Analysis
- max time kernel
8s - platform
debian-9_armhf - resource
debian9-armhf-20240226-en - resource tags
- submitted
10/03/2024, 13:11
General
- Target filedefender.js
- Size 811B
- Sample240310-qfbcjadc69
- SHA256 7e0382578ab7186c98135d80e04f07178bcaf16edf02ab2a9535c1b773c4875a
Score
6/10
Malware Config
Signatures
- Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
- Reads CPU attributes 1 TTPs 1 IoCs
- Enumerates kernel/hardware configuration 1 TTPs 1 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
- Reads runtime system information 1 IoCs
Reads data from /proc virtual filesystem.
- Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/usr/bin/nodenode /tmp/filedefender.js1⤵
- Checks CPU configuration
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory