ca978112ca1bbdcafac231b39a23dc4da786eff8147c4e72b9807785afee48bb

Resubmissions

11-09-2024 09:28

240911-lfggbstglb 3

11-09-2024 09:25

11-09-2024 09:24

11-09-2024 09:23

11-09-2024 09:21

11-09-2024 09:18

Analysis

max time kernel
3s
platform
debian-9_armhf
resource
debian9-armhf-20240729-en
resource tags

arch:armhfimage:debian9-armhf-20240729-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
11-09-2024 09:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file01.js
Size

1B
MD5

0cc175b9c0f1b6a831c399e269772661
SHA1

86f7e437faa5a7fce15d1ddcb9eaeaea377667b8
SHA256

ca978112ca1bbdcafac231b39a23dc4da786eff8147c4e72b9807785afee48bb
SHA512

1f40fc92da241694750979ee6cf582f2d5d7d28e18335de05abc54d0560e0f5302860c652bf08d560252aa5e74210546f369fbbbce8c12cfc7957b2652fe9a75

Score

4^/10

antivm discovery execution

Malware Config

Signatures

Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
antivm

System Checks
T1497.001

Processes:

node

description ioc process

File opened for reading /proc/cpuinfo node
Reads CPU attributes 1 TTPs 1 IoCs
discovery

System Information Discovery
T1082

Processes:

node

description ioc process

File opened for reading /sys/devices/system/cpu/online node
Command and Scripting Interpreter: JavaScript 1 TTPs 1 IoCs
Execution via JavaScript.
execution

JavaScript
T1059.007

Processes:

node

pid process

660 node
Enumerates kernel/hardware configuration 1 TTPs 1 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
discovery

System Information Discovery
T1082

Processes:

node

description ioc process

File opened for reading /sys/fs/cgroup/memory/memory.limit_in_bytes node
Reads runtime system information 1 IoCs
Reads data from /proc virtual filesystem.
discovery

Processes:

node

description ioc process

File opened for reading /proc/meminfo node

description	ioc	process
File opened for reading	/proc/cpuinfo	node

description	ioc	process
File opened for reading	/sys/devices/system/cpu/online	node

pid	process
660	node

description	ioc	process
File opened for reading	/sys/fs/cgroup/memory/memory.limit_in_bytes	node

description	ioc	process
File opened for reading	/proc/meminfo	node

/usr/bin/node
node /tmp/file01.js
1⤵
- Checks CPU configuration
- Reads CPU attributes
- Command and Scripting Interpreter: JavaScript
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads