b4474348e53f927c304f9b7da84928aa3425484ec7715590b130bf71ea8afe1d

Analysis

max time kernel
8s
max time network
134s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
25-11-2024 20:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

resources/app.asar.unpacked/node_modules/playwright-core/bin/reinstall_chrome_beta_linux.sh
Size

1KB
MD5

cba6e6dfa77711fe4a65875b4a77c032
SHA1

66164fc6a7f678daa293570e05963555d418831e
SHA256

17d0c0361e8a66efc1db45004a75fad9cb33426d6c07b90db838929c4ae96a74
SHA512

7d30bb242d3deb0e7e3df8881103bfa868cddbd6ff01aaae6d64aa37eecaaf145785e21882e2fdf1c9e6aee2e05a1d888438a1fc780fb78c36e22e4ebd496842

Score

3^/10

discovery execution

Malware Config

Signatures

Reads runtime system information 13 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/self/fd	apt-get
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/sys/kernel/ngroups_max	apt-get
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	id

Writes file to tmp directory 21 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/fileutl.message.KKE0TF	apt-get
File opened for modification	/tmp/fileutl.message.yZb0tC	apt-get
File opened for modification	/tmp/fileutl.message.1twMMV	apt-get
File opened for modification	/tmp/fileutl.message.N3ccvS	apt-get
File opened for modification	/tmp/fileutl.message.ANuTcy	apt-get
File opened for modification	/tmp/fileutl.message.MFLu6y	apt-get
File opened for modification	/tmp/fileutl.message.NUwU5Y	apt-get
File opened for modification	/tmp/fileutl.message.0L29qs	apt-get
File opened for modification	/tmp/fileutl.message.WCBwVd	apt-get
File opened for modification	/tmp/fileutl.message.jZLKSg	apt-get
File opened for modification	/tmp/fileutl.message.UVqRc1	apt-get
File opened for modification	/tmp/fileutl.message.a4R8lJ	apt-get
File opened for modification	/tmp/fileutl.message.PHcRCc	apt-get
File opened for modification	/tmp/fileutl.message.fFBNM5	apt-get
File opened for modification	/tmp/fileutl.message.TkWyq2	apt-get
File opened for modification	/tmp/fileutl.message.Em1N8o	apt-get
File opened for modification	/tmp/fileutl.message.RHrFDP	apt-get
File opened for modification	/tmp/fileutl.message.3fMR6f	apt-get
File opened for modification	/tmp/fileutl.message.LUJzb9	apt-get
File opened for modification	/tmp/fileutl.message.qZN1Kv	apt-get
File opened for modification	/tmp/fileutl.message.ojyWRl	apt-get

Software Deployment Tools 1 TTPs 2 IoCs

Use software deployment tools to execute code.

execution

Software Deployment Tools

T1072

pid	Process
1507	dpkg
1509	apt-get

/tmp/resources/app.asar.unpacked/node_modules/playwright-core/bin/reinstall_chrome_beta_linux.sh
/tmp/resources/app.asar.unpacked/node_modules/playwright-core/bin/reinstall_chrome_beta_linux.sh
1⤵
PID:1504

/usr/local/sbin/bash
bash /tmp/resources/app.asar.unpacked/node_modules/playwright-core/bin/reinstall_chrome_beta_linux.sh
1⤵
PID:1504

/usr/local/bin/bash
bash /tmp/resources/app.asar.unpacked/node_modules/playwright-core/bin/reinstall_chrome_beta_linux.sh
1⤵
PID:1504

/usr/sbin/bash
bash /tmp/resources/app.asar.unpacked/node_modules/playwright-core/bin/reinstall_chrome_beta_linux.sh
1⤵
PID:1504

/usr/bin/bash
bash /tmp/resources/app.asar.unpacked/node_modules/playwright-core/bin/reinstall_chrome_beta_linux.sh
1⤵
PID:1504

/sbin/bash
bash /tmp/resources/app.asar.unpacked/node_modules/playwright-core/bin/reinstall_chrome_beta_linux.sh
1⤵
PID:1504

/bin/bash
bash /tmp/resources/app.asar.unpacked/node_modules/playwright-core/bin/reinstall_chrome_beta_linux.sh
1⤵
PID:1504
- /usr/bin/arch
  arch
  2⤵
  PID:1505
- /bin/bash
  bash -c "source /etc/os-release && echo \$ID"
  2⤵
  PID:1506
- /bin/grep
  grep -q "^google-chrome-beta[[:space:]]*install\$"
  2⤵
  PID:1508
- /usr/bin/dpkg
  dpkg --get-selections
  2⤵
  - Reads runtime system information
  - Software Deployment Tools
  PID:1507
- /usr/bin/apt-get
  apt-get update
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  - Software Deployment Tools
  PID:1509
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:1513
- - /usr/lib/apt/methods/http
    /usr/lib/apt/methods/http
    3⤵
    PID:1514
- - /usr/lib/apt/methods/https
    /usr/lib/apt/methods/https
    3⤵
    PID:1515
- - /bin/sh
    sh -c "[ ! -e /run/systemd/system ] || [ \$(id -u) -ne 0 ] || systemctl start --no-block apt-news.service esm-cache.service || true"
    3⤵
    PID:1517
  - - /usr/bin/id
      id -u
      4⤵
      Reads runtime system information
      PID:1518
  - - /bin/systemctl
      systemctl start --no-block apt-news.service esm-cache.service
      4⤵
      Reads runtime system information
      PID:1519
- - /usr/lib/apt/methods/https
    /usr/lib/apt/methods/https
    3⤵
    PID:1522
- - /usr/lib/apt/methods/http
    /usr/lib/apt/methods/http
    3⤵
    PID:1524
- - /usr/lib/apt/methods/http
    /usr/lib/apt/methods/http
    3⤵
    PID:1525
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:1532
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:1538

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Software Deployment Tools

T1072

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Software Deployment Tools

T1072

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/fileutl.message.3fMR6f

Filesize
235KB

MD5
373fe2f2ef99005d2550a482f09a3e51

SHA1
68e6572b55b1e77f7d171ebac7b2579b7a6bd51d

SHA256
7552d5ab0c3879756a860aaab8e7c2f8ffb9409ea9ff9e65fc046ba5c519ebe5

SHA512
def9e854b824d2fddc6a15f898be73cfb679ac38563f5af854546f49c9d5d2316a40176dc41d6b360bda7b65de53863a53e4eedadf6336000b031b77a113607b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads