Overview
overview
7Static
static
jetbra/???...?.html
windows7-x64
1jetbra/???...?.html
windows10-2004-x64
5jetbra/ja-...er.jar
windows7-x64
1jetbra/ja-...er.jar
windows10-2004-x64
1jetbra/plu...ns.jar
windows7-x64
1jetbra/plu...ns.jar
windows10-2004-x64
1jetbra/plu...me.jar
windows7-x64
1jetbra/plu...me.jar
windows10-2004-x64
1jetbra/plu...er.jar
windows7-x64
1jetbra/plu...er.jar
windows10-2004-x64
1jetbra/plu...rl.jar
windows7-x64
1jetbra/plu...rl.jar
windows10-2004-x64
1jetbra/scr...rs.vbs
windows7-x64
3jetbra/scr...rs.vbs
windows10-2004-x64
7jetbra/scr...er.vbs
windows7-x64
1jetbra/scr...er.vbs
windows10-2004-x64
1jetbra/scr...all.sh
ubuntu-18.04-amd64
5jetbra/scr...all.sh
debian-9-armhf
5jetbra/scr...all.sh
debian-9-mips
5jetbra/scr...all.sh
debian-9-mipsel
5jetbra/scr...rs.vbs
windows7-x64
3jetbra/scr...rs.vbs
windows10-2004-x64
7jetbra/scr...er.vbs
windows7-x64
1jetbra/scr...er.vbs
windows10-2004-x64
1jetbra/scr...all.sh
ubuntu-18.04-amd64
5jetbra/scr...all.sh
debian-9-armhf
5jetbra/scr...all.sh
debian-9-mips
5jetbra/scr...all.sh
debian-9-mipsel
5Analysis
-
max time kernel
0s -
max time network
153s -
platform
linux_mips -
resource
debian9-mipsbe-en-20211208 -
resource tags
arch:mipsimage:debian9-mipsbe-en-20211208kernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
16-08-2022 03:01
Static task
static1
Behavioral task
behavioral1
Sample
jetbra/?????????????????.html
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
jetbra/?????????????????.html
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
jetbra/ja-netfilter.jar
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
jetbra/ja-netfilter.jar
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
jetbra/plugins-jetbrains/dns.jar
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
jetbra/plugins-jetbrains/dns.jar
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
jetbra/plugins-jetbrains/hideme.jar
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
jetbra/plugins-jetbrains/hideme.jar
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
jetbra/plugins-jetbrains/power.jar
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
jetbra/plugins-jetbrains/power.jar
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
jetbra/plugins-jetbrains/url.jar
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
jetbra/plugins-jetbrains/url.jar
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
jetbra/scripts/install-all-users.vbs
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
jetbra/scripts/install-all-users.vbs
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
jetbra/scripts/install-current-user.vbs
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
jetbra/scripts/install-current-user.vbs
Resource
win10v2004-20220812-en
Behavioral task
behavioral17
Sample
jetbra/scripts/install.sh
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral18
Sample
jetbra/scripts/install.sh
Resource
debian9-armhf-en-20211208
Behavioral task
behavioral19
Sample
jetbra/scripts/install.sh
Resource
debian9-mipsbe-en-20211208
Behavioral task
behavioral20
Sample
jetbra/scripts/install.sh
Resource
debian9-mipsel-en-20211208
Behavioral task
behavioral21
Sample
jetbra/scripts/uninstall-all-users.vbs
Resource
win7-20220812-en
Behavioral task
behavioral22
Sample
jetbra/scripts/uninstall-all-users.vbs
Resource
win10v2004-20220812-en
Behavioral task
behavioral23
Sample
jetbra/scripts/uninstall-current-user.vbs
Resource
win7-20220812-en
Behavioral task
behavioral24
Sample
jetbra/scripts/uninstall-current-user.vbs
Resource
win10v2004-20220812-en
Behavioral task
behavioral25
Sample
jetbra/scripts/uninstall.sh
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral26
Sample
jetbra/scripts/uninstall.sh
Resource
debian9-armhf-en-20211208
Behavioral task
behavioral27
Sample
jetbra/scripts/uninstall.sh
Resource
debian9-mipsbe-en-20211208
Behavioral task
behavioral28
Sample
jetbra/scripts/uninstall.sh
Resource
debian9-mipsel-en-20211208
General
-
Target
jetbra/scripts/install.sh
-
Size
3KB
-
MD5
4f86ad982a9cdf710d297f30a1c35d3e
-
SHA1
32eb21a4fd2a0ae3ead868dd550d30b64409a883
-
SHA256
ff7b76ed04b0ca7e42b380fd3426b4ea14dd1e6fd39154fcd32ef9e11907478f
-
SHA512
99a8eacfe80870912a334804ccfcdba1f13a0a5a78f6e4325d124aaf0a1b0352f47fb0144f68003670acb4565ea694f550608fc7343668a2a3d819c03e3e1802
Malware Config
Signatures
-
Reads runtime system information 21 IoCs
Reads data from /proc virtual filesystem.
Processes:
sedsedsedsedsedsedsedsedsedsedsedsedsedsedsedsedsedsedmkdirsedseddescription ioc process /proc/filesystems /proc/filesystems sed /proc/filesystems /proc/filesystems sed /proc/filesystems /proc/filesystems sed /proc/filesystems /proc/filesystems sed /proc/filesystems /proc/filesystems sed /proc/filesystems /proc/filesystems sed /proc/filesystems /proc/filesystems sed /proc/filesystems /proc/filesystems sed /proc/filesystems /proc/filesystems sed /proc/filesystems /proc/filesystems sed /proc/filesystems /proc/filesystems sed /proc/filesystems /proc/filesystems sed /proc/filesystems /proc/filesystems sed /proc/filesystems /proc/filesystems sed /proc/filesystems /proc/filesystems sed /proc/filesystems /proc/filesystems sed /proc/filesystems /proc/filesystems sed /proc/filesystems /proc/filesystems sed /proc/filesystems /proc/filesystems mkdir /proc/filesystems /proc/filesystems sed /proc/filesystems /proc/filesystems sed -
Writes file to tmp directory 52 IoCs
Malware often drops required files in the /tmp directory.
Processes:
sedinstall.shsedsedsedsedsedsedsedsedsedsedsedsedsedsedsedseddescription ioc process /tmp/jetbra/vmoptions/sedJQvswl /tmp/jetbra/vmoptions/sedJQvswl sed /tmp/jetbra/vmoptions/dataspell.vmoptions /tmp/jetbra/vmoptions/dataspell.vmoptions install.sh /tmp/jetbra/vmoptions/gateway.vmoptions /tmp/jetbra/vmoptions/gateway.vmoptions install.sh /tmp/jetbra/vmoptions/jetbrains_client.vmoptions /tmp/jetbra/vmoptions/jetbrains_client.vmoptions sed /tmp/jetbra/vmoptions/clion.vmoptions /tmp/jetbra/vmoptions/clion.vmoptions sed /tmp/jetbra/vmoptions/phpstorm.vmoptions /tmp/jetbra/vmoptions/phpstorm.vmoptions sed /tmp/jetbra/vmoptions/sedq91Z3t /tmp/jetbra/vmoptions/sedq91Z3t sed /tmp/jetbra/vmoptions/webstorm.vmoptions /tmp/jetbra/vmoptions/webstorm.vmoptions sed /tmp/jetbra/vmoptions/studio.vmoptions /tmp/jetbra/vmoptions/studio.vmoptions install.sh /tmp/jetbra/vmoptions/devecostudio.vmoptions /tmp/jetbra/vmoptions/devecostudio.vmoptions install.sh /tmp/jetbra/vmoptions/pycharm.vmoptions /tmp/jetbra/vmoptions/pycharm.vmoptions sed /tmp/jetbra/vmoptions/rider.vmoptions /tmp/jetbra/vmoptions/rider.vmoptions sed /tmp/jetbra/vmoptions/sedR4BhIy /tmp/jetbra/vmoptions/sedR4BhIy sed /tmp/jetbra/vmoptions/jetbrainsclient.vmoptions /tmp/jetbra/vmoptions/jetbrainsclient.vmoptions install.sh /tmp/jetbra/vmoptions/dataspell.vmoptions /tmp/jetbra/vmoptions/dataspell.vmoptions sed /tmp/jetbra/vmoptions/sedLOMKuR /tmp/jetbra/vmoptions/sedLOMKuR sed /tmp/jetbra/vmoptions/clion.vmoptions /tmp/jetbra/vmoptions/clion.vmoptions install.sh /tmp/jetbra/vmoptions/goland.vmoptions /tmp/jetbra/vmoptions/goland.vmoptions sed /tmp/jetbra/vmoptions/sedn5Ok4L /tmp/jetbra/vmoptions/sedn5Ok4L sed /tmp/jetbra/vmoptions/jetbrains_client.vmoptions /tmp/jetbra/vmoptions/jetbrains_client.vmoptions install.sh /tmp/jetbra/vmoptions/sedKz1WRd /tmp/jetbra/vmoptions/sedKz1WRd sed /tmp/jetbra/vmoptions/appcode.vmoptions /tmp/jetbra/vmoptions/appcode.vmoptions install.sh /tmp/jetbra/vmoptions/sedFmQFf4 /tmp/jetbra/vmoptions/sedFmQFf4 sed /tmp/jetbra/vmoptions/sedUbV1mk /tmp/jetbra/vmoptions/sedUbV1mk sed /tmp/jetbra/vmoptions/studio.vmoptions /tmp/jetbra/vmoptions/studio.vmoptions sed /tmp/jetbra/scripts/install.sh /tmp/jetbra/scripts/install.sh install.sh /tmp/jetbra/vmoptions/idea.vmoptions /tmp/jetbra/vmoptions/idea.vmoptions install.sh /tmp/jetbra/vmoptions/sedcC3hHJ /tmp/jetbra/vmoptions/sedcC3hHJ sed /tmp/jetbra/vmoptions/gateway.vmoptions /tmp/jetbra/vmoptions/gateway.vmoptions sed /tmp/jetbra/vmoptions/webide.vmoptions /tmp/jetbra/vmoptions/webide.vmoptions install.sh /tmp/jetbra/vmoptions/rubymine.vmoptions /tmp/jetbra/vmoptions/rubymine.vmoptions sed /tmp/jetbra/vmoptions/appcode.vmoptions /tmp/jetbra/vmoptions/appcode.vmoptions sed /tmp/jetbra/vmoptions/idea.vmoptions /tmp/jetbra/vmoptions/idea.vmoptions sed /tmp/jetbra/vmoptions/sedjOsYAx /tmp/jetbra/vmoptions/sedjOsYAx sed /tmp/jetbra/vmoptions/sedLMoXA8 /tmp/jetbra/vmoptions/sedLMoXA8 sed /tmp/jetbra/vmoptions/sedIwQ9Ld /tmp/jetbra/vmoptions/sedIwQ9Ld sed /tmp/jetbra/vmoptions/devecostudio.vmoptions /tmp/jetbra/vmoptions/devecostudio.vmoptions sed /tmp/jetbra/vmoptions/sedWQK2JZ /tmp/jetbra/vmoptions/sedWQK2JZ sed /tmp/jetbra/vmoptions/goland.vmoptions /tmp/jetbra/vmoptions/goland.vmoptions install.sh /tmp/jetbra/vmoptions/datagrip.vmoptions /tmp/jetbra/vmoptions/datagrip.vmoptions install.sh /tmp/jetbra/vmoptions/rubymine.vmoptions /tmp/jetbra/vmoptions/rubymine.vmoptions install.sh /tmp/jetbra/vmoptions/sedy68u5y /tmp/jetbra/vmoptions/sedy68u5y sed /tmp/jetbra/vmoptions/sedcEP8l1 /tmp/jetbra/vmoptions/sedcEP8l1 sed /tmp/jetbra/vmoptions/rider.vmoptions /tmp/jetbra/vmoptions/rider.vmoptions install.sh /tmp/jetbra/vmoptions/datagrip.vmoptions /tmp/jetbra/vmoptions/datagrip.vmoptions sed /tmp/jetbra/vmoptions/sedB8ANXj /tmp/jetbra/vmoptions/sedB8ANXj sed /tmp/jetbra/vmoptions/phpstorm.vmoptions /tmp/jetbra/vmoptions/phpstorm.vmoptions install.sh /tmp/jetbra/vmoptions/pycharm.vmoptions /tmp/jetbra/vmoptions/pycharm.vmoptions install.sh /tmp/jetbra/vmoptions/webstorm.vmoptions /tmp/jetbra/vmoptions/webstorm.vmoptions install.sh /tmp/jetbra/vmoptions/webide.vmoptions /tmp/jetbra/vmoptions/webide.vmoptions sed /tmp/jetbra/vmoptions/jetbrainsclient.vmoptions /tmp/jetbra/vmoptions/jetbrainsclient.vmoptions sed /tmp/jetbra/vmoptions/sedYRj5nM /tmp/jetbra/vmoptions/sedYRj5nM sed
Processes
-
/tmp/jetbra/scripts/install.sh/tmp/jetbra/scripts/install.sh1⤵
- Writes file to tmp directory
-
/bin/unameuname -s2⤵
-
/usr/bin/dirnamedirname /tmp/jetbra/scripts2⤵
-
/bin/mkdirmkdir -p /.config/plasma-workspace/env2⤵
- Reads runtime system information
-
/usr/bin/touchtouch /.profile2⤵
-
/usr/bin/touchtouch /.bashrc2⤵
-
/usr/bin/touchtouch /.zshrc2⤵
-
/bin/sedsed -i "/^\\-javaagent:.*[\\/\\\\]ja\\-netfilter\\.jar.*/d" /tmp/jetbra/vmoptions/idea.vmoptions2⤵
- Reads runtime system information
- Writes file to tmp directory
-
/bin/sedsed -i "/^\\-javaagent:.*[\\/\\\\]ja\\-netfilter\\.jar.*/d" /tmp/jetbra/vmoptions/clion.vmoptions2⤵
- Reads runtime system information
- Writes file to tmp directory
-
/bin/sedsed -i "/^\\-javaagent:.*[\\/\\\\]ja\\-netfilter\\.jar.*/d" /tmp/jetbra/vmoptions/phpstorm.vmoptions2⤵
- Reads runtime system information
- Writes file to tmp directory
-
/bin/sedsed -i "/^\\-javaagent:.*[\\/\\\\]ja\\-netfilter\\.jar.*/d" /tmp/jetbra/vmoptions/goland.vmoptions2⤵
- Reads runtime system information
- Writes file to tmp directory
-
/bin/sedsed -i "/^\\-javaagent:.*[\\/\\\\]ja\\-netfilter\\.jar.*/d" /tmp/jetbra/vmoptions/pycharm.vmoptions2⤵
- Reads runtime system information
- Writes file to tmp directory
-
/bin/sedsed -i "/^\\-javaagent:.*[\\/\\\\]ja\\-netfilter\\.jar.*/d" /tmp/jetbra/vmoptions/webstorm.vmoptions2⤵
- Reads runtime system information
- Writes file to tmp directory
-
/bin/sedsed -i "/^\\-javaagent:.*[\\/\\\\]ja\\-netfilter\\.jar.*/d" /tmp/jetbra/vmoptions/webide.vmoptions2⤵
- Reads runtime system information
- Writes file to tmp directory
-
/bin/sedsed -i "/^\\-javaagent:.*[\\/\\\\]ja\\-netfilter\\.jar.*/d" /tmp/jetbra/vmoptions/rider.vmoptions2⤵
- Reads runtime system information
- Writes file to tmp directory
-
/bin/sedsed -i "/^\\-javaagent:.*[\\/\\\\]ja\\-netfilter\\.jar.*/d" /tmp/jetbra/vmoptions/datagrip.vmoptions2⤵
- Reads runtime system information
- Writes file to tmp directory
-
/bin/sedsed -i "/^\\-javaagent:.*[\\/\\\\]ja\\-netfilter\\.jar.*/d" /tmp/jetbra/vmoptions/rubymine.vmoptions2⤵
- Reads runtime system information
- Writes file to tmp directory
-
/bin/sedsed -i "/^\\-javaagent:.*[\\/\\\\]ja\\-netfilter\\.jar.*/d" /tmp/jetbra/vmoptions/appcode.vmoptions2⤵
- Reads runtime system information
- Writes file to tmp directory
-
/bin/sedsed -i "/^\\-javaagent:.*[\\/\\\\]ja\\-netfilter\\.jar.*/d" /tmp/jetbra/vmoptions/dataspell.vmoptions2⤵
- Reads runtime system information
- Writes file to tmp directory
-
/bin/sedsed -i "/^\\-javaagent:.*[\\/\\\\]ja\\-netfilter\\.jar.*/d" /tmp/jetbra/vmoptions/gateway.vmoptions2⤵
- Reads runtime system information
- Writes file to tmp directory
-
/bin/sedsed -i "/^\\-javaagent:.*[\\/\\\\]ja\\-netfilter\\.jar.*/d" /tmp/jetbra/vmoptions/jetbrains_client.vmoptions2⤵
- Reads runtime system information
- Writes file to tmp directory
-
/bin/sedsed -i "/^\\-javaagent:.*[\\/\\\\]ja\\-netfilter\\.jar.*/d" /tmp/jetbra/vmoptions/jetbrainsclient.vmoptions2⤵
- Reads runtime system information
- Writes file to tmp directory
-
/bin/sedsed -i "/^\\-javaagent:.*[\\/\\\\]ja\\-netfilter\\.jar.*/d" /tmp/jetbra/vmoptions/studio.vmoptions2⤵
- Reads runtime system information
- Writes file to tmp directory
-
/bin/sedsed -i "/^\\-javaagent:.*[\\/\\\\]ja\\-netfilter\\.jar.*/d" /tmp/jetbra/vmoptions/devecostudio.vmoptions2⤵
- Reads runtime system information
- Writes file to tmp directory
-
/bin/sedsed -i "/___MY_VMOPTIONS_SHELL_FILE=\"\${HOME}\\/\\.jetbrains\\.vmoptions\\.sh\"; if /d" /.profile2⤵
- Reads runtime system information
-
/bin/sedsed -i "/___MY_VMOPTIONS_SHELL_FILE=\"\${HOME}\\/\\.jetbrains\\.vmoptions\\.sh\"; if /d" /.bashrc2⤵
- Reads runtime system information
-
/bin/sedsed -i "/___MY_VMOPTIONS_SHELL_FILE=\"\${HOME}\\/\\.jetbrains\\.vmoptions\\.sh\"; if /d" /.zshrc2⤵
- Reads runtime system information
-
/bin/lnln -sf /.jetbrains.vmoptions.sh /.config/plasma-workspace/env/jetbrains.vmoptions.sh2⤵
-
/usr/bin/dirnamedirname /tmp/jetbra/scripts/install.sh1⤵
-
/usr/bin/trtr "[a-z]" "[A-Z]"1⤵
-
/usr/bin/trtr "[a-z]" "[A-Z]"1⤵
-
/usr/bin/trtr "[a-z]" "[A-Z]"1⤵
-
/usr/bin/trtr "[a-z]" "[A-Z]"1⤵
-
/usr/bin/trtr "[a-z]" "[A-Z]"1⤵
-
/usr/bin/trtr "[a-z]" "[A-Z]"1⤵
-
/usr/bin/trtr "[a-z]" "[A-Z]"1⤵
-
/usr/bin/trtr "[a-z]" "[A-Z]"1⤵
-
/usr/bin/trtr "[a-z]" "[A-Z]"1⤵
-
/usr/bin/trtr "[a-z]" "[A-Z]"1⤵
-
/usr/bin/trtr "[a-z]" "[A-Z]"1⤵
-
/usr/bin/trtr "[a-z]" "[A-Z]"1⤵
-
/usr/bin/trtr "[a-z]" "[A-Z]"1⤵
-
/usr/bin/trtr "[a-z]" "[A-Z]"1⤵
-
/usr/bin/trtr "[a-z]" "[A-Z]"1⤵
-
/usr/bin/trtr "[a-z]" "[A-Z]"1⤵
-
/usr/bin/trtr "[a-z]" "[A-Z]"1⤵