Analysis

  • max time kernel
    3s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20240611-en
  • resource tags

    arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    26-06-2024 17:19

General

  • Target

    file01.js

  • Size

    11B

  • MD5

    f9357bdd0069fbcd014d15ef427ff4f7

  • SHA1

    9865fa69f6209dfd5747cd4424924ff1b62d77ae

  • SHA256

    3b549ed051f07d14ca03241c68ed10f3e8647f5d0e18d315e47534f2ba5c1e3b

  • SHA512

    1b255fff282f7cde5a5cd3efca3e95a0b5d3bf0e93c1edd2ac4a4b3d84a5712b829e28d6f22dd5ad549060a33befadf21f288084ad93d2e2efb6d1094e9d7cc9

Score
4/10

Malware Config

Signatures

  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

  • Reads CPU attributes 1 TTPs 1 IoCs
  • Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

  • Reads runtime system information 1 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /usr/bin/node
    node /tmp/file01.js
    1⤵
    • Checks CPU configuration
    • Reads CPU attributes
    • Enumerates kernel/hardware configuration
    • Reads runtime system information
    PID:640

Network

MITRE ATT&CK Matrix ATT&CK v13

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Discovery

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Replay Monitor

Loading Replay Monitor...

Downloads