Overview

overview

10

Static

static

1

Execute.dll

windows7-x64

1

Execute.dll

windows10-2004-x64

1

Framework.dll

windows7-x64

1

Framework.dll

windows10-2004-x64

1

app.js

windows7-x64

1

app.js

windows10-2004-x64

3

basta.js

windows7-x64

3

basta.js

windows10-2004-x64

3

get.js

windows7-x64

1

get.js

windows10-2004-x64

1

invoke.dll

windows7-x64

1

invoke.dll

windows10-2004-x64

1

load.dll

windows7-x64

1

load.dll

windows10-2004-x64

1

method.dll

windows7-x64

1

method.dll

windows10-2004-x64

1

msg.dll

windows7-x64

1

msg.dll

windows10-2004-x64

1

node.bat

windows7-x64

10

node.bat

windows10-2004-x64

10

node_modul.../crc32

ubuntu-18.04-amd64

3

node_modul.../crc32

debian-9-armhf

4

node_modul.../crc32

debian-9-mips

3

node_modul.../crc32

debian-9-mipsel

3

node_modul...32.cmd

windows7-x64

1

node_modul...32.cmd

windows10-2004-x64

1

node_modul...32.ps1

ubuntu-18.04-amd64

1

node_modul...32.ps1

debian-9-armhf

1

node_modul...32.ps1

debian-9-mips

1

node_modul...32.ps1

debian-9-mipsel

1

node_modul...ile.js

windows7-x64

1

node_modul...ile.js

windows10-2004-x64

1

Analysis

  • max time kernel
    0s
  • max time network
    131s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20240226-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    25-04-2024 10:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    node_modules/.bin/crc32

  • Size

    308B

  • MD5

    a708a9c956d6684e5f0b34ab638d1f3f

  • SHA1

    f6afc28e6be725a561743da9637d26495d7386b0

  • SHA256

    0d56e35268bce01a4fe268df882e74187ada9034b7b18880637d6811ed3e5a29

  • SHA512

    e717e3ad37ad04ad37302cbe68faf1883f10093929cb74ac878bb8e01bea2701d8208b7ad17587b2ec163d499d0a9cee1f377863d3165937350ebad439863b54

Score
3/10

Malware Config

Signatures

  • Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

  • Reads runtime system information 2 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/node_modules/.bin/crc32
    /tmp/node_modules/.bin/crc32
    1⤵
      PID:1554
      • /bin/sed
        sed -e "s,\\\\,/,g"
        2⤵
        • Reads runtime system information
        PID:1558
      • /usr/bin/dirname
        dirname /tmp/node_modules/.bin/crc32
        2⤵
          PID:1555
        • /bin/uname
          uname
          2⤵
            PID:1559
        • /usr/local/sbin/node
          node /tmp/node_modules/.bin/../crc-32/bin/crc32.njs
          1⤵
            PID:1554
          • /usr/local/bin/node
            node /tmp/node_modules/.bin/../crc-32/bin/crc32.njs
            1⤵
              PID:1554
            • /usr/sbin/node
              node /tmp/node_modules/.bin/../crc-32/bin/crc32.njs
              1⤵
                PID:1554
              • /usr/bin/node
                node /tmp/node_modules/.bin/../crc-32/bin/crc32.njs
                1⤵
                • Enumerates kernel/hardware configuration
                • Reads runtime system information
                PID:1554

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads