dbf82d838a58ea5164815779ae0eee5c9de8000cb1596b3fd5bae90ec70e02b2

Analysis

max time kernel
38s
max time network
151s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
19/05/2026, 20:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
resources/app.asar.unpacked/node_modules/better-sqlite3/deps/download.sh
Size 3KB
Sample260519-y6a4fsey3m
SHA256 dbf82d838a58ea5164815779ae0eee5c9de8000cb1596b3fd5bae90ec70e02b2
MD5 384a5594464d61d108767fd21c35085d
SHA1 93ac2fa3248cd2aa6c69b51a86cbea38cd8a2008
SHA512 1cc9d276dd328f2ed316ce42878c38c5f54832592f3680c5117d432f8f205f28179529d4f092ed8cbcbf0d3cc5aead01be36260994519ef1c4583494ac1474c8
TLSH
T1F58161F76789067D24C70029A12D61CABA23C32F8B7478484089566C0530AE45FBACFF
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads runtime system information 4 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	mkdir

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
828	curl

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/temp/source.zip	bash

/tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/download.sh
/tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/download.sh
1⤵
PID:812

/usr/local/sbin/bash
bash /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/download.sh
1⤵
PID:812

/usr/local/bin/bash
bash /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/download.sh
1⤵
PID:812

/usr/sbin/bash
bash /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/download.sh
1⤵
PID:812

/usr/bin/bash
bash /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/download.sh
1⤵
PID:812

/sbin/bash
bash /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/download.sh
1⤵
PID:812

/bin/bash
bash /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/download.sh
1⤵
- Writes file to tmp directory
PID:812
- /usr/bin/dirname
  dirname -- /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/download.sh
  2⤵
  PID:815
- /bin/rm
  rm -rf /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/temp
  2⤵
  PID:816
- /bin/rm
  rm -rf /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/sqlite3
  2⤵
  PID:817
- /bin/mkdir
  mkdir -p /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/temp
  2⤵
  - Reads runtime system information
  PID:818
- /bin/mkdir
  mkdir -p /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/sqlite3
  2⤵
  - Reads runtime system information
  PID:822
- /bin/sed
  sed -e "/^\\s*\$/d" -e "s/^/-D/"
  2⤵
  - Reads runtime system information
  PID:827
- /usr/bin/curl
  curl "-#f" https://www.sqlite.org/2026/sqlite-src-3530000.zip
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

source.zip

Path /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/temp/source.zip
Size 13.8MB
SHA256 fbc30cdbfcfa42c78fe7bddd3fd37ab8995369a31d39097a5d0633296c0b6e65
MD5 9fcd5a0cb1e3700c69d1824f6bc88de2
SHA1 259a0712f0c108b81bc32d885afca3b40b2ba775
SHA512 f2a5990d8bafc2d2bb63b1a413bca6cb4b6bed1c7b84caf7ce7fe569ec22f1098f54c5e46080025b09ddb882f5ef1ae36baccaf7f5d53dfe7a242afdc74adcda
SSDEEP 196608:Y9/joerimCBAlMCduhO9RLEPtJCQnYgsk2/foHoXV5JBJiGv0qUz59dBYYjBYgqz:Y9boeXXMOEjYgBHS5JTi5HYgJVo
TLSH
T10BE61368C53B9E95CD9F5120CB4C9ADFF86EE23E458CBB1B3430A6918D6E0C11A71E4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads