1b82a20e13c0462e3f4d884435313fb3e41ec1a0946dfd55c46237300ab0e40f

Analysis

max time kernel
10s
max time network
1679s
platform
debian-9_mips
resource
debian9-mipsbe-20240418-en
resource tags

arch:mipsimage:debian9-mipsbe-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
27-06-2024 02:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

trigger.js
Size

15B
MD5

d281f403c04b73ef6948ba99a87750e6
SHA1

d4c45b31833a3df05f7657cda853fef7c303e1c8
SHA256

1b82a20e13c0462e3f4d884435313fb3e41ec1a0946dfd55c46237300ab0e40f
SHA512

9f20287686d7f711654c1ab019afa543bc25cb32c3ef9b56695bf0d1b25ec6b05e9e1f68351227b6cccc3fac329955675bf5679439b2738683a5a2c80c05c5bb

Score

4^/10

antivm

Malware Config

Signatures

Changes its process name 4 IoCs

Processes:

description	ioc	pid
Changes the process name, possibly in an attempt to hide itself	V8 WorkerThread	718
Changes the process name, possibly in an attempt to hide itself	V8 WorkerThread	720
Changes the process name, possibly in an attempt to hide itself	V8 WorkerThread	721
Changes the process name, possibly in an attempt to hide itself	V8 WorkerThread	724

Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
antivm

Virtualization/Sandbox Evasion
T1497

Processes:

nodejs

description ioc process

File opened for reading /proc/cpuinfo nodejs

description	ioc	process
File opened for reading	/proc/cpuinfo	nodejs

/usr/bin/nodejs
nodejs /tmp/trigger.js
1⤵
- Checks CPU configuration
PID:705

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads