Analysis

  • max time kernel
    9s
  • max time network
    1679s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20240611-en
  • resource tags

    arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    27-06-2024 02:15

General

  • Target

    trigger.js

  • Size

    15B

  • MD5

    d281f403c04b73ef6948ba99a87750e6

  • SHA1

    d4c45b31833a3df05f7657cda853fef7c303e1c8

  • SHA256

    1b82a20e13c0462e3f4d884435313fb3e41ec1a0946dfd55c46237300ab0e40f

  • SHA512

    9f20287686d7f711654c1ab019afa543bc25cb32c3ef9b56695bf0d1b25ec6b05e9e1f68351227b6cccc3fac329955675bf5679439b2738683a5a2c80c05c5bb

Score
4/10

Malware Config

Signatures

  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

  • Reads CPU attributes 1 TTPs 1 IoCs
  • Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

  • Reads runtime system information 1 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /usr/bin/node
    node /tmp/trigger.js
    1⤵
    • Checks CPU configuration
    • Reads CPU attributes
    • Enumerates kernel/hardware configuration
    • Reads runtime system information
    PID:649

Network

MITRE ATT&CK Matrix ATT&CK v13

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Discovery

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Replay Monitor

Loading Replay Monitor...

Downloads