8ea07077502eacce3b5c7d08f71abb1daee1fdc626548ba20953aa31e54c465e

Analysis

max time kernel
0s
max time network
103s
platform
linux_amd64
resource
ubuntu1804-amd64-en-20211208
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
16-08-2022 02:49

Target

JetBrains 2022 ??/??2????2099????????????/ja-netfilter-all/scripts/uninstall.sh
Size

1KB
MD5

e3f187bb61526539c002a2303bc3325a
SHA1

d3831b8e1b914892f412dc86d5c79f89314e6cd1
SHA256

ae91ad30b493097d0704e97fb122d51f939b14d999267fdd0882058116bfed62
SHA512

cafd9ddcd2139d525a480d65a582aff6119c3f771e9472d2472d9b4b42c76d2b7851c4288e5177907579b5f5181e88586bc8f9e4aafaafb769a096656896c355

Score

5^/10

Reads runtime system information 3 IoCs
Reads data from /proc virtual filesystem.

Processes:

sedsedsed

description ioc process

/proc/filesystems /proc/filesystems sed
/proc/filesystems /proc/filesystems sed
/proc/filesystems /proc/filesystems sed

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

Processes:

uninstall.sh

description	ioc	process
/tmp/JetBrains 2022 ??/??2????2099????????????/ja-netfilter-all/scripts/uninstall.sh	/tmp/JetBrains 2022 ??/??2????2099????????????/ja-netfilter-all/scripts/uninstall.sh	uninstall.sh

/tmp/JetBrains 2022 ??/??2????2099????????????/ja-netfilter-all/scripts/uninstall.sh
"/tmp/JetBrains 2022 ??/??2????2099????????????/ja-netfilter-all/scripts/uninstall.sh"
1⤵
- Writes file to tmp directory
PID:580
- /bin/uname
  uname -s
  2⤵
  PID:581
- /usr/bin/touch
  touch /.profile
  2⤵
  PID:582
- /usr/bin/touch
  touch /.bashrc
  2⤵
  PID:583
- /usr/bin/touch
  touch /.zshrc
  2⤵
  PID:584
- /bin/rm
  rm -rf /.jetbrains.vmoptions.sh
  2⤵
  PID:585
- /bin/sed
  sed -i "/___MY_VMOPTIONS_SHELL_FILE=\"\${HOME}\\/\\.jetbrains\\.vmoptions\\.sh\"; if /d" /.profile
  2⤵
  - Reads runtime system information
  PID:586
- /bin/sed
  sed -i "/___MY_VMOPTIONS_SHELL_FILE=\"\${HOME}\\/\\.jetbrains\\.vmoptions\\.sh\"; if /d" /.bashrc
  2⤵
  - Reads runtime system information
  PID:587
- /bin/sed
  sed -i "/___MY_VMOPTIONS_SHELL_FILE=\"\${HOME}\\/\\.jetbrains\\.vmoptions\\.sh\"; if /d" /.zshrc
  2⤵
  - Reads runtime system information
  PID:588
- /bin/rm
  rm -rf /.config/plasma-workspace/env/jetbrains.vmoptions.sh
  2⤵
  PID:589