dbf82d838a58ea5164815779ae0eee5c9de8000cb1596b3fd5bae90ec70e02b2

Analysis

max time kernel
4s
max time network
55s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
19/05/2026, 20:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
resources/app.asar.unpacked/node_modules/better-sqlite3/deps/download.sh
Size 3KB
Sample260519-y6a4fsey3m
SHA256 dbf82d838a58ea5164815779ae0eee5c9de8000cb1596b3fd5bae90ec70e02b2
MD5 384a5594464d61d108767fd21c35085d
SHA1 93ac2fa3248cd2aa6c69b51a86cbea38cd8a2008
SHA512 1cc9d276dd328f2ed316ce42878c38c5f54832592f3680c5117d432f8f205f28179529d4f092ed8cbcbf0d3cc5aead01be36260994519ef1c4583494ac1474c8
TLSH
T1F58161F76789067D24C70029A12D61CABA23C32F8B7478484089566C0530AE45FBACFF
MD5 SHA1 SHA512 TLSH

Score

4^/10

antivm discovery

Malware Config

Signatures

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 5 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
766	curl

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/temp/source.zip	bash

/tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/download.sh
/tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/download.sh
1⤵
PID:754

/usr/local/sbin/bash
bash /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/download.sh
1⤵
PID:754

/usr/local/bin/bash
bash /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/download.sh
1⤵
PID:754

/usr/sbin/bash
bash /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/download.sh
1⤵
PID:754

/usr/bin/bash
bash /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/download.sh
1⤵
PID:754

/sbin/bash
bash /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/download.sh
1⤵
PID:754

/bin/bash
bash /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/download.sh
1⤵
- Writes file to tmp directory
PID:754
- /usr/bin/dirname
  dirname -- /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/download.sh
  2⤵
  PID:757
- /bin/rm
  rm -rf /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/temp
  2⤵
  PID:758
- /bin/rm
  rm -rf /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/sqlite3
  2⤵
  PID:759
- /bin/mkdir
  mkdir -p /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/temp
  2⤵
  - Reads runtime system information
  PID:760
- /bin/mkdir
  mkdir -p /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/sqlite3
  2⤵
  - Reads runtime system information
  PID:761
- /bin/sed
  sed -e "/^\\s*\$/d" -e "s/^/-D/"
  2⤵
  - Reads runtime system information
  PID:765
- /usr/bin/curl
  curl "-#f" https://www.sqlite.org/2026/sqlite-src-3530000.zip
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:766

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

source.zip

Path /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/temp/source.zip
Size 13.8MB
SHA256 fbc30cdbfcfa42c78fe7bddd3fd37ab8995369a31d39097a5d0633296c0b6e65
MD5 9fcd5a0cb1e3700c69d1824f6bc88de2
SHA1 259a0712f0c108b81bc32d885afca3b40b2ba775
SHA512 f2a5990d8bafc2d2bb63b1a413bca6cb4b6bed1c7b84caf7ce7fe569ec22f1098f54c5e46080025b09ddb882f5ef1ae36baccaf7f5d53dfe7a242afdc74adcda
SSDEEP 196608:Y9/joerimCBAlMCduhO9RLEPtJCQnYgsk2/foHoXV5JBJiGv0qUz59dBYYjBYgqz:Y9boeXXMOEjYgBHS5JTi5HYgJVo
TLSH
T10BE61368C53B9E95CD9F5120CB4C9ADFF86EE23E458CBB1B3430A6918D6E0C11A71E4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads