Overview
overview
7Static
static
1ja-netfilter.jar
windows7-x64
1ja-netfilter.jar
windows10-2004-x64
7plugins-je...ns.jar
windows7-x64
1plugins-je...ns.jar
windows10-2004-x64
7plugins-je...me.jar
windows7-x64
1plugins-je...me.jar
windows10-2004-x64
7plugins-je...er.jar
windows7-x64
1plugins-je...er.jar
windows10-2004-x64
7plugins-je...rl.jar
windows7-x64
1plugins-je...rl.jar
windows10-2004-x64
7scripts/in...rs.vbs
windows7-x64
3scripts/in...rs.vbs
windows10-2004-x64
7scripts/in...er.vbs
windows7-x64
1scripts/in...er.vbs
windows10-2004-x64
1scripts/install.sh
ubuntu-18.04-amd64
3scripts/install.sh
debian-9-armhf
3scripts/install.sh
debian-9-mips
3scripts/install.sh
debian-9-mipsel
1scripts/un...rs.vbs
windows7-x64
3scripts/un...rs.vbs
windows10-2004-x64
7scripts/un...er.vbs
windows7-x64
1scripts/un...er.vbs
windows10-2004-x64
1scripts/uninstall.sh
ubuntu-18.04-amd64
3scripts/uninstall.sh
debian-9-armhf
3scripts/uninstall.sh
debian-9-mips
3scripts/uninstall.sh
debian-9-mipsel
3Analysis
-
max time kernel
5s -
platform
debian-9_mipsel -
resource
debian9-mipsel-20231215-en -
resource tags
arch:mipselimage:debian9-mipsel-20231215-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem -
submitted
20/12/2023, 09:26
Static task
static1
Behavioral task
behavioral1
Sample
ja-netfilter.jar
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
ja-netfilter.jar
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
plugins-jetbrains/dns.jar
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
plugins-jetbrains/dns.jar
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
plugins-jetbrains/hideme.jar
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
plugins-jetbrains/hideme.jar
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
plugins-jetbrains/power.jar
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
plugins-jetbrains/power.jar
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
plugins-jetbrains/url.jar
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
plugins-jetbrains/url.jar
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
scripts/install-all-users.vbs
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
scripts/install-all-users.vbs
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
scripts/install-current-user.vbs
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
scripts/install-current-user.vbs
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
scripts/install.sh
Resource
ubuntu1804-amd64-20231215-en
Behavioral task
behavioral16
Sample
scripts/install.sh
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral17
Sample
scripts/install.sh
Resource
debian9-mipsbe-20231215-en
Behavioral task
behavioral18
Sample
scripts/install.sh
Resource
debian9-mipsel-20231215-en
Behavioral task
behavioral19
Sample
scripts/uninstall-all-users.vbs
Resource
win7-20231215-en
Behavioral task
behavioral20
Sample
scripts/uninstall-all-users.vbs
Resource
win10v2004-20231215-en
Behavioral task
behavioral21
Sample
scripts/uninstall-current-user.vbs
Resource
win7-20231215-en
Behavioral task
behavioral22
Sample
scripts/uninstall-current-user.vbs
Resource
win10v2004-20231215-en
Behavioral task
behavioral23
Sample
scripts/uninstall.sh
Resource
ubuntu1804-amd64-20231215-en
Behavioral task
behavioral24
Sample
scripts/uninstall.sh
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral25
Sample
scripts/uninstall.sh
Resource
debian9-mipsbe-20231215-en
Behavioral task
behavioral26
Sample
scripts/uninstall.sh
Resource
debian9-mipsel-20231215-en
General
-
Target
scripts/uninstall.sh
-
Size
1KB
-
MD5
f8d12ad74edc1df03c1d71e723cf7317
-
SHA1
437f66132747f12edaa30d81052b08f8ce99e7ed
-
SHA256
ec93dfcdf02f00f21bff552e3ee6899850877a8cc7dd08033d474050ac67a956
-
SHA512
5c46956b4497856e881b27aaa2f3306fa7922af180b52aacd1cc4f7881b5ee05d22d02688079cae836d588aacf6592dc2cbcad08fa03925302d20317034031c0
Malware Config
Signatures
-
Reads runtime system information 3 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/filesystems sed File opened for reading /proc/filesystems sed File opened for reading /proc/filesystems sed
Processes
-
/tmp/scripts/uninstall.sh/tmp/scripts/uninstall.sh1⤵PID:713
-
/bin/unameuname -s2⤵PID:715
-
-
/usr/bin/touchtouch /.profile2⤵PID:717
-
-
/usr/bin/touchtouch /.bashrc2⤵PID:719
-
-
/usr/bin/touchtouch /.zshrc2⤵PID:722
-
-
/bin/rmrm -rf /.jetbrains.vmoptions.sh2⤵PID:730
-
-
/bin/sedsed -i "/___MY_VMOPTIONS_SHELL_FILE=\"\${HOME}\\/\\.jetbrains\\.vmoptions\\.sh\"; if /d" /.profile2⤵
- Reads runtime system information
PID:731
-
-
/bin/sedsed -i "/___MY_VMOPTIONS_SHELL_FILE=\"\${HOME}\\/\\.jetbrains\\.vmoptions\\.sh\"; if /d" /.bashrc2⤵
- Reads runtime system information
PID:732
-
-
/bin/sedsed -i "/___MY_VMOPTIONS_SHELL_FILE=\"\${HOME}\\/\\.jetbrains\\.vmoptions\\.sh\"; if /d" /.zshrc2⤵
- Reads runtime system information
PID:733
-
-
/bin/rmrm -rf /.config/plasma-workspace/env/jetbrains.vmoptions.sh2⤵PID:734
-