6aee3410ee83dc4376357c23a6d15adb955cd56707156bd0ae506648b6976a4f

Analysis

max time kernel
19s
platform
debian-9_mipsel
resource
debian9-mipsel-20240418-en
resource tags

arch:mipselimage:debian9-mipsel-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
30-06-2024 12:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file01.js
Size

48B
MD5

2dc64100ab79cf7b6fe89b535c0a39bc
SHA1

a5f7887b6402b20fb26080db84de234e62536f85
SHA256

6aee3410ee83dc4376357c23a6d15adb955cd56707156bd0ae506648b6976a4f
SHA512

eff5d70deb7eb50eeddb33ab45be2a53cc52ec0096d664375aaab33b08434c3dfe93d159e37cf413eab88989c278655ae3faff21f974a7b77c851165cb5c7458

Score

4^/10

antivm

Malware Config

Signatures

Changes its process name 4 IoCs

Processes:

description	ioc	pid
Changes the process name, possibly in an attempt to hide itself	V8 WorkerThread	735
Changes the process name, possibly in an attempt to hide itself	V8 WorkerThread	737
Changes the process name, possibly in an attempt to hide itself	V8 WorkerThread	738
Changes the process name, possibly in an attempt to hide itself	V8 WorkerThread	740

Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
antivm

Virtualization/Sandbox Evasion
T1497

Processes:

nodejs

description ioc process

File opened for reading /proc/cpuinfo nodejs

description	ioc	process
File opened for reading	/proc/cpuinfo	nodejs

/usr/bin/nodejs
nodejs /tmp/file01.js
1⤵
- Checks CPU configuration
PID:724

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads