Overview
overview
4Static
static
1Cihad Chan...fer.js
windows7-x64
3Cihad Chan...fer.js
windows10-2004-x64
3Cihad Chan...ous.js
windows7-x64
3Cihad Chan...ous.js
windows10-2004-x64
3Cihad Chan...fer.js
windows7-x64
3Cihad Chan...fer.js
windows10-2004-x64
3Cihad Chan...sts.js
windows7-x64
3Cihad Chan...sts.js
windows10-2004-x64
3Cihad Chan...ate.js
windows7-x64
3Cihad Chan...ate.js
windows10-2004-x64
3Cihad Chan...DME.js
windows7-x64
3Cihad Chan...DME.js
windows10-2004-x64
3Cihad Chan...k-conv
ubuntu-18.04-amd64
3Cihad Chan...k-conv
debian-9-armhf
4Cihad Chan...k-conv
debian-9-mips
1Cihad Chan...k-conv
debian-9-mipsel
1Cihad Chan...k-sign
ubuntu-18.04-amd64
3Cihad Chan...k-sign
debian-9-armhf
4Cihad Chan...k-sign
debian-9-mips
1Cihad Chan...k-sign
debian-9-mipsel
1Cihad Chan...verify
ubuntu-18.04-amd64
3Cihad Chan...verify
debian-9-armhf
4Cihad Chan...verify
debian-9-mips
1Cihad Chan...verify
debian-9-mipsel
1Cihad Chan...lgs.js
windows7-x64
3Cihad Chan...lgs.js
windows10-2004-x64
3Cihad Chan...ate.js
windows7-x64
3Cihad Chan...ate.js
windows10-2004-x64
3Cihad Chan...dhe.js
windows7-x64
3Cihad Chan...dhe.js
windows10-2004-x64
3Cihad Chan...pat.js
windows7-x64
3Cihad Chan...pat.js
windows10-2004-x64
3Analysis
-
max time kernel
0s -
max time network
131s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
30-08-2024 16:52
Static task
static1
Behavioral task
behavioral1
Sample
Cihad Channel Url sniper/node_modules/safer-buffer/Porting-Buffer.js
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
Cihad Channel Url sniper/node_modules/safer-buffer/Porting-Buffer.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Cihad Channel Url sniper/node_modules/safer-buffer/dangerous.js
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
Cihad Channel Url sniper/node_modules/safer-buffer/dangerous.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
Cihad Channel Url sniper/node_modules/safer-buffer/safer.js
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
Cihad Channel Url sniper/node_modules/safer-buffer/safer.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
Cihad Channel Url sniper/node_modules/safer-buffer/tests.js
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
Cihad Channel Url sniper/node_modules/safer-buffer/tests.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
Cihad Channel Url sniper/node_modules/setimmediate/setImmediate.js
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
Cihad Channel Url sniper/node_modules/setimmediate/setImmediate.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
Cihad Channel Url sniper/node_modules/sshpk/README.js
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
Cihad Channel Url sniper/node_modules/sshpk/README.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
Cihad Channel Url sniper/node_modules/sshpk/bin/sshpk-conv
Resource
ubuntu1804-amd64-20240729-en
Behavioral task
behavioral14
Sample
Cihad Channel Url sniper/node_modules/sshpk/bin/sshpk-conv
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral15
Sample
Cihad Channel Url sniper/node_modules/sshpk/bin/sshpk-conv
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral16
Sample
Cihad Channel Url sniper/node_modules/sshpk/bin/sshpk-conv
Resource
debian9-mipsel-20240611-en
Behavioral task
behavioral17
Sample
Cihad Channel Url sniper/node_modules/sshpk/bin/sshpk-sign
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral18
Sample
Cihad Channel Url sniper/node_modules/sshpk/bin/sshpk-sign
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral19
Sample
Cihad Channel Url sniper/node_modules/sshpk/bin/sshpk-sign
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral20
Sample
Cihad Channel Url sniper/node_modules/sshpk/bin/sshpk-sign
Resource
debian9-mipsel-20240611-en
Behavioral task
behavioral21
Sample
Cihad Channel Url sniper/node_modules/sshpk/bin/sshpk-verify
Resource
ubuntu1804-amd64-20240729-en
Behavioral task
behavioral22
Sample
Cihad Channel Url sniper/node_modules/sshpk/bin/sshpk-verify
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral23
Sample
Cihad Channel Url sniper/node_modules/sshpk/bin/sshpk-verify
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral24
Sample
Cihad Channel Url sniper/node_modules/sshpk/bin/sshpk-verify
Resource
debian9-mipsel-20240729-en
Behavioral task
behavioral25
Sample
Cihad Channel Url sniper/node_modules/sshpk/lib/algs.js
Resource
win7-20240705-en
Behavioral task
behavioral26
Sample
Cihad Channel Url sniper/node_modules/sshpk/lib/algs.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
Cihad Channel Url sniper/node_modules/sshpk/lib/certificate.js
Resource
win7-20240705-en
Behavioral task
behavioral28
Sample
Cihad Channel Url sniper/node_modules/sshpk/lib/certificate.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
Cihad Channel Url sniper/node_modules/sshpk/lib/dhe.js
Resource
win7-20240704-en
Behavioral task
behavioral30
Sample
Cihad Channel Url sniper/node_modules/sshpk/lib/dhe.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
Cihad Channel Url sniper/node_modules/sshpk/lib/ed-compat.js
Resource
win7-20240705-en
Behavioral task
behavioral32
Sample
Cihad Channel Url sniper/node_modules/sshpk/lib/ed-compat.js
Resource
win10v2004-20240802-en
General
-
Target
Cihad Channel Url sniper/node_modules/sshpk/bin/sshpk-sign
-
Size
3KB
-
MD5
0d0ecd48e7dd7bdbeeb012ed32e6f249
-
SHA1
75271a4b0392b5549555f50085b991e8d9a3bd0c
-
SHA256
312daac89de6236eb325ce241e0b77bcdcd3409cc74252427352e6128681ba39
-
SHA512
fabac47b62916cdd09e7a15b080881c30713dc2106815f2a10d340a324d01b30262d0c8b297bf8addedd68395639e624b35867260cc3265f079ccafc8717e8bb
Malware Config
Signatures
-
Enumerates kernel/hardware configuration 1 TTPs 1 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/fs/cgroup/memory/memory.limit_in_bytes node -
Reads runtime system information 1 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/meminfo node
Processes
-
/tmp/Cihad Channel Url sniper/node_modules/sshpk/bin/sshpk-sign"/tmp/Cihad Channel Url sniper/node_modules/sshpk/bin/sshpk-sign"1⤵PID:1500
-
/usr/local/sbin/nodenode "/tmp/Cihad Channel Url sniper/node_modules/sshpk/bin/sshpk-sign"1⤵PID:1500
-
/usr/local/bin/nodenode "/tmp/Cihad Channel Url sniper/node_modules/sshpk/bin/sshpk-sign"1⤵PID:1500
-
/usr/sbin/nodenode "/tmp/Cihad Channel Url sniper/node_modules/sshpk/bin/sshpk-sign"1⤵PID:1500
-
/usr/bin/nodenode "/tmp/Cihad Channel Url sniper/node_modules/sshpk/bin/sshpk-sign"1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1500