3ab8e2ca421a950555b9866396ea9d2632d3a70d5674096a20968fd0458cfd7d

Resubmissions

28/06/2026, 02:06

260628-cjqdzaey6z

28/06/2026, 01:58

260628-cd19aaey6p9

Analysis

max time kernel
0s
max time network
130s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
28/06/2026, 01:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
resources/app.asar.unpacked/node_modules/koffi/src/koffi/tools/write_trampolines.js
Size 1KB
Sample260628-cd19aaey6p
SHA256 3ab8e2ca421a950555b9866396ea9d2632d3a70d5674096a20968fd0458cfd7d
MD5 364e1e3a2f1d19d03ed006beaf83cb1b
SHA1 5a508286c137d07b6051b47e4cb0dbbbbc7b6eca
SHA512 b5afc7a22906607bc2830e64e6b751e1dd3c7f4c441b967f57a7de88ed75c5eca2e5ab3874ec137dac381d868206c1e0579b8b15ac27004d56610bd2b7dfd387
TLSH
T132419D24C59E02344323846A6FB7D40254C9B9173AD8EE14FD1CA7852FDA63EB6A1B29
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: JavaScript 1 TTPs 4 IoCs

Execution via JavaScript.

execution

JavaScript

T1059.007

pid	Process
1488	node
1488	node
1488	node
1488	node

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/cgroup/memory/memory.limit_in_bytes	node

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/meminfo	node

/tmp/resources/app.asar.unpacked/node_modules/koffi/src/koffi/tools/write_trampolines.js
/tmp/resources/app.asar.unpacked/node_modules/koffi/src/koffi/tools/write_trampolines.js
1⤵
PID:1488

/usr/local/sbin/node
node /tmp/resources/app.asar.unpacked/node_modules/koffi/src/koffi/tools/write_trampolines.js
1⤵
- Command and Scripting Interpreter: JavaScript
PID:1488

/usr/local/bin/node
node /tmp/resources/app.asar.unpacked/node_modules/koffi/src/koffi/tools/write_trampolines.js
1⤵
- Command and Scripting Interpreter: JavaScript
PID:1488

/usr/sbin/node
node /tmp/resources/app.asar.unpacked/node_modules/koffi/src/koffi/tools/write_trampolines.js
1⤵
- Command and Scripting Interpreter: JavaScript
PID:1488

/usr/bin/node
node /tmp/resources/app.asar.unpacked/node_modules/koffi/src/koffi/tools/write_trampolines.js
1⤵
- Command and Scripting Interpreter: JavaScript
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads