Analysis
-
max time kernel
6s -
max time network
132s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20231215-en -
resource tags
-
submitted
20/12/2023, 09:26 UTC
General
-
Target
scripts/install.sh
-
Size
3KB
-
MD5
4f86ad982a9cdf710d297f30a1c35d3e
-
SHA1
32eb21a4fd2a0ae3ead868dd550d30b64409a883
-
SHA256
ff7b76ed04b0ca7e42b380fd3426b4ea14dd1e6fd39154fcd32ef9e11907478f
-
SHA512
99a8eacfe80870912a334804ccfcdba1f13a0a5a78f6e4325d124aaf0a1b0352f47fb0144f68003670acb4565ea694f550608fc7343668a2a3d819c03e3e1802
Malware Config
Signatures
-
Reads runtime system information 21 IoCs
Reads data from /proc virtual filesystem.
-
Writes file to tmp directory 34 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/scripts/install.sh/tmp/scripts/install.sh1⤵
- Writes file to tmp directory
-
/bin/unameuname -s2⤵
-
-
/usr/bin/dirnamedirname /tmp/scripts2⤵
-
-
/bin/mkdirmkdir -p /.config/plasma-workspace/env2⤵
- Reads runtime system information
-
-
/usr/bin/touchtouch /.profile2⤵
-
-
/usr/bin/touchtouch /.bashrc2⤵
-
-
/usr/bin/touchtouch /.zshrc2⤵
-
-
/bin/sedsed -i "/^\\-javaagent:.*[\\/\\\\]ja\\-netfilter\\.jar.*/d" /tmp/vmoptions/idea.vmoptions2⤵
- Reads runtime system information
- Writes file to tmp directory
-
-
/bin/sedsed -i "/^\\-javaagent:.*[\\/\\\\]ja\\-netfilter\\.jar.*/d" /tmp/vmoptions/clion.vmoptions2⤵
- Reads runtime system information
- Writes file to tmp directory
-
-
/bin/sedsed -i "/^\\-javaagent:.*[\\/\\\\]ja\\-netfilter\\.jar.*/d" /tmp/vmoptions/phpstorm.vmoptions2⤵
- Reads runtime system information
- Writes file to tmp directory
-
-
/bin/sedsed -i "/^\\-javaagent:.*[\\/\\\\]ja\\-netfilter\\.jar.*/d" /tmp/vmoptions/goland.vmoptions2⤵
- Reads runtime system information
- Writes file to tmp directory
-
-
/bin/sedsed -i "/^\\-javaagent:.*[\\/\\\\]ja\\-netfilter\\.jar.*/d" /tmp/vmoptions/pycharm.vmoptions2⤵
- Reads runtime system information
- Writes file to tmp directory
-
-
/bin/sedsed -i "/^\\-javaagent:.*[\\/\\\\]ja\\-netfilter\\.jar.*/d" /tmp/vmoptions/webstorm.vmoptions2⤵
- Reads runtime system information
- Writes file to tmp directory
-
-
/bin/sedsed -i "/^\\-javaagent:.*[\\/\\\\]ja\\-netfilter\\.jar.*/d" /tmp/vmoptions/webide.vmoptions2⤵
- Reads runtime system information
- Writes file to tmp directory
-
-
/bin/sedsed -i "/^\\-javaagent:.*[\\/\\\\]ja\\-netfilter\\.jar.*/d" /tmp/vmoptions/rider.vmoptions2⤵
- Reads runtime system information
- Writes file to tmp directory
-
-
/bin/sedsed -i "/^\\-javaagent:.*[\\/\\\\]ja\\-netfilter\\.jar.*/d" /tmp/vmoptions/datagrip.vmoptions2⤵
- Reads runtime system information
- Writes file to tmp directory
-
-
/bin/sedsed -i "/^\\-javaagent:.*[\\/\\\\]ja\\-netfilter\\.jar.*/d" /tmp/vmoptions/rubymine.vmoptions2⤵
- Reads runtime system information
- Writes file to tmp directory
-
-
/bin/sedsed -i "/^\\-javaagent:.*[\\/\\\\]ja\\-netfilter\\.jar.*/d" /tmp/vmoptions/appcode.vmoptions2⤵
- Reads runtime system information
- Writes file to tmp directory
-
-
/bin/sedsed -i "/^\\-javaagent:.*[\\/\\\\]ja\\-netfilter\\.jar.*/d" /tmp/vmoptions/dataspell.vmoptions2⤵
- Reads runtime system information
- Writes file to tmp directory
-
-
/bin/sedsed -i "/^\\-javaagent:.*[\\/\\\\]ja\\-netfilter\\.jar.*/d" /tmp/vmoptions/gateway.vmoptions2⤵
- Reads runtime system information
- Writes file to tmp directory
-
-
/bin/sedsed -i "/^\\-javaagent:.*[\\/\\\\]ja\\-netfilter\\.jar.*/d" /tmp/vmoptions/jetbrains_client.vmoptions2⤵
- Reads runtime system information
- Writes file to tmp directory
-
-
/bin/sedsed -i "/^\\-javaagent:.*[\\/\\\\]ja\\-netfilter\\.jar.*/d" /tmp/vmoptions/jetbrainsclient.vmoptions2⤵
- Reads runtime system information
- Writes file to tmp directory
-
-
/bin/sedsed -i "/^\\-javaagent:.*[\\/\\\\]ja\\-netfilter\\.jar.*/d" /tmp/vmoptions/studio.vmoptions2⤵
- Reads runtime system information
- Writes file to tmp directory
-
-
/bin/sedsed -i "/^\\-javaagent:.*[\\/\\\\]ja\\-netfilter\\.jar.*/d" /tmp/vmoptions/devecostudio.vmoptions2⤵
- Reads runtime system information
- Writes file to tmp directory
-
-
/bin/sedsed -i "/___MY_VMOPTIONS_SHELL_FILE=\"\${HOME}\\/\\.jetbrains\\.vmoptions\\.sh\"; if /d" /.profile2⤵
- Reads runtime system information
-
-
/bin/sedsed -i "/___MY_VMOPTIONS_SHELL_FILE=\"\${HOME}\\/\\.jetbrains\\.vmoptions\\.sh\"; if /d" /.bashrc2⤵
- Reads runtime system information
-
-
/bin/sedsed -i "/___MY_VMOPTIONS_SHELL_FILE=\"\${HOME}\\/\\.jetbrains\\.vmoptions\\.sh\"; if /d" /.zshrc2⤵
- Reads runtime system information
-
-
/bin/lnln -sf /.jetbrains.vmoptions.sh /.config/plasma-workspace/env/jetbrains.vmoptions.sh2⤵
-
-
/usr/bin/dirnamedirname /tmp/scripts/install.sh1⤵
-
/usr/bin/trtr "[a-z]" "[A-Z]"1⤵
-
/usr/bin/trtr "[a-z]" "[A-Z]"1⤵
-
/usr/bin/trtr "[a-z]" "[A-Z]"1⤵
-
/usr/bin/trtr "[a-z]" "[A-Z]"1⤵
-
/usr/bin/trtr "[a-z]" "[A-Z]"1⤵
-
/usr/bin/trtr "[a-z]" "[A-Z]"1⤵
-
/usr/bin/trtr "[a-z]" "[A-Z]"1⤵
-
/usr/bin/trtr "[a-z]" "[A-Z]"1⤵
-
/usr/bin/trtr "[a-z]" "[A-Z]"1⤵
-
/usr/bin/trtr "[a-z]" "[A-Z]"1⤵
-
/usr/bin/trtr "[a-z]" "[A-Z]"1⤵
-
/usr/bin/trtr "[a-z]" "[A-Z]"1⤵
-
/usr/bin/trtr "[a-z]" "[A-Z]"1⤵
-
/usr/bin/trtr "[a-z]" "[A-Z]"1⤵
-
/usr/bin/trtr "[a-z]" "[A-Z]"1⤵
-
/usr/bin/trtr "[a-z]" "[A-Z]"1⤵
-
/usr/bin/trtr "[a-z]" "[A-Z]"1⤵
Network
-
DNScdn.fwupd.orgRemote address:1.1.1.1:53Requestcdn.fwupd.orgIN AResponsecdn.fwupd.orgIN CNAMEdualstack.p2.shared.global.fastly.netdualstack.p2.shared.global.fastly.netIN A151.101.2.49dualstack.p2.shared.global.fastly.netIN A151.101.66.49dualstack.p2.shared.global.fastly.netIN A151.101.130.49dualstack.p2.shared.global.fastly.netIN A151.101.194.49 -
DNScdn.fwupd.orgRemote address:1.1.1.1:53Requestcdn.fwupd.orgIN AAAAResponsecdn.fwupd.orgIN CNAMEdualstack.p2.shared.global.fastly.netdualstack.p2.shared.global.fastly.netIN AAAA2a04:4e42::561dualstack.p2.shared.global.fastly.netIN AAAA2a04:4e42:200::561dualstack.p2.shared.global.fastly.netIN AAAA2a04:4e42:400::561dualstack.p2.shared.global.fastly.netIN AAAA2a04:4e42:600::561
-
DNS1527653184.rsc.cdn77.orgRemote address:1.1.1.1:53Request1527653184.rsc.cdn77.orgIN AResponse1527653184.rsc.cdn77.orgIN A195.181.164.171527653184.rsc.cdn77.orgIN A89.187.167.6
-
DNS1527653184.rsc.cdn77.orgRemote address:1.1.1.1:53Request1527653184.rsc.cdn77.orgIN AAAAResponse1527653184.rsc.cdn77.orgIN AAAA2a02:6ea0:ca00::41527653184.rsc.cdn77.orgIN AAAA2a02:6ea0:ca00::3
-
151.101.194.49:443tls
-
151.101.129.91:443tls
-
195.181.164.14:443tls -
151.101.194.49:443cdn.fwupd.orgtls
-
185.125.188.62:443tls
-
185.125.188.62:443tls
-
151.101.129.91:443extensions.gnome.orgtls
-
195.181.164.17:443odrs.gnome.orgtls
-
224.0.0.251:5353 -
1.1.1.1:53cdn.fwupd.orgdns
DNS Request
cdn.fwupd.org
DNS Response
151.101.2.49151.101.66.49151.101.130.49151.101.194.49
-
1.1.1.1:53cdn.fwupd.orgdns
DNS Request
cdn.fwupd.org
DNS Response
2a04:4e42::5612a04:4e42:200::5612a04:4e42:400::5612a04:4e42:600::561
-
1.1.1.1:531527653184.rsc.cdn77.orgdns
DNS Request
1527653184.rsc.cdn77.org
DNS Response
195.181.164.1789.187.167.6
-
1.1.1.1:531527653184.rsc.cdn77.orgdns
DNS Request
1527653184.rsc.cdn77.org
DNS Response
2a02:6ea0:ca00::42a02:6ea0:ca00::3
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
185B
MD5c08ab06b32d96dc65c082b639ae4d467
SHA11fdde29652a4aea63c22b5c4d16b64258c13964e
SHA256b68f22dd54acb66418b4332c5703286122ddc6c7bd257720e37363510991535c
SHA51219a42319c55579405c2151577ad6d1af334ff8c9ce75648b3bbd1420a90284db84cf2bf477d06607017883574f118c3c1582257d77bc9cbfc4fbe98ade2833bf
-
Filesize
244B
MD53342b3246910bdbe1f399104ea7316da
SHA1c506673896507bc85db81ac242b4dfe833c6ebfd
SHA256488bb2c04b0f32ca2f3065b311f64d57225923ef29332c7da26e1f9c1186d870
SHA512c4953238cf15b3464d9120988667c98f67241874c8a81632282f403d1ec4a0e5272368849f9a75419b001351eae35bbde0b1744c412658adb4b1e9e7eda69e78
-
Filesize
1KB
MD5e9e99bb4399e8e72ee41f0ceb14afcf6
SHA1b5c8c8555431462fb444c4067e1707d9dfbd0bd1
SHA2564992433ba790ea49821639102dea0cab520e352164285a0596ccda8c73bc7a67
SHA512ba3c1edd8ffa67cffb2cc5315d0de37b4fbe51d94a46eb9fbf91849447bacd7b7fb245649095bce038a556f411fe28616a3bc379e69f17be4548af09789b0da8
-
Filesize
10B
MD53e2b31c72181b87149ff995e7202c0e3
SHA1bd971bec88149956458a10fc9c5ecb3eb99dd452
SHA256a8076d3d28d21e02012b20eaf7dbf75409a6277134439025f282e368e3305abf
SHA512543f39af1ae7a2382ed869cbd1ee1ac598a88eb4e213cd64487c54b5c37722c6207ee6db4fa7e2ed53064259a44115c6da7bbc8c068378bb52a25e7088eeebd6
-
Filesize
65B
MD5d05e07f777d5a7262f27f009c709b6da
SHA1d53ee0777afdc033a363017608f5d2137d3d4baf
SHA25689cbe08b266f593d6db523a0207804ff6671fc77da7f955f8f9319f0be94cb05
SHA5126fcf6e710c95726c196d825b34f5c34945270e124ef652b70faa4d74453d3a1a4703d169a81ef7c7791927a097958960c425c25c8e6bb184429a992d6d13aa40
-
Filesize
122B
MD5db429228e4713acf5bf4fbb18a8834a4
SHA1dcfa6be754dbca2dca6d9b7d795b6eaedaedeb3c
SHA256081d1c848695cbba6ab8453152f6d0561e4548c02da626c0c108416408b48d64
SHA5125a23734d0a7e12abce44f74ff148ce8cb7b6bd60a2ca0e7c05be9041e8ca59e98ae7eca43caefc816cf1cf97de620e77619e10f51d792961adf81b2544803963
-
Filesize
148B
MD5d0cfbf4ab229cb0b8e351a1ccafc99ea
SHA1c07864fefc64efa750b8f67f39f5d2e9443881f3
SHA256f190a66f4f0d95e59170e1eb3a1f95352163d28ead4cc855ef06b3b112758e72
SHA512ea741be9782d108e42716c7887b83d90689de76895d647d2602362d7ff4313c5c2643ecd81e9e7ac241ca58e49c77297669caa2b7389e1c4941caffa4e1d90df
-
Filesize
720B
MD5324aa84f1968b5e0f893c08d1a569079
SHA1503adc5895a6b4426f9f25a2d7641304cbe85243
SHA25606151881492c7d8ed6b6a27ed8a3b4c94fe24cf63c24735664827ac472631502
SHA51231368609ca6064bf07fa12408860d273a33effba328baae66b730fcf9ebd766b1344367182ef96d3b07b2888bab5d3c0555d87280c8f581a0e4615885965c893