3b549ed051f07d14ca03241c68ed10f3e8647f5d0e18d315e47534f2ba5c1e3b

Analysis

max time kernel
13s
platform
debian-9_mips
resource
debian9-mipsbe-20240418-en
resource tags

arch:mipsimage:debian9-mipsbe-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
26-06-2024 17:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file01.js
Size

11B
MD5

f9357bdd0069fbcd014d15ef427ff4f7
SHA1

9865fa69f6209dfd5747cd4424924ff1b62d77ae
SHA256

3b549ed051f07d14ca03241c68ed10f3e8647f5d0e18d315e47534f2ba5c1e3b
SHA512

1b255fff282f7cde5a5cd3efca3e95a0b5d3bf0e93c1edd2ac4a4b3d84a5712b829e28d6f22dd5ad549060a33befadf21f288084ad93d2e2efb6d1094e9d7cc9

Score

4^/10

antivm

Malware Config

Signatures

Changes its process name 4 IoCs

Processes:

description	ioc	pid
Changes the process name, possibly in an attempt to hide itself	V8 WorkerThread	729
Changes the process name, possibly in an attempt to hide itself	V8 WorkerThread	732
Changes the process name, possibly in an attempt to hide itself	V8 WorkerThread	734
Changes the process name, possibly in an attempt to hide itself	V8 WorkerThread	735

Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
antivm

Virtualization/Sandbox Evasion
T1497

Processes:

nodejs

description ioc process

File opened for reading /proc/cpuinfo nodejs

description	ioc	process
File opened for reading	/proc/cpuinfo	nodejs

/usr/bin/nodejs
nodejs /tmp/file01.js
1⤵
- Checks CPU configuration
PID:717

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads