Technical Information
Malicious functions:
Substitutes application name for:
- authenticator
- update_loop
- line_forwarder
- indexer-1
- indexer-2
- indexer-3
- indexer-0
- notify_event_receiver
- TabNine-worker
- server_comm
- local-forwarder
- autocomplete_worker
Launches processes:
- <SAMPLE_FULL_PATH> --inner
- xdg-open https://tabnine.com/welcome/
- dbus-send --print-reply --dest=org.freedesktop.DBus /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
- xprop -root _DT_SAVE_MODE
- grep = \\"xfce4\\"$
- grep -i ^xfce_desktop_window
- xprop -root
- uname
- grep -q ^file://
- egrep -q ^[[:alpha:]+\.\-]+:
- grep -E -q ^[[:alpha:]+\.\-]+:
- www-browser https://tabnine.com/welcome/
- gunzip
- gzip -d
Performs operations with the file system:
Creates folders:
- /root/.config
- /root/.config/TabNine
- /root/.config/TabNine/.atomicwrite.MhUOrZxqnoBr
- /root/.w3m
Deletes folders:
- /root/.config/TabNine/.atomicwrite.MhUOrZxqnoBr
Creates or modifies files:
- /root/.config/TabNine/TabNineExample.toml
- /root/.config/TabNine/.atomicwrite.MhUOrZxqnoBr/tmpfile.tmp
- /root/.w3m/w3mtmp729-0.gz
Deletes files:
- /root/.w3m/w3mtmp729-0.gz
Network activity:
Establishes connection:
- <LOCAL_DNS_SERVER>
- 52.###.154.83:443
- 34.###.26.42:443
- 34.##2.97.6:443
DNS ASK:
- ta##ine.com
Sends data to the following servers:
- 52.###.154.83:443
Receives data from the following servers:
- 52.###.154.83:443
Other:
Collects OS information
Collects RAM information
Collects information about network activity