Analysis

  • max time kernel
    0s
  • max time network
    153s
  • platform
    linux_mips
  • resource
    debian9-mipsbe-en-20211208
  • resource tags

    arch:mipsimage:debian9-mipsbe-en-20211208kernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    16-08-2022 02:49

General

  • Target

    JetBrains 2022 ??/??2????2099????????????/ja-netfilter-all/scripts/uninstall.sh

  • Size

    1KB

  • MD5

    e3f187bb61526539c002a2303bc3325a

  • SHA1

    d3831b8e1b914892f412dc86d5c79f89314e6cd1

  • SHA256

    ae91ad30b493097d0704e97fb122d51f939b14d999267fdd0882058116bfed62

  • SHA512

    cafd9ddcd2139d525a480d65a582aff6119c3f771e9472d2472d9b4b42c76d2b7851c4288e5177907579b5f5181e88586bc8f9e4aafaafb769a096656896c355

Score
5/10

Malware Config

Signatures

  • Reads runtime system information 3 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/JetBrains 2022 ??/??2????2099????????????/ja-netfilter-all/scripts/uninstall.sh
    "/tmp/JetBrains 2022 ??/??2????2099????????????/ja-netfilter-all/scripts/uninstall.sh"
    1⤵
    • Writes file to tmp directory
    PID:320
    • /bin/uname
      uname -s
      2⤵
        PID:321
      • /usr/bin/touch
        touch /.profile
        2⤵
          PID:322
        • /usr/bin/touch
          touch /.bashrc
          2⤵
            PID:323
          • /usr/bin/touch
            touch /.zshrc
            2⤵
              PID:324
            • /bin/rm
              rm -rf /.jetbrains.vmoptions.sh
              2⤵
                PID:326
              • /bin/sed
                sed -i "/___MY_VMOPTIONS_SHELL_FILE=\"\${HOME}\\/\\.jetbrains\\.vmoptions\\.sh\"; if /d" /.profile
                2⤵
                • Reads runtime system information
                PID:327
              • /bin/sed
                sed -i "/___MY_VMOPTIONS_SHELL_FILE=\"\${HOME}\\/\\.jetbrains\\.vmoptions\\.sh\"; if /d" /.bashrc
                2⤵
                • Reads runtime system information
                PID:331
              • /bin/sed
                sed -i "/___MY_VMOPTIONS_SHELL_FILE=\"\${HOME}\\/\\.jetbrains\\.vmoptions\\.sh\"; if /d" /.zshrc
                2⤵
                • Reads runtime system information
                PID:332
              • /bin/rm
                rm -rf /.config/plasma-workspace/env/jetbrains.vmoptions.sh
                2⤵
                  PID:333

              Network

              MITRE ATT&CK Matrix

              Replay Monitor

              Loading Replay Monitor...

              Downloads