b4474348e53f927c304f9b7da84928aa3425484ec7715590b130bf71ea8afe1d

Analysis

max time kernel
5s
max time network
133s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
21-11-2024 18:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

resources/app.asar.unpacked/node_modules/playwright-core/bin/reinstall_chrome_beta_linux.sh
Size

1KB
MD5

cba6e6dfa77711fe4a65875b4a77c032
SHA1

66164fc6a7f678daa293570e05963555d418831e
SHA256

17d0c0361e8a66efc1db45004a75fad9cb33426d6c07b90db838929c4ae96a74
SHA512

7d30bb242d3deb0e7e3df8881103bfa868cddbd6ff01aaae6d64aa37eecaaf145785e21882e2fdf1c9e6aee2e05a1d888438a1fc780fb78c36e22e4ebd496842

Score

3^/10

discovery execution

Malware Config

Signatures

Reads runtime system information 13 IoCs

Reads data from /proc virtual filesystem.

discovery

Processes:

idapt-getdpkgsystemctldpkgdpkgdpkg

description	ioc	process
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/self/fd	apt-get
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/sys/kernel/ngroups_max	apt-get
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/cmdline	systemctl

Writes file to tmp directory 21 IoCs

Malware often drops required files in the /tmp directory.

Processes:

apt-get

description	ioc	process
File opened for modification	/tmp/fileutl.message.oFR7Uw	apt-get
File opened for modification	/tmp/fileutl.message.6geRaH	apt-get
File opened for modification	/tmp/fileutl.message.ESmchi	apt-get
File opened for modification	/tmp/fileutl.message.WDFvFq	apt-get
File opened for modification	/tmp/fileutl.message.MmlEJD	apt-get
File opened for modification	/tmp/fileutl.message.Kuwoa5	apt-get
File opened for modification	/tmp/fileutl.message.kp9wBw	apt-get
File opened for modification	/tmp/fileutl.message.Ke5Q65	apt-get
File opened for modification	/tmp/fileutl.message.ihKAMd	apt-get
File opened for modification	/tmp/fileutl.message.mkMx8E	apt-get
File opened for modification	/tmp/fileutl.message.4w6q4R	apt-get
File opened for modification	/tmp/fileutl.message.8v0Htj	apt-get
File opened for modification	/tmp/fileutl.message.YXzkTK	apt-get
File opened for modification	/tmp/fileutl.message.UYSKKU	apt-get
File opened for modification	/tmp/fileutl.message.WbX1ST	apt-get
File opened for modification	/tmp/fileutl.message.62gA6k	apt-get
File opened for modification	/tmp/fileutl.message.Olutv6	apt-get
File opened for modification	/tmp/fileutl.message.KeNKSx	apt-get
File opened for modification	/tmp/fileutl.message.asi5qM	apt-get
File opened for modification	/tmp/fileutl.message.gHKVgZ	apt-get
File opened for modification	/tmp/fileutl.message.UkDijc	apt-get

Software Deployment Tools 1 TTPs 2 IoCs
Use software deployment tools to execute code.
execution

Software Deployment Tools
T1072

Processes:

dpkgapt-get

pid process

1498 dpkg
1500 apt-get

pid	process
1498	dpkg
1500	apt-get

/tmp/resources/app.asar.unpacked/node_modules/playwright-core/bin/reinstall_chrome_beta_linux.sh
/tmp/resources/app.asar.unpacked/node_modules/playwright-core/bin/reinstall_chrome_beta_linux.sh
1⤵
PID:1495

/usr/local/sbin/bash
bash /tmp/resources/app.asar.unpacked/node_modules/playwright-core/bin/reinstall_chrome_beta_linux.sh
1⤵
PID:1495

/usr/local/bin/bash
bash /tmp/resources/app.asar.unpacked/node_modules/playwright-core/bin/reinstall_chrome_beta_linux.sh
1⤵
PID:1495

/usr/sbin/bash
bash /tmp/resources/app.asar.unpacked/node_modules/playwright-core/bin/reinstall_chrome_beta_linux.sh
1⤵
PID:1495

/usr/bin/bash
bash /tmp/resources/app.asar.unpacked/node_modules/playwright-core/bin/reinstall_chrome_beta_linux.sh
1⤵
PID:1495

/sbin/bash
bash /tmp/resources/app.asar.unpacked/node_modules/playwright-core/bin/reinstall_chrome_beta_linux.sh
1⤵
PID:1495

/bin/bash
bash /tmp/resources/app.asar.unpacked/node_modules/playwright-core/bin/reinstall_chrome_beta_linux.sh
1⤵
PID:1495
- /usr/bin/arch
  arch
  2⤵
  PID:1496
- /bin/bash
  bash -c "source /etc/os-release && echo \$ID"
  2⤵
  PID:1497
- /usr/bin/dpkg
  dpkg --get-selections
  2⤵
  - Reads runtime system information
  - Software Deployment Tools
  PID:1498
- /bin/grep
  grep -q "^google-chrome-beta[[:space:]]*install\$"
  2⤵
  PID:1499
- /usr/bin/apt-get
  apt-get update
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  - Software Deployment Tools
  PID:1500
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:1501
- - /usr/lib/apt/methods/http
    /usr/lib/apt/methods/http
    3⤵
    PID:1505
- - /usr/lib/apt/methods/https
    /usr/lib/apt/methods/https
    3⤵
    PID:1506
- - /bin/sh
    sh -c "[ ! -e /run/systemd/system ] || [ \$(id -u) -ne 0 ] || systemctl start --no-block apt-news.service esm-cache.service || true"
    3⤵
    PID:1508
  - - /usr/bin/id
      id -u
      4⤵
      Reads runtime system information
      PID:1509
  - - /bin/systemctl
      systemctl start --no-block apt-news.service esm-cache.service
      4⤵
      Reads runtime system information
      PID:1510
- - /usr/lib/apt/methods/https
    /usr/lib/apt/methods/https
    3⤵
    PID:1514
- - /usr/lib/apt/methods/http
    /usr/lib/apt/methods/http
    3⤵
    PID:1515
- - /usr/lib/apt/methods/http
    /usr/lib/apt/methods/http
    3⤵
    PID:1516
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:1523
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:1524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Software Deployment Tools

T1072

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Software Deployment Tools

T1072

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/fileutl.message.WbX1ST

Filesize
235KB

MD5
373fe2f2ef99005d2550a482f09a3e51

SHA1
68e6572b55b1e77f7d171ebac7b2579b7a6bd51d

SHA256
7552d5ab0c3879756a860aaab8e7c2f8ffb9409ea9ff9e65fc046ba5c519ebe5

SHA512
def9e854b824d2fddc6a15f898be73cfb679ac38563f5af854546f49c9d5d2316a40176dc41d6b360bda7b65de53863a53e4eedadf6336000b031b77a113607b

Download Submit