b4474348e53f927c304f9b7da84928aa3425484ec7715590b130bf71ea8afe1d

Analysis

max time kernel
8s
max time network
48s
platform
debian-9_armhf
resource
debian9-armhf-20240418-en
resource tags

arch:armhfimage:debian9-armhf-20240418-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
25-11-2024 20:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

resources/app.asar.unpacked/node_modules/playwright-core/bin/reinstall_chrome_beta_linux.sh
Size

1KB
MD5

cba6e6dfa77711fe4a65875b4a77c032
SHA1

66164fc6a7f678daa293570e05963555d418831e
SHA256

17d0c0361e8a66efc1db45004a75fad9cb33426d6c07b90db838929c4ae96a74
SHA512

7d30bb242d3deb0e7e3df8881103bfa868cddbd6ff01aaae6d64aa37eecaaf145785e21882e2fdf1c9e6aee2e05a1d888438a1fc780fb78c36e22e4ebd496842

Score

4^/10

antivm discovery execution

Malware Config

Signatures

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

Processes:

https

description	ioc	Process
File opened for reading	/proc/cpuinfo	https

Reads runtime system information 8 IoCs

Reads data from /proc virtual filesystem.

discovery

Processes:

dpkgapt-gethttpsdpkgdpkgdpkg

description	ioc	Process
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/sys/kernel/ngroups_max	apt-get
File opened for reading	/proc/sys/crypto/fips_enabled	https
File opened for reading	/proc/self/auxv	https
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-get

Writes file to tmp directory 7 IoCs

Malware often drops required files in the /tmp directory.

Processes:

apt-get

description	ioc	Process
File opened for modification	/tmp/fileutl.message.ck36aa	apt-get
File opened for modification	/tmp/fileutl.message.AeBr37	apt-get
File opened for modification	/tmp/fileutl.message.qQQFmb	apt-get
File opened for modification	/tmp/fileutl.message.AmgbOc	apt-get
File opened for modification	/tmp/fileutl.message.cPkARh	apt-get
File opened for modification	/tmp/fileutl.message.eUtblQ	apt-get
File opened for modification	/tmp/fileutl.message.3AICeg	apt-get

Software Deployment Tools 1 TTPs 2 IoCs

Use software deployment tools to execute code.

execution

Software Deployment Tools

T1072

Processes:

dpkgapt-get

pid	Process
755	dpkg
757	apt-get

/tmp/resources/app.asar.unpacked/node_modules/playwright-core/bin/reinstall_chrome_beta_linux.sh
/tmp/resources/app.asar.unpacked/node_modules/playwright-core/bin/reinstall_chrome_beta_linux.sh
1⤵
PID:748

/usr/local/sbin/bash
bash /tmp/resources/app.asar.unpacked/node_modules/playwright-core/bin/reinstall_chrome_beta_linux.sh
1⤵
PID:748

/usr/local/bin/bash
bash /tmp/resources/app.asar.unpacked/node_modules/playwright-core/bin/reinstall_chrome_beta_linux.sh
1⤵
PID:748

/usr/sbin/bash
bash /tmp/resources/app.asar.unpacked/node_modules/playwright-core/bin/reinstall_chrome_beta_linux.sh
1⤵
PID:748

/usr/bin/bash
bash /tmp/resources/app.asar.unpacked/node_modules/playwright-core/bin/reinstall_chrome_beta_linux.sh
1⤵
PID:748

/sbin/bash
bash /tmp/resources/app.asar.unpacked/node_modules/playwright-core/bin/reinstall_chrome_beta_linux.sh
1⤵
PID:748

/bin/bash
bash /tmp/resources/app.asar.unpacked/node_modules/playwright-core/bin/reinstall_chrome_beta_linux.sh
1⤵
PID:748
- /usr/bin/arch
  arch
  2⤵
  PID:753
- /bin/bash
  bash -c "source /etc/os-release && echo \$ID"
  2⤵
  PID:754
- /usr/bin/dpkg
  dpkg --get-selections
  2⤵
  - Reads runtime system information
  - Software Deployment Tools
  PID:755
- /bin/grep
  grep -q "^google-chrome-beta[[:space:]]*install\$"
  2⤵
  PID:756
- /usr/bin/apt-get
  apt-get update
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  - Software Deployment Tools
  PID:757
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:758
- - /usr/lib/apt/methods/http
    /usr/lib/apt/methods/http
    3⤵
    PID:759
- - /usr/lib/apt/methods/https
    /usr/lib/apt/methods/https
    3⤵
    PID:760
- - /usr/lib/apt/methods/https
    /usr/lib/apt/methods/https
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    PID:761
- - /usr/lib/apt/methods/http
    /usr/lib/apt/methods/http
    3⤵
    PID:762
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:764
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:767

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Software Deployment Tools

T1072

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Software Deployment Tools

T1072

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads