8ea07077502eacce3b5c7d08f71abb1daee1fdc626548ba20953aa31e54c465e

Analysis

max time kernel
0s
max time network
153s
platform
linux_mips
resource
debian9-mipsbe-en-20211208
resource tags

arch:mipsimage:debian9-mipsbe-en-20211208kernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
16-08-2022 02:49

Target

JetBrains 2022 ??/??2????2099????????????/ja-netfilter-all/scripts/uninstall.sh
Size

1KB
MD5

e3f187bb61526539c002a2303bc3325a
SHA1

d3831b8e1b914892f412dc86d5c79f89314e6cd1
SHA256

ae91ad30b493097d0704e97fb122d51f939b14d999267fdd0882058116bfed62
SHA512

cafd9ddcd2139d525a480d65a582aff6119c3f771e9472d2472d9b4b42c76d2b7851c4288e5177907579b5f5181e88586bc8f9e4aafaafb769a096656896c355

Score

5^/10

Reads runtime system information 3 IoCs
Reads data from /proc virtual filesystem.

Processes:

sedsedsed

description ioc process

/proc/filesystems /proc/filesystems sed
/proc/filesystems /proc/filesystems sed
/proc/filesystems /proc/filesystems sed

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

Processes:

uninstall.sh

description	ioc	process
/tmp/JetBrains 2022 ??/??2????2099????????????/ja-netfilter-all/scripts/uninstall.sh	/tmp/JetBrains 2022 ??/??2????2099????????????/ja-netfilter-all/scripts/uninstall.sh	uninstall.sh

/tmp/JetBrains 2022 ??/??2????2099????????????/ja-netfilter-all/scripts/uninstall.sh
"/tmp/JetBrains 2022 ??/??2????2099????????????/ja-netfilter-all/scripts/uninstall.sh"
1⤵
- Writes file to tmp directory
PID:320
- /bin/uname
  uname -s
  2⤵
  PID:321
- /usr/bin/touch
  touch /.profile
  2⤵
  PID:322
- /usr/bin/touch
  touch /.bashrc
  2⤵
  PID:323
- /usr/bin/touch
  touch /.zshrc
  2⤵
  PID:324
- /bin/rm
  rm -rf /.jetbrains.vmoptions.sh
  2⤵
  PID:326
- /bin/sed
  sed -i "/___MY_VMOPTIONS_SHELL_FILE=\"\${HOME}\\/\\.jetbrains\\.vmoptions\\.sh\"; if /d" /.profile
  2⤵
  - Reads runtime system information
  PID:327
- /bin/sed
  sed -i "/___MY_VMOPTIONS_SHELL_FILE=\"\${HOME}\\/\\.jetbrains\\.vmoptions\\.sh\"; if /d" /.bashrc
  2⤵
  - Reads runtime system information
  PID:331
- /bin/sed
  sed -i "/___MY_VMOPTIONS_SHELL_FILE=\"\${HOME}\\/\\.jetbrains\\.vmoptions\\.sh\"; if /d" /.zshrc
  2⤵
  - Reads runtime system information
  PID:332
- /bin/rm
  rm -rf /.config/plasma-workspace/env/jetbrains.vmoptions.sh
  2⤵
  PID:333