Overview
overview
10Static
static
10SparxSolve...64.exe
windows7-x64
7SparxSolve...64.exe
windows10-2004-x64
7$PLUGINSDI...er.dll
windows7-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows7-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3LICENSES.c...m.html
windows7-x64
3LICENSES.c...m.html
windows10-2004-x64
3SparxMaths-Solver.exe
windows7-x64
1SparxMaths-Solver.exe
windows10-2004-x64
7d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows7-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows7-x64
1libEGL.dll
windows10-2004-x64
1locales/uk.ps1
windows7-x64
3locales/uk.ps1
windows10-2004-x64
3resources/...ces.js
windows7-x64
3resources/...ces.js
windows10-2004-x64
3resources/...ps.exe
windows7-x64
1resources/...ps.exe
windows10-2004-x64
1resources/...ck.ps1
windows7-x64
3resources/...ck.ps1
windows10-2004-x64
3resources/...nux.sh
ubuntu-18.04-amd64
3resources/...nux.sh
debian-9-armhf
4resources/...nux.sh
debian-9-mips
3resources/...nux.sh
debian-9-mipsel
3resources/...mac.sh
ubuntu-18.04-amd64
1Analysis
-
max time kernel
8s -
max time network
134s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
25-11-2024 20:04
Static task
static1
Behavioral task
behavioral1
Sample
SparxSolverSetup.1-2.win_64.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
SparxSolverSetup.1-2.win_64.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/WinShell.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
LICENSES.chromium.html
Resource
win7-20240729-en
Behavioral task
behavioral12
Sample
LICENSES.chromium.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
SparxMaths-Solver.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
SparxMaths-Solver.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
d3dcompiler_47.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral16
Sample
ffmpeg.dll
Resource
win7-20240903-en
Behavioral task
behavioral17
Sample
ffmpeg.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral18
Sample
libEGL.dll
Resource
win7-20241010-en
Behavioral task
behavioral19
Sample
libEGL.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral20
Sample
locales/uk.ps1
Resource
win7-20240729-en
Behavioral task
behavioral21
Sample
locales/uk.ps1
Resource
win10v2004-20241007-en
Behavioral task
behavioral22
Sample
resources/app.asar.unpacked/node_modules/playwright-core/ThirdPartyNotices.js
Resource
win7-20240903-en
Behavioral task
behavioral23
Sample
resources/app.asar.unpacked/node_modules/playwright-core/ThirdPartyNotices.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral24
Sample
resources/app.asar.unpacked/node_modules/playwright-core/bin/PrintDeps.exe
Resource
win7-20240903-en
Behavioral task
behavioral25
Sample
resources/app.asar.unpacked/node_modules/playwright-core/bin/PrintDeps.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral26
Sample
resources/app.asar.unpacked/node_modules/playwright-core/bin/install_media_pack.ps1
Resource
win7-20241023-en
Behavioral task
behavioral27
Sample
resources/app.asar.unpacked/node_modules/playwright-core/bin/install_media_pack.ps1
Resource
win10v2004-20241007-en
Behavioral task
behavioral28
Sample
resources/app.asar.unpacked/node_modules/playwright-core/bin/reinstall_chrome_beta_linux.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral29
Sample
resources/app.asar.unpacked/node_modules/playwright-core/bin/reinstall_chrome_beta_linux.sh
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral30
Sample
resources/app.asar.unpacked/node_modules/playwright-core/bin/reinstall_chrome_beta_linux.sh
Resource
debian9-mipsbe-20240729-en
Behavioral task
behavioral31
Sample
resources/app.asar.unpacked/node_modules/playwright-core/bin/reinstall_chrome_beta_linux.sh
Resource
debian9-mipsel-20240611-en
Behavioral task
behavioral32
Sample
resources/app.asar.unpacked/node_modules/playwright-core/bin/reinstall_chrome_beta_mac.sh
Resource
ubuntu1804-amd64-20240611-en
General
-
Target
resources/app.asar.unpacked/node_modules/playwright-core/bin/reinstall_chrome_beta_linux.sh
-
Size
1KB
-
MD5
cba6e6dfa77711fe4a65875b4a77c032
-
SHA1
66164fc6a7f678daa293570e05963555d418831e
-
SHA256
17d0c0361e8a66efc1db45004a75fad9cb33426d6c07b90db838929c4ae96a74
-
SHA512
7d30bb242d3deb0e7e3df8881103bfa868cddbd6ff01aaae6d64aa37eecaaf145785e21882e2fdf1c9e6aee2e05a1d888438a1fc780fb78c36e22e4ebd496842
Malware Config
Signatures
-
description ioc Process File opened for reading /proc/self/stat systemctl File opened for reading /proc/sys/kernel/osrelease systemctl File opened for reading /proc/1/environ systemctl File opened for reading /proc/1/sched systemctl File opened for reading /proc/cmdline systemctl File opened for reading /proc/self/fd apt-get File opened for reading /proc/filesystems dpkg File opened for reading /proc/filesystems systemctl File opened for reading /proc/sys/kernel/ngroups_max apt-get File opened for reading /proc/filesystems dpkg File opened for reading /proc/filesystems dpkg File opened for reading /proc/filesystems dpkg File opened for reading /proc/filesystems id -
Writes file to tmp directory 21 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/fileutl.message.KKE0TF apt-get File opened for modification /tmp/fileutl.message.yZb0tC apt-get File opened for modification /tmp/fileutl.message.1twMMV apt-get File opened for modification /tmp/fileutl.message.N3ccvS apt-get File opened for modification /tmp/fileutl.message.ANuTcy apt-get File opened for modification /tmp/fileutl.message.MFLu6y apt-get File opened for modification /tmp/fileutl.message.NUwU5Y apt-get File opened for modification /tmp/fileutl.message.0L29qs apt-get File opened for modification /tmp/fileutl.message.WCBwVd apt-get File opened for modification /tmp/fileutl.message.jZLKSg apt-get File opened for modification /tmp/fileutl.message.UVqRc1 apt-get File opened for modification /tmp/fileutl.message.a4R8lJ apt-get File opened for modification /tmp/fileutl.message.PHcRCc apt-get File opened for modification /tmp/fileutl.message.fFBNM5 apt-get File opened for modification /tmp/fileutl.message.TkWyq2 apt-get File opened for modification /tmp/fileutl.message.Em1N8o apt-get File opened for modification /tmp/fileutl.message.RHrFDP apt-get File opened for modification /tmp/fileutl.message.3fMR6f apt-get File opened for modification /tmp/fileutl.message.LUJzb9 apt-get File opened for modification /tmp/fileutl.message.qZN1Kv apt-get File opened for modification /tmp/fileutl.message.ojyWRl apt-get -
pid Process 1507 dpkg 1509 apt-get
Processes
-
/tmp/resources/app.asar.unpacked/node_modules/playwright-core/bin/reinstall_chrome_beta_linux.sh/tmp/resources/app.asar.unpacked/node_modules/playwright-core/bin/reinstall_chrome_beta_linux.sh1⤵PID:1504
-
/usr/local/sbin/bashbash /tmp/resources/app.asar.unpacked/node_modules/playwright-core/bin/reinstall_chrome_beta_linux.sh1⤵PID:1504
-
/usr/local/bin/bashbash /tmp/resources/app.asar.unpacked/node_modules/playwright-core/bin/reinstall_chrome_beta_linux.sh1⤵PID:1504
-
/usr/sbin/bashbash /tmp/resources/app.asar.unpacked/node_modules/playwright-core/bin/reinstall_chrome_beta_linux.sh1⤵PID:1504
-
/usr/bin/bashbash /tmp/resources/app.asar.unpacked/node_modules/playwright-core/bin/reinstall_chrome_beta_linux.sh1⤵PID:1504
-
/sbin/bashbash /tmp/resources/app.asar.unpacked/node_modules/playwright-core/bin/reinstall_chrome_beta_linux.sh1⤵PID:1504
-
/bin/bashbash /tmp/resources/app.asar.unpacked/node_modules/playwright-core/bin/reinstall_chrome_beta_linux.sh1⤵PID:1504
-
/usr/bin/archarch2⤵PID:1505
-
-
/bin/bashbash -c "source /etc/os-release && echo \$ID"2⤵PID:1506
-
-
/bin/grepgrep -q "^google-chrome-beta[[:space:]]*install\$"2⤵PID:1508
-
-
/usr/bin/dpkgdpkg --get-selections2⤵
- Reads runtime system information
- Software Deployment Tools
PID:1507
-
-
/usr/bin/apt-getapt-get update2⤵
- Reads runtime system information
- Writes file to tmp directory
- Software Deployment Tools
PID:1509 -
/usr/bin/dpkg/usr/bin/dpkg --print-foreign-architectures3⤵
- Reads runtime system information
PID:1513
-
-
/usr/lib/apt/methods/http/usr/lib/apt/methods/http3⤵PID:1514
-
-
/usr/lib/apt/methods/https/usr/lib/apt/methods/https3⤵PID:1515
-
-
/bin/shsh -c "[ ! -e /run/systemd/system ] || [ \$(id -u) -ne 0 ] || systemctl start --no-block apt-news.service esm-cache.service || true"3⤵PID:1517
-
/usr/bin/idid -u4⤵
- Reads runtime system information
PID:1518
-
-
/bin/systemctlsystemctl start --no-block apt-news.service esm-cache.service4⤵
- Reads runtime system information
PID:1519
-
-
-
/usr/lib/apt/methods/https/usr/lib/apt/methods/https3⤵PID:1522
-
-
/usr/lib/apt/methods/http/usr/lib/apt/methods/http3⤵PID:1524
-
-
/usr/lib/apt/methods/http/usr/lib/apt/methods/http3⤵PID:1525
-
-
/usr/bin/dpkg/usr/bin/dpkg --print-foreign-architectures3⤵
- Reads runtime system information
PID:1532
-
-
/usr/bin/dpkg/usr/bin/dpkg --print-foreign-architectures3⤵
- Reads runtime system information
PID:1538
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
235KB
MD5373fe2f2ef99005d2550a482f09a3e51
SHA168e6572b55b1e77f7d171ebac7b2579b7a6bd51d
SHA2567552d5ab0c3879756a860aaab8e7c2f8ffb9409ea9ff9e65fc046ba5c519ebe5
SHA512def9e854b824d2fddc6a15f898be73cfb679ac38563f5af854546f49c9d5d2316a40176dc41d6b360bda7b65de53863a53e4eedadf6336000b031b77a113607b