Overview
overview
4Static
static
1Cihad Chan...fer.js
windows7-x64
3Cihad Chan...fer.js
windows10-2004-x64
3Cihad Chan...ous.js
windows7-x64
3Cihad Chan...ous.js
windows10-2004-x64
3Cihad Chan...fer.js
windows7-x64
3Cihad Chan...fer.js
windows10-2004-x64
3Cihad Chan...sts.js
windows7-x64
3Cihad Chan...sts.js
windows10-2004-x64
3Cihad Chan...ate.js
windows7-x64
3Cihad Chan...ate.js
windows10-2004-x64
3Cihad Chan...DME.js
windows7-x64
3Cihad Chan...DME.js
windows10-2004-x64
3Cihad Chan...k-conv
ubuntu-18.04-amd64
3Cihad Chan...k-conv
debian-9-armhf
4Cihad Chan...k-conv
debian-9-mips
1Cihad Chan...k-conv
debian-9-mipsel
1Cihad Chan...k-sign
ubuntu-18.04-amd64
3Cihad Chan...k-sign
debian-9-armhf
4Cihad Chan...k-sign
debian-9-mips
1Cihad Chan...k-sign
debian-9-mipsel
1Cihad Chan...verify
ubuntu-18.04-amd64
3Cihad Chan...verify
debian-9-armhf
4Cihad Chan...verify
debian-9-mips
1Cihad Chan...verify
debian-9-mipsel
1Cihad Chan...lgs.js
windows7-x64
3Cihad Chan...lgs.js
windows10-2004-x64
3Cihad Chan...ate.js
windows7-x64
3Cihad Chan...ate.js
windows10-2004-x64
3Cihad Chan...dhe.js
windows7-x64
3Cihad Chan...dhe.js
windows10-2004-x64
3Cihad Chan...pat.js
windows7-x64
3Cihad Chan...pat.js
windows10-2004-x64
3Analysis
-
max time kernel
0s -
max time network
129s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240729-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240729-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
30-08-2024 16:52
Static task
static1
Behavioral task
behavioral1
Sample
Cihad Channel Url sniper/node_modules/safer-buffer/Porting-Buffer.js
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
Cihad Channel Url sniper/node_modules/safer-buffer/Porting-Buffer.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Cihad Channel Url sniper/node_modules/safer-buffer/dangerous.js
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
Cihad Channel Url sniper/node_modules/safer-buffer/dangerous.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
Cihad Channel Url sniper/node_modules/safer-buffer/safer.js
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
Cihad Channel Url sniper/node_modules/safer-buffer/safer.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
Cihad Channel Url sniper/node_modules/safer-buffer/tests.js
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
Cihad Channel Url sniper/node_modules/safer-buffer/tests.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
Cihad Channel Url sniper/node_modules/setimmediate/setImmediate.js
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
Cihad Channel Url sniper/node_modules/setimmediate/setImmediate.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
Cihad Channel Url sniper/node_modules/sshpk/README.js
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
Cihad Channel Url sniper/node_modules/sshpk/README.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
Cihad Channel Url sniper/node_modules/sshpk/bin/sshpk-conv
Resource
ubuntu1804-amd64-20240729-en
Behavioral task
behavioral14
Sample
Cihad Channel Url sniper/node_modules/sshpk/bin/sshpk-conv
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral15
Sample
Cihad Channel Url sniper/node_modules/sshpk/bin/sshpk-conv
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral16
Sample
Cihad Channel Url sniper/node_modules/sshpk/bin/sshpk-conv
Resource
debian9-mipsel-20240611-en
Behavioral task
behavioral17
Sample
Cihad Channel Url sniper/node_modules/sshpk/bin/sshpk-sign
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral18
Sample
Cihad Channel Url sniper/node_modules/sshpk/bin/sshpk-sign
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral19
Sample
Cihad Channel Url sniper/node_modules/sshpk/bin/sshpk-sign
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral20
Sample
Cihad Channel Url sniper/node_modules/sshpk/bin/sshpk-sign
Resource
debian9-mipsel-20240611-en
Behavioral task
behavioral21
Sample
Cihad Channel Url sniper/node_modules/sshpk/bin/sshpk-verify
Resource
ubuntu1804-amd64-20240729-en
Behavioral task
behavioral22
Sample
Cihad Channel Url sniper/node_modules/sshpk/bin/sshpk-verify
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral23
Sample
Cihad Channel Url sniper/node_modules/sshpk/bin/sshpk-verify
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral24
Sample
Cihad Channel Url sniper/node_modules/sshpk/bin/sshpk-verify
Resource
debian9-mipsel-20240729-en
Behavioral task
behavioral25
Sample
Cihad Channel Url sniper/node_modules/sshpk/lib/algs.js
Resource
win7-20240705-en
Behavioral task
behavioral26
Sample
Cihad Channel Url sniper/node_modules/sshpk/lib/algs.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
Cihad Channel Url sniper/node_modules/sshpk/lib/certificate.js
Resource
win7-20240705-en
Behavioral task
behavioral28
Sample
Cihad Channel Url sniper/node_modules/sshpk/lib/certificate.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
Cihad Channel Url sniper/node_modules/sshpk/lib/dhe.js
Resource
win7-20240704-en
Behavioral task
behavioral30
Sample
Cihad Channel Url sniper/node_modules/sshpk/lib/dhe.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
Cihad Channel Url sniper/node_modules/sshpk/lib/ed-compat.js
Resource
win7-20240705-en
Behavioral task
behavioral32
Sample
Cihad Channel Url sniper/node_modules/sshpk/lib/ed-compat.js
Resource
win10v2004-20240802-en
General
-
Target
Cihad Channel Url sniper/node_modules/sshpk/bin/sshpk-verify
-
Size
3KB
-
MD5
e9dce004ba75555aaf438285912418ca
-
SHA1
bed5d9cc90700090b09d785d84f985b7815e55f8
-
SHA256
901a4c5578177a3b69e5b3868c21371904603b326561421afedc4ba18ac446d8
-
SHA512
b9fd029a6a8297e832e430f7239569a2796aea3fdd5b93883018f18e96d03a7dba5dd5fb8efebb9f7631404ed52bf048700a4f5ba90632eebd991847fc4d445d
Malware Config
Signatures
-
Enumerates kernel/hardware configuration 1 TTPs 1 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/fs/cgroup/memory/memory.limit_in_bytes node -
Reads runtime system information 1 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/meminfo node
Processes
-
/tmp/Cihad Channel Url sniper/node_modules/sshpk/bin/sshpk-verify"/tmp/Cihad Channel Url sniper/node_modules/sshpk/bin/sshpk-verify"1⤵PID:1505
-
/usr/local/sbin/nodenode "/tmp/Cihad Channel Url sniper/node_modules/sshpk/bin/sshpk-verify"1⤵PID:1505
-
/usr/local/bin/nodenode "/tmp/Cihad Channel Url sniper/node_modules/sshpk/bin/sshpk-verify"1⤵PID:1505
-
/usr/sbin/nodenode "/tmp/Cihad Channel Url sniper/node_modules/sshpk/bin/sshpk-verify"1⤵PID:1505
-
/usr/bin/nodenode "/tmp/Cihad Channel Url sniper/node_modules/sshpk/bin/sshpk-verify"1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1505