Analysis
-
max time kernel
0s -
max time network
157s -
platform
linux_armhf -
resource
debian9-armhf-en-20211208 -
resource tags
-
submitted
16-08-2022 03:01
General
-
Target
jetbra/scripts/install.sh
-
Size
3KB
-
MD5
4f86ad982a9cdf710d297f30a1c35d3e
-
SHA1
32eb21a4fd2a0ae3ead868dd550d30b64409a883
-
SHA256
ff7b76ed04b0ca7e42b380fd3426b4ea14dd1e6fd39154fcd32ef9e11907478f
-
SHA512
99a8eacfe80870912a334804ccfcdba1f13a0a5a78f6e4325d124aaf0a1b0352f47fb0144f68003670acb4565ea694f550608fc7343668a2a3d819c03e3e1802
Score
5/10
Malware Config
Signatures
-
Reads runtime system information 21 IoCs
Reads data from /proc virtual filesystem.
-
Writes file to tmp directory 52 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/jetbra/scripts/install.sh/tmp/jetbra/scripts/install.sh1⤵
- Writes file to tmp directory
-
/bin/unameuname -s2⤵
-
/usr/bin/dirnamedirname /tmp/jetbra/scripts2⤵
-
/bin/mkdirmkdir -p /.config/plasma-workspace/env2⤵
- Reads runtime system information
-
/usr/bin/touchtouch /.profile2⤵
-
/usr/bin/touchtouch /.bashrc2⤵
-
/usr/bin/touchtouch /.zshrc2⤵
-
/bin/sedsed -i "/^\\-javaagent:.*[\\/\\\\]ja\\-netfilter\\.jar.*/d" /tmp/jetbra/vmoptions/idea.vmoptions2⤵
- Reads runtime system information
- Writes file to tmp directory
-
/bin/sedsed -i "/^\\-javaagent:.*[\\/\\\\]ja\\-netfilter\\.jar.*/d" /tmp/jetbra/vmoptions/clion.vmoptions2⤵
- Reads runtime system information
- Writes file to tmp directory
-
/bin/sedsed -i "/^\\-javaagent:.*[\\/\\\\]ja\\-netfilter\\.jar.*/d" /tmp/jetbra/vmoptions/phpstorm.vmoptions2⤵
- Reads runtime system information
- Writes file to tmp directory
-
/bin/sedsed -i "/^\\-javaagent:.*[\\/\\\\]ja\\-netfilter\\.jar.*/d" /tmp/jetbra/vmoptions/goland.vmoptions2⤵
- Reads runtime system information
- Writes file to tmp directory
-
/bin/sedsed -i "/^\\-javaagent:.*[\\/\\\\]ja\\-netfilter\\.jar.*/d" /tmp/jetbra/vmoptions/pycharm.vmoptions2⤵
- Reads runtime system information
- Writes file to tmp directory
-
/bin/sedsed -i "/^\\-javaagent:.*[\\/\\\\]ja\\-netfilter\\.jar.*/d" /tmp/jetbra/vmoptions/webstorm.vmoptions2⤵
- Reads runtime system information
- Writes file to tmp directory
-
/bin/sedsed -i "/^\\-javaagent:.*[\\/\\\\]ja\\-netfilter\\.jar.*/d" /tmp/jetbra/vmoptions/webide.vmoptions2⤵
- Reads runtime system information
- Writes file to tmp directory
-
/bin/sedsed -i "/^\\-javaagent:.*[\\/\\\\]ja\\-netfilter\\.jar.*/d" /tmp/jetbra/vmoptions/rider.vmoptions2⤵
- Reads runtime system information
- Writes file to tmp directory
-
/bin/sedsed -i "/^\\-javaagent:.*[\\/\\\\]ja\\-netfilter\\.jar.*/d" /tmp/jetbra/vmoptions/datagrip.vmoptions2⤵
- Reads runtime system information
- Writes file to tmp directory
-
/bin/sedsed -i "/^\\-javaagent:.*[\\/\\\\]ja\\-netfilter\\.jar.*/d" /tmp/jetbra/vmoptions/rubymine.vmoptions2⤵
- Reads runtime system information
- Writes file to tmp directory
-
/bin/sedsed -i "/^\\-javaagent:.*[\\/\\\\]ja\\-netfilter\\.jar.*/d" /tmp/jetbra/vmoptions/appcode.vmoptions2⤵
- Reads runtime system information
- Writes file to tmp directory
-
/bin/sedsed -i "/^\\-javaagent:.*[\\/\\\\]ja\\-netfilter\\.jar.*/d" /tmp/jetbra/vmoptions/dataspell.vmoptions2⤵
- Reads runtime system information
- Writes file to tmp directory
-
/bin/sedsed -i "/^\\-javaagent:.*[\\/\\\\]ja\\-netfilter\\.jar.*/d" /tmp/jetbra/vmoptions/gateway.vmoptions2⤵
- Reads runtime system information
- Writes file to tmp directory
-
/bin/sedsed -i "/^\\-javaagent:.*[\\/\\\\]ja\\-netfilter\\.jar.*/d" /tmp/jetbra/vmoptions/jetbrains_client.vmoptions2⤵
- Reads runtime system information
- Writes file to tmp directory
-
/bin/sedsed -i "/^\\-javaagent:.*[\\/\\\\]ja\\-netfilter\\.jar.*/d" /tmp/jetbra/vmoptions/jetbrainsclient.vmoptions2⤵
- Reads runtime system information
- Writes file to tmp directory
-
/bin/sedsed -i "/^\\-javaagent:.*[\\/\\\\]ja\\-netfilter\\.jar.*/d" /tmp/jetbra/vmoptions/studio.vmoptions2⤵
- Reads runtime system information
- Writes file to tmp directory
-
/bin/sedsed -i "/^\\-javaagent:.*[\\/\\\\]ja\\-netfilter\\.jar.*/d" /tmp/jetbra/vmoptions/devecostudio.vmoptions2⤵
- Reads runtime system information
- Writes file to tmp directory
-
/bin/sedsed -i "/___MY_VMOPTIONS_SHELL_FILE=\"\${HOME}\\/\\.jetbrains\\.vmoptions\\.sh\"; if /d" /.profile2⤵
- Reads runtime system information
-
/bin/sedsed -i "/___MY_VMOPTIONS_SHELL_FILE=\"\${HOME}\\/\\.jetbrains\\.vmoptions\\.sh\"; if /d" /.bashrc2⤵
- Reads runtime system information
-
/bin/sedsed -i "/___MY_VMOPTIONS_SHELL_FILE=\"\${HOME}\\/\\.jetbrains\\.vmoptions\\.sh\"; if /d" /.zshrc2⤵
- Reads runtime system information
-
/bin/lnln -sf /.jetbrains.vmoptions.sh /.config/plasma-workspace/env/jetbrains.vmoptions.sh2⤵
-
/usr/bin/dirnamedirname /tmp/jetbra/scripts/install.sh1⤵
-
/usr/bin/trtr "[a-z]" "[A-Z]"1⤵
-
/usr/bin/trtr "[a-z]" "[A-Z]"1⤵
-
/usr/bin/trtr "[a-z]" "[A-Z]"1⤵
-
/usr/bin/trtr "[a-z]" "[A-Z]"1⤵
-
/usr/bin/trtr "[a-z]" "[A-Z]"1⤵
-
/usr/bin/trtr "[a-z]" "[A-Z]"1⤵
-
/usr/bin/trtr "[a-z]" "[A-Z]"1⤵
-
/usr/bin/trtr "[a-z]" "[A-Z]"1⤵
-
/usr/bin/trtr "[a-z]" "[A-Z]"1⤵
-
/usr/bin/trtr "[a-z]" "[A-Z]"1⤵
-
/usr/bin/trtr "[a-z]" "[A-Z]"1⤵
-
/usr/bin/trtr "[a-z]" "[A-Z]"1⤵
-
/usr/bin/trtr "[a-z]" "[A-Z]"1⤵
-
/usr/bin/trtr "[a-z]" "[A-Z]"1⤵
-
/usr/bin/trtr "[a-z]" "[A-Z]"1⤵
-
/usr/bin/trtr "[a-z]" "[A-Z]"1⤵
-
/usr/bin/trtr "[a-z]" "[A-Z]"1⤵