Analysis
- max time kernel
2s - platform
debian-9_armhf - resource
debian9-armhf-20240729-en - resource tags
- submitted
07/08/2024, 03:24
General
- Target resources/app/node_modules/ejs-electron/node_modules/mime/cli.js
- Size 1KB
- Sample240807-dx33natalb
- SHA256 15da8d89bd7fc3a4025f79197a02a62284a95add244ec67bdd2b8dff918b5052
Score
4/10
Malware Config
Signatures
- Changes its process name 1 IoCs
- Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
- Reads CPU attributes 1 TTPs 1 IoCs
- Enumerates kernel/hardware configuration 1 TTPs 1 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
- Reads runtime system information 1 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/resources/app/node_modules/ejs-electron/node_modules/mime/cli.js/tmp/resources/app/node_modules/ejs-electron/node_modules/mime/cli.js1⤵
-
/usr/local/sbin/nodenode /tmp/resources/app/node_modules/ejs-electron/node_modules/mime/cli.js1⤵
-
/usr/local/bin/nodenode /tmp/resources/app/node_modules/ejs-electron/node_modules/mime/cli.js1⤵
-
/usr/sbin/nodenode /tmp/resources/app/node_modules/ejs-electron/node_modules/mime/cli.js1⤵
-
/usr/bin/nodenode /tmp/resources/app/node_modules/ejs-electron/node_modules/mime/cli.js1⤵
- Changes its process name
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information