evilgnome | 819eab9afaca5601ffd83c85a7edd6cd1899e6b431ab8e901a385065912adeb1

Resubmissions

28-02-2022 15:41

220228-s4qs8seeg3 10

12-06-2021 09:55

210612-f7rmdwaays 10

12-06-2021 09:51

210612-kcegep1ef2 7

Analysis

max time kernel
240s
max time network
287s
platform
macos_amd64
resource
macos
submitted
28-02-2022 15:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

installer.run
Size

99KB
MD5

d4b45f4ab1ec5616026e8fbed2431be8
SHA1

28ecd4944f37bb8f9b7dfd1d486f7c9c027166d0
SHA256

819eab9afaca5601ffd83c85a7edd6cd1899e6b431ab8e901a385065912adeb1
SHA512

2026b561dce762930e3c6a7179d509efb7be482281111f65461328ed6da5c04e1bb7a7bf3f5cd883920a2cdd50e5c72b1c500d6f4963174792f0c183070b0771

Score

10^/10

evilgnome backdoor trojan

Malware Config

Signatures

Detected EvilGnome 4 IoCs

resource	yara_rule
behavioral1/files/0x0000000300089195-2.dat	family_evilgnome
behavioral1/files/0x000000030008919b-8.dat	family_evilgnome
behavioral1/files/0x0000000300089195-7.dat	family_evilgnome
behavioral1/files/0x000000030008919b-29.dat	family_evilgnome

EvilGnome Backdoor
Linux malware which targets desktop users. Includes common stealer/keylogger functionality as well as downloading and executing various modules.
backdoor trojan evilgnome

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/installer.run\""
1⤵
PID:589

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/installer.run\""
1⤵
PID:589

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/installer.run\""
1⤵
PID:589

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/installer.run
1⤵
PID:589

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/installer.run
1⤵
PID:589
- /bin/zsh
  /bin/zsh -c /Users/run/installer.run
  2⤵
  PID:591
- /bin/zsh
  /bin/zsh -c /Users/run/installer.run
  2⤵
  PID:591
- /Users/run/installer.run
  /Users/run/installer.run
  2⤵
  PID:591
- /Users/run/installer.run
  /Users/run/installer.run
  2⤵
  PID:591
- /bin/bash
  /bin/sh /Users/run/installer.run
  2⤵
  PID:591
- /bin/bash
  /bin/sh /Users/run/installer.run
  2⤵
  PID:591
- - /usr/bin/id
    id -u
    3⤵
    PID:593
- - /usr/bin/id
    id -u
    3⤵
    PID:593
- - /usr/bin/tty
    tty -s
    3⤵
    PID:594
- - /usr/bin/tty
    tty -s
    3⤵
    PID:594
- - /bin/mkdir
    mkdir /tmp/selfgz59122337
    3⤵
    PID:595
- - /bin/mkdir
    mkdir /tmp/selfgz59122337
    3⤵
    PID:595
- - /usr/bin/basename
    basename /usr/bin/shasum
    3⤵
    PID:610
- - /usr/bin/basename
    basename /usr/bin/shasum
    3⤵
    PID:610
- - /usr/bin/basename
    basename /sbin/md5
    3⤵
    PID:614
- - /usr/bin/basename
    basename /sbin/md5
    3⤵
    PID:614
- - /bin/expr
    expr 1 + 1
    3⤵
    PID:645
- - /bin/expr
    expr 1 + 1
    3⤵
    PID:645
- - /bin/expr
    expr 14819 + 87287
    3⤵
    PID:646
- - /bin/expr
    expr 14819 + 87287
    3⤵
    PID:646
- - /bin/expr
    expr 14819 + 87287
    3⤵
    PID:682
- - /bin/expr
    expr 14819 + 87287
    3⤵
    PID:682
- - ./setup.sh
    ./setup.sh
    3⤵
    PID:683
- - ./setup.sh
    ./setup.sh
    3⤵
    PID:683
- - /bin/bash
    /bin/sh ./setup.sh
    3⤵
    PID:683
- - /bin/bash
    /bin/sh ./setup.sh
    3⤵
    PID:683
  - - /bin/mkdir
      mkdir -p /Users/run/.cache/gnome-software/gnome-shell-extensions
      4⤵
      PID:684
  - - /bin/mkdir
      mkdir -p /Users/run/.cache/gnome-software/gnome-shell-extensions
      4⤵
      PID:684
  - - /bin/cp
      cp ./gnome-shell-ext /Users/run/.cache/gnome-software/gnome-shell-extensions
      4⤵
      PID:685
  - - /bin/cp
      cp ./gnome-shell-ext /Users/run/.cache/gnome-software/gnome-shell-extensions
      4⤵
      PID:685
  - - /bin/cp
      cp ./gnome-shell-ext.sh /Users/run/.cache/gnome-software/gnome-shell-extensions
      4⤵
      PID:686
  - - /bin/cp
      cp ./gnome-shell-ext.sh /Users/run/.cache/gnome-software/gnome-shell-extensions
      4⤵
      PID:686
  - - /bin/cp
      cp ./rtp.dat /Users/run/.cache/gnome-software/gnome-shell-extensions
      4⤵
      PID:687
  - - /bin/cp
      cp ./rtp.dat /Users/run/.cache/gnome-software/gnome-shell-extensions
      4⤵
      PID:687
  - - /bin/chmod
      chmod +x /Users/run/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext
      4⤵
      PID:688
  - - /bin/chmod
      chmod +x /Users/run/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext
      4⤵
      PID:688
  - - /bin/chmod
      chmod +x /Users/run/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext.sh
      4⤵
      PID:689
  - - /bin/chmod
      chmod +x /Users/run/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext.sh
      4⤵
      PID:689
  - - /usr/bin/grep
      grep -q "0-59 * * * * /Users/run/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext.sh"
      4⤵
      PID:691
  - - /usr/bin/grep
      grep -q "0-59 * * * * /Users/run/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext.sh"
      4⤵
      PID:691
  - - /usr/bin/crontab
      crontab -l
      4⤵
      PID:690
  - - /usr/bin/crontab
      crontab -l
      4⤵
      PID:690
  - - /usr/bin/crontab
      crontab -u root -l
      4⤵
      PID:692
  - - /usr/bin/crontab
      crontab -u root -l
      4⤵
      PID:692
  - - /usr/bin/crontab
      crontab -u root -
      4⤵
      PID:695
  - - /usr/bin/crontab
      crontab -u root -
      4⤵
      PID:695
  - - /usr/bin/nohup
      nohup /Users/run/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext.sh
      4⤵
      PID:698
  - - /usr/bin/nohup
      nohup /Users/run/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext.sh
      4⤵
      PID:698
  - - /bin/rm
      rm -rf -- /private/tmp/selfgz59122337
      4⤵
      PID:700
  - - /bin/rm
      rm -rf -- /private/tmp/selfgz59122337
      4⤵
      PID:700
  - - /Users/run/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext.sh
      /Users/run/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext.sh
      4⤵
      PID:698
  - - /Users/run/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext.sh
      /Users/run/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext.sh
      4⤵
      PID:698
  - - /bin/bash
      /bin/sh /Users/run/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext.sh
      4⤵
      PID:698
  - - /bin/bash
      /bin/sh /Users/run/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext.sh
      4⤵
      PID:698
    - - /Users/run/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext
        
        /Users/run/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext
        5⤵
        
        PID:703
    - - /Users/run/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext
        
        /Users/run/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext
        5⤵
        
        PID:703
- - /bin/rm
    /bin/rm -rf /tmp/selfgz59122337
    3⤵
    PID:701
- - /bin/rm
    /bin/rm -rf /tmp/selfgz59122337
    3⤵
    PID:701

/usr/bin/which
which md5sum
1⤵
PID:598

/usr/bin/which
which md5sum
1⤵
PID:598

/usr/bin/which
which md5
1⤵
PID:600

/usr/bin/which
which md5
1⤵
PID:600

/usr/bin/which
which shasum
1⤵
PID:602

/usr/bin/which
which shasum
1⤵
PID:602

/usr/bin/wc
wc -c
1⤵
PID:605

/usr/bin/wc
wc -c
1⤵
PID:605

/usr/bin/head
head -n 587 /Users/run/installer.run
1⤵
PID:604

/usr/bin/head
head -n 587 /Users/run/installer.run
1⤵
PID:604

/usr/bin/tr
tr -d " "
1⤵
PID:606

/usr/bin/tr
tr -d " "
1⤵
PID:606

/usr/bin/cut
cut "-d " -f1
1⤵
PID:609

/usr/bin/cut
cut "-d " -f1
1⤵
PID:609

/usr/bin/cut
cut "-d " -f1
1⤵
PID:613

/usr/bin/cut
cut "-d " -f1
1⤵
PID:613

/usr/bin/cut
cut "-d " -f1
1⤵
PID:617

/usr/bin/cut
cut "-d " -f1
1⤵
PID:617

/usr/bin/cut
cut -b-32
1⤵
PID:621

/usr/bin/cut
cut -b-32
1⤵
PID:621

/sbin/md5
/sbin/md5
1⤵
PID:622

/sbin/md5
/sbin/md5
1⤵
PID:622

/bin/expr
expr 4194304 / 4
1⤵
PID:624

/bin/expr
expr 4194304 / 4
1⤵
PID:624

/bin/expr
expr 1048576 / 4
1⤵
PID:626

/bin/expr
expr 1048576 / 4
1⤵
PID:626

/bin/expr
expr 262144 / 4
1⤵
PID:628

/bin/expr
expr 262144 / 4
1⤵
PID:628

/bin/expr
expr 87287 / 65536
1⤵
PID:630

/bin/expr
expr 87287 / 65536
1⤵
PID:630

/bin/expr
expr 87287 "%" 65536
1⤵
PID:632

/bin/expr
expr 87287 "%" 65536
1⤵
PID:632

/bin/dd
dd "ibs=14819" "skip=1"
1⤵
PID:634

/bin/dd
dd "ibs=14819" "skip=1"
1⤵
PID:634

/bin/expr
expr 0 + 65536
1⤵
PID:636

/bin/expr
expr 0 + 65536
1⤵
PID:636

/bin/dd
dd "bs=65536" "count=1"
1⤵
PID:637

/bin/dd
dd "bs=65536" "count=1"
1⤵
PID:637

/bin/expr
expr 87287 / 100
1⤵
PID:639

/bin/expr
expr 87287 / 100
1⤵
PID:639

/bin/expr
expr 65536 / 872
1⤵
PID:641

/bin/expr
expr 65536 / 872
1⤵
PID:641

/bin/expr
expr 65536 + 65536
1⤵
PID:643

/bin/expr
expr 65536 + 65536
1⤵
PID:643

/bin/dd
dd "bs=21751" "count=1"
1⤵
PID:644

/bin/dd
dd "bs=21751" "count=1"
1⤵
PID:644

/usr/bin/head
head -n 587 /Users/run/installer.run
1⤵
PID:648

/usr/bin/head
head -n 587 /Users/run/installer.run
1⤵
PID:648

/usr/bin/wc
wc -c
1⤵
PID:649

/usr/bin/wc
wc -c
1⤵
PID:649

/usr/bin/tr
tr -d " "
1⤵
PID:650

/usr/bin/tr
tr -d " "
1⤵
PID:650

/bin/df
df -kP /tmp/selfgz59122337
1⤵
PID:653

/bin/df
df -kP /tmp/selfgz59122337
1⤵
PID:653

/usr/bin/tail
tail -1
1⤵
PID:654

/usr/bin/tail
tail -1
1⤵
PID:654

/usr/bin/awk
awk "{ if (\$4 ~ /%/) {print \$3} else {print \$4} }"
1⤵
PID:655

/usr/bin/awk
awk "{ if (\$4 ~ /%/) {print \$3} else {print \$4} }"
1⤵
PID:655

/bin/expr
expr 4194304 / 4
1⤵
PID:658

/bin/expr
expr 4194304 / 4
1⤵
PID:658

/usr/bin/gzip
gzip -cd
1⤵
PID:662

/usr/bin/gzip
gzip -cd
1⤵
PID:662

/usr/bin/tar
tar xpvf -
1⤵
PID:663

/usr/bin/tar
tar xpvf -
1⤵
PID:663

/bin/expr
expr 1048576 / 4
1⤵
PID:664

/bin/expr
expr 1048576 / 4
1⤵
PID:664

/bin/expr
expr 262144 / 4
1⤵
PID:665

/bin/expr
expr 262144 / 4
1⤵
PID:665

/bin/expr
expr 87287 / 65536
1⤵
PID:666

/bin/expr
expr 87287 / 65536
1⤵
PID:666

/bin/expr
expr 87287 "%" 65536
1⤵
PID:667

/bin/expr
expr 87287 "%" 65536
1⤵
PID:667

/bin/dd
dd "ibs=14819" "skip=1"
1⤵
PID:669

/bin/dd
dd "ibs=14819" "skip=1"
1⤵
PID:669

/bin/expr
expr 0 + 65536
1⤵
PID:670

/bin/expr
expr 0 + 65536
1⤵
PID:670

/bin/dd
dd "bs=65536" "count=1"
1⤵
PID:671

/bin/dd
dd "bs=65536" "count=1"
1⤵
PID:671

/bin/expr
expr 87287 / 100
1⤵
PID:672

/bin/expr
expr 87287 / 100
1⤵
PID:672

/bin/expr
expr 65536 / 872
1⤵
PID:673

/bin/expr
expr 65536 / 872
1⤵
PID:673

/bin/expr
expr 65536 + 65536
1⤵
PID:675

/bin/expr
expr 65536 + 65536
1⤵
PID:675

/bin/dd
dd "bs=21751" "count=1"
1⤵
PID:676

/bin/dd
dd "bs=21751" "count=1"
1⤵
PID:676

/usr/bin/id
id -u
1⤵
PID:678

/usr/bin/id
id -u
1⤵
PID:678

/usr/sbin/chown
chown -R 0 .
1⤵
PID:679

/usr/sbin/chown
chown -R 0 .
1⤵
PID:679

/usr/bin/id
id -g
1⤵
PID:680

/usr/bin/id
id -g
1⤵
PID:680

/usr/bin/chgrp
chgrp -R 0 .
1⤵
PID:681

/usr/bin/chgrp
chgrp -R 0 .
1⤵
PID:681

/usr/bin/whoami
whoami
1⤵
PID:693

/usr/bin/whoami
whoami
1⤵
PID:693

/bin/cat
cat
1⤵
PID:696

/bin/cat
cat
1⤵
PID:696

/usr/bin/whoami
whoami
1⤵
PID:697

/usr/bin/whoami
whoami
1⤵
PID:697

/usr/libexec/xpcproxy
xpcproxy com.vix.cron
1⤵
PID:704

/usr/sbin/cron
/usr/sbin/cron
1⤵
PID:704

/bin/sh
/bin/sh -c /Users/run/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext.sh
1⤵
PID:726

/bin/sh
/bin/sh -c /Users/run/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext.sh
1⤵
PID:726

/bin/bash
/bin/sh -c /Users/run/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext.sh
1⤵
PID:726

/bin/bash
/bin/sh -c /Users/run/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext.sh
1⤵
PID:726

/Users/run/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext.sh
/Users/run/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext.sh
1⤵
PID:726

/Users/run/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext.sh
/Users/run/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext.sh
1⤵
PID:726

/bin/bash
/bin/sh /Users/run/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext.sh
1⤵
PID:726

/bin/bash
/bin/sh /Users/run/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext.sh
1⤵
PID:726
- /var/root/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext
  /var/root/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext
  2⤵
  PID:729
- /var/root/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext
  /var/root/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext
  2⤵
  PID:729

/bin/sh
/bin/sh -c /Users/run/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext.sh
1⤵
PID:733

/bin/sh
/bin/sh -c /Users/run/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext.sh
1⤵
PID:733

/bin/bash
/bin/sh -c /Users/run/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext.sh
1⤵
PID:733

/bin/bash
/bin/sh -c /Users/run/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext.sh
1⤵
PID:733

/Users/run/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext.sh
/Users/run/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext.sh
1⤵
PID:733

/Users/run/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext.sh
/Users/run/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext.sh
1⤵
PID:733

/bin/bash
/bin/sh /Users/run/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext.sh
1⤵
PID:733

/bin/bash
/bin/sh /Users/run/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext.sh
1⤵
PID:733
- /var/root/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext
  /var/root/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext
  2⤵
  PID:736
- /var/root/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext
  /var/root/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext
  2⤵
  PID:736

/bin/sh
/bin/sh -c /Users/run/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext.sh
1⤵
PID:738

/bin/sh
/bin/sh -c /Users/run/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext.sh
1⤵
PID:738

/bin/bash
/bin/sh -c /Users/run/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext.sh
1⤵
PID:738

/bin/bash
/bin/sh -c /Users/run/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext.sh
1⤵
PID:738

/Users/run/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext.sh
/Users/run/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext.sh
1⤵
PID:738

/Users/run/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext.sh
/Users/run/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext.sh
1⤵
PID:738

/bin/bash
/bin/sh /Users/run/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext.sh
1⤵
PID:738

/bin/bash
/bin/sh /Users/run/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext.sh
1⤵
PID:738
- /var/root/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext
  /var/root/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext
  2⤵
  PID:741
- /var/root/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext
  /var/root/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext
  2⤵
  PID:741

/bin/sh
/bin/sh -c /Users/run/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext.sh
1⤵
PID:743

/bin/sh
/bin/sh -c /Users/run/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext.sh
1⤵
PID:743

/bin/bash
/bin/sh -c /Users/run/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext.sh
1⤵
PID:743

/bin/bash
/bin/sh -c /Users/run/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext.sh
1⤵
PID:743

/Users/run/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext.sh
/Users/run/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext.sh
1⤵
PID:743

/Users/run/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext.sh
/Users/run/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext.sh
1⤵
PID:743

/bin/bash
/bin/sh /Users/run/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext.sh
1⤵
PID:743

/bin/bash
/bin/sh /Users/run/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext.sh
1⤵
PID:743
- /var/root/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext
  /var/root/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext
  2⤵
  PID:746
- /var/root/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext
  /var/root/.cache/gnome-software/gnome-shell-extensions/gnome-shell-ext
  2⤵
  PID:746

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads