Technical Information
Malicious functions:
Substitutes application name for:
- analytics queue
- reqwest-internal-sync-runtime
- UserSession
- user cache watcher
- tokio-runtime-worker
Launches processes:
- xdg-open https://tabnine.com/welcome/
- dbus-send --print-reply --dest=org.freedesktop.DBus /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
- grep = \\"xfce4\\"$
- xprop -root _DT_SAVE_MODE
- xprop -root
- grep -i ^xfce_desktop_window
- uname
- grep -q ^file://
- egrep -q ^[[:alpha:]+\.\-]+:
- grep -E -q ^[[:alpha:]+\.\-]+:
- www-browser https://tabnine.com/welcome/
Performs operations with the file system:
Modifies file access rights:
- /root/.w3m/cookie
Creates folders:
- /root/.config
- /root/.config/TabNine
- /root/.config/TabNine/com.tabnine.data
- /root/.config/TabNine/.atomicwrite.DOFqbqSDnshq
- /root/.w3m
- /root/.config/TabNine/monitoring
Deletes folders:
- /root/.config/TabNine/.atomicwrite.DOFqbqSDnshq
Creates symlinks:
- /root/.config/TabNine/tabnine_config.json
Creates or modifies files:
- /root/.config/TabNine/TabNineExample.toml
- /root/.config/TabNine/com.tabnine.data/install_time
- /root/.config/TabNine/.atomicwrite.DOFqbqSDnshq/tmpfile.tmp
- /root/.w3m/w3msrc727-0
- /root/.w3m/cookie
- /root/.config/TabNine/monitoring/watchdog.lock
Deletes files:
- /root/.config/TabNine/.atomicwrite.DOFqbqSDnshq/tmpfile.tmp
- /root/.w3m/w3msrc727-0
Locks files:
- /root/.config/TabNine/monitoring/watchdog.lock
Network activity:
Establishes connection:
- <LOCAL_DNS_SERVER>
- 65.#.#83.120:443
- 65.#.183.69:443
- 65.#.#83.125:443
- 65.#.183.21:443
- 54.###.135.197:443
- 34.###.43.194:443
DNS ASK:
- ta##ine.com
- ww#.#abnine.com
- ap#.#abnine.com
Sends data to the following servers:
- 65.#.#83.120:443
- 54.###.135.197:443
- 34.###.43.194:443
Receives data from the following servers:
- 65.#.#83.120:443
- 54.###.135.197:443
- 34.###.43.194:443
Other:
Collects OS information
Collects CPU information
Collects RAM information
Collects information about network activity
