Analysis

  • max time kernel
    2s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20240611-en
  • resource tags

    arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    09-11-2024 20:29

General

  • Target

    resources/app/node_modules/ejs/bin/cli.js

  • Size

    4KB

  • MD5

    c104b7f45946c47a7c80abcf2eeada49

  • SHA1

    ca407aa696a8fde9c7ecbdc20178af41def19c01

  • SHA256

    565df8144924d86535189192b207178eea934962d4c3b29498a4e8fe7f49e8ac

  • SHA512

    3ffabc5d5d7216e787515c2a801cc0acda59f0b4383bf29b9082c66d93396c740f5f55a47a029e6c5e1da3d56a9875588acfa59249f0e582c6ff7c149643fa9c

  • SSDEEP

    96:O4S/XHFCkJibCgM1GLyHfQIWtroMaPLAnJQr9ieikVzx9Vz1nFqAxUEtgvwjc+Ig:O/XHxK4Toazx9Vz1nFdxUEG6IpctMcD9

Malware Config

Signatures

  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

  • Reads CPU attributes 1 TTPs 1 IoCs
  • Command and Scripting Interpreter: JavaScript 1 TTPs 4 IoCs

    Execution via JavaScript.

  • Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

  • Reads runtime system information 2 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/resources/app/node_modules/ejs/bin/cli.js
    /tmp/resources/app/node_modules/ejs/bin/cli.js
    1⤵
      PID:758
    • /usr/local/sbin/node
      node /tmp/resources/app/node_modules/ejs/bin/cli.js
      1⤵
      • Command and Scripting Interpreter: JavaScript
      PID:758
    • /usr/local/bin/node
      node /tmp/resources/app/node_modules/ejs/bin/cli.js
      1⤵
      • Command and Scripting Interpreter: JavaScript
      PID:758
    • /usr/sbin/node
      node /tmp/resources/app/node_modules/ejs/bin/cli.js
      1⤵
      • Command and Scripting Interpreter: JavaScript
      PID:758
    • /usr/bin/node
      node /tmp/resources/app/node_modules/ejs/bin/cli.js
      1⤵
      • Checks CPU configuration
      • Reads CPU attributes
      • Command and Scripting Interpreter: JavaScript
      • Enumerates kernel/hardware configuration
      • Reads runtime system information
      PID:758

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads