Overview
overview
10Static
static
10discord-re...dex.js
windows7-x64
1discord-re...dex.js
windows10-2004-x64
1discord-re...n/mime
ubuntu-18.04-amd64
3discord-re...n/mime
debian-9-armhf
1discord-re...n/mime
debian-9-mips
3discord-re...n/mime
debian-9-mipsel
3discord-re...me.cmd
windows7-x64
1discord-re...me.cmd
windows10-2004-x64
1discord-re...me.ps1
ubuntu-18.04-amd64
discord-re...me.ps1
debian-9-armhf
discord-re...me.ps1
debian-9-mips
discord-re...me.ps1
debian-9-mipsel
discord-re...-build
ubuntu-18.04-amd64
3discord-re...-build
debian-9-armhf
1discord-re...-build
debian-9-mips
1discord-re...-build
debian-9-mipsel
1discord-re...tional
ubuntu-18.04-amd64
3discord-re...tional
debian-9-armhf
1discord-re...tional
debian-9-mips
1discord-re...tional
debian-9-mipsel
1discord-re...al.cmd
windows7-x64
1discord-re...al.cmd
windows10-2004-x64
1discord-re...al.ps1
ubuntu-18.04-amd64
discord-re...al.ps1
debian-9-armhf
discord-re...al.ps1
debian-9-mips
discord-re...al.ps1
debian-9-mipsel
discord-re...d-test
ubuntu-18.04-amd64
3discord-re...d-test
debian-9-armhf
1discord-re...d-test
debian-9-mips
1discord-re...d-test
debian-9-mipsel
1discord-re...st.cmd
windows7-x64
1discord-re...st.cmd
windows10-2004-x64
1Analysis
-
max time kernel
5s -
max time network
145s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20230831-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20230831-enkernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
12-10-2023 01:22
Behavioral task
behavioral1
Sample
discord-reg/bypass/browser/index.js
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
discord-reg/bypass/browser/index.js
Resource
win10v2004-20230915-en
Behavioral task
behavioral3
Sample
discord-reg/bypass/browser/node_modules/.bin/mime
Resource
ubuntu1804-amd64-20230831-en
Behavioral task
behavioral4
Sample
discord-reg/bypass/browser/node_modules/.bin/mime
Resource
debian9-armhf-20230831-en
Behavioral task
behavioral5
Sample
discord-reg/bypass/browser/node_modules/.bin/mime
Resource
debian9-mipsbe-20230831-en
Behavioral task
behavioral6
Sample
discord-reg/bypass/browser/node_modules/.bin/mime
Resource
debian9-mipsel-20230831-en
Behavioral task
behavioral7
Sample
discord-reg/bypass/browser/node_modules/.bin/mime.cmd
Resource
win7-20230831-en
Behavioral task
behavioral8
Sample
discord-reg/bypass/browser/node_modules/.bin/mime.cmd
Resource
win10v2004-20230915-en
Behavioral task
behavioral9
Sample
discord-reg/bypass/browser/node_modules/.bin/mime.ps1
Resource
ubuntu1804-amd64-20230831-en
Behavioral task
behavioral10
Sample
discord-reg/bypass/browser/node_modules/.bin/mime.ps1
Resource
debian9-armhf-20230831-en
Behavioral task
behavioral11
Sample
discord-reg/bypass/browser/node_modules/.bin/mime.ps1
Resource
debian9-mipsbe-20230831-en
Behavioral task
behavioral12
Sample
discord-reg/bypass/browser/node_modules/.bin/mime.ps1
Resource
debian9-mipsel-en-20211208
Behavioral task
behavioral13
Sample
discord-reg/bypass/browser/node_modules/.bin/node-gyp-build
Resource
ubuntu1804-amd64-20230831-en
Behavioral task
behavioral14
Sample
discord-reg/bypass/browser/node_modules/.bin/node-gyp-build
Resource
debian9-armhf-20230831-en
Behavioral task
behavioral15
Sample
discord-reg/bypass/browser/node_modules/.bin/node-gyp-build
Resource
debian9-mipsbe-20230831-en
Behavioral task
behavioral16
Sample
discord-reg/bypass/browser/node_modules/.bin/node-gyp-build
Resource
debian9-mipsel-en-20211208
Behavioral task
behavioral17
Sample
discord-reg/bypass/browser/node_modules/.bin/node-gyp-build-optional
Resource
ubuntu1804-amd64-20230831-en
Behavioral task
behavioral18
Sample
discord-reg/bypass/browser/node_modules/.bin/node-gyp-build-optional
Resource
debian9-armhf-20230831-en
Behavioral task
behavioral19
Sample
discord-reg/bypass/browser/node_modules/.bin/node-gyp-build-optional
Resource
debian9-mipsbe-en-20211208
Behavioral task
behavioral20
Sample
discord-reg/bypass/browser/node_modules/.bin/node-gyp-build-optional
Resource
debian9-mipsel-20230831-en
Behavioral task
behavioral21
Sample
discord-reg/bypass/browser/node_modules/.bin/node-gyp-build-optional.cmd
Resource
win7-20230831-en
Behavioral task
behavioral22
Sample
discord-reg/bypass/browser/node_modules/.bin/node-gyp-build-optional.cmd
Resource
win10v2004-20230915-en
Behavioral task
behavioral23
Sample
discord-reg/bypass/browser/node_modules/.bin/node-gyp-build-optional.ps1
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral24
Sample
discord-reg/bypass/browser/node_modules/.bin/node-gyp-build-optional.ps1
Resource
debian9-armhf-20230831-en
Behavioral task
behavioral25
Sample
discord-reg/bypass/browser/node_modules/.bin/node-gyp-build-optional.ps1
Resource
debian9-mipsbe-20230831-en
Behavioral task
behavioral26
Sample
discord-reg/bypass/browser/node_modules/.bin/node-gyp-build-optional.ps1
Resource
debian9-mipsel-20230831-en
Behavioral task
behavioral27
Sample
discord-reg/bypass/browser/node_modules/.bin/node-gyp-build-test
Resource
ubuntu1804-amd64-20230831-en
Behavioral task
behavioral28
Sample
discord-reg/bypass/browser/node_modules/.bin/node-gyp-build-test
Resource
debian9-armhf-en-20211208
Behavioral task
behavioral29
Sample
discord-reg/bypass/browser/node_modules/.bin/node-gyp-build-test
Resource
debian9-mipsbe-20230831-en
Behavioral task
behavioral30
Sample
discord-reg/bypass/browser/node_modules/.bin/node-gyp-build-test
Resource
debian9-mipsel-20230831-en
Behavioral task
behavioral31
Sample
discord-reg/bypass/browser/node_modules/.bin/node-gyp-build-test.cmd
Resource
win7-20230831-en
Behavioral task
behavioral32
Sample
discord-reg/bypass/browser/node_modules/.bin/node-gyp-build-test.cmd
Resource
win10v2004-20230915-en
General
-
Target
discord-reg/bypass/browser/node_modules/.bin/node-gyp-build
-
Size
310B
-
MD5
12cbf3babb786218def63efb615f8b6f
-
SHA1
acf59353111d1c24e1622d5fc86cb449cb182c61
-
SHA256
2c34c104880b8ac95bea71c954c848697835b3aeeacbd6cb01369b237e2e295a
-
SHA512
98f0acc66694d2b1732364f69f777b2df58c3cd477029c50b4cc62965dc0f7c518e149ecc9670283636aa92306559b1c7998fd2a1353d026107054aa7639c585
Malware Config
Signatures
-
Reads runtime system information 1 IoCs
Reads data from /proc virtual filesystem.
Processes:
seddescription ioc process File opened for reading /proc/filesystems sed
Processes
-
/tmp/discord-reg/bypass/browser/node_modules/.bin/node-gyp-build/tmp/discord-reg/bypass/browser/node_modules/.bin/node-gyp-build1⤵PID:594
-
/usr/bin/dirnamedirname /tmp/discord-reg/bypass/browser/node_modules/.bin/node-gyp-build2⤵PID:595
-
/bin/unameuname2⤵PID:599
-
/bin/sedsed -e "s,\\\\,/,g"1⤵
- Reads runtime system information
PID:598
-
/usr/local/sbin/nodenode /tmp/discord-reg/bypass/browser/node_modules/.bin/../node-gyp-build/bin.js1⤵PID:594
-
/usr/local/bin/nodenode /tmp/discord-reg/bypass/browser/node_modules/.bin/../node-gyp-build/bin.js1⤵PID:594
-
/usr/sbin/nodenode /tmp/discord-reg/bypass/browser/node_modules/.bin/../node-gyp-build/bin.js1⤵PID:594
-
/usr/bin/nodenode /tmp/discord-reg/bypass/browser/node_modules/.bin/../node-gyp-build/bin.js1⤵PID:594
-
/sbin/nodenode /tmp/discord-reg/bypass/browser/node_modules/.bin/../node-gyp-build/bin.js1⤵PID:594
-
/bin/nodenode /tmp/discord-reg/bypass/browser/node_modules/.bin/../node-gyp-build/bin.js1⤵PID:594