reads runtime system information
  PID:759
- /bin/uname
  uname -s
  2⤵
  PID:760
- /bin/sed
  sed "s%/*[^/][^/]*\$%%"
  2⤵
  - Reads runtime system information
  PID:763
- /usr/bin/tty
  tty -s
  2⤵
  PID:764
- /bin/mktemp
  mktemp /tmp/mktexlsrtrees.XXXXXXXXXX
  2⤵
  - Writes file to tmp directory
  PID:765
- /usr/bin/tr
  tr : " "
  2⤵
  PID:768
- /usr/bin/sort
  sort
  2⤵
  PID:769
- /usr/bin/uniq
  uniq
  2⤵
  PID:770
- /bin/rm
  rm -f /tmp/mktexlsrtrees.CzeWjQUPFK
  2⤵
  PID:771