3ab8e2ca421a950555b9866396ea9d2632d3a70d5674096a20968fd0458cfd7d

Resubmissions

28/06/2026, 02:06

260628-cjqdzaey6z

28/06/2026, 01:58

260628-cd19aaey6p9

Analysis

max time kernel
22s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
28/06/2026, 01:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
resources/app.asar.unpacked/node_modules/koffi/src/koffi/tools/write_trampolines.js
Size 1KB
Sample260628-cd19aaey6p
SHA256 3ab8e2ca421a950555b9866396ea9d2632d3a70d5674096a20968fd0458cfd7d
MD5 364e1e3a2f1d19d03ed006beaf83cb1b
SHA1 5a508286c137d07b6051b47e4cb0dbbbbc7b6eca
SHA512 b5afc7a22906607bc2830e64e6b751e1dd3c7f4c441b967f57a7de88ed75c5eca2e5ab3874ec137dac381d868206c1e0579b8b15ac27004d56610bd2b7dfd387
TLSH
T132419D24C59E02344323846A6FB7D40254C9B9173AD8EE14FD1CA7852FDA63EB6A1B29
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: JavaScript 1 TTPs 6 IoCs

Execution via JavaScript.

execution

JavaScript

T1059.007

pid	Process
813	node
813	node
813	node
813	node
813	node
813	node

/tmp/resources/app.asar.unpacked/node_modules/koffi/src/koffi/tools/write_trampolines.js
/tmp/resources/app.asar.unpacked/node_modules/koffi/src/koffi/tools/write_trampolines.js
1⤵
PID:813

/usr/local/sbin/node
node /tmp/resources/app.asar.unpacked/node_modules/koffi/src/koffi/tools/write_trampolines.js
1⤵
- Command and Scripting Interpreter: JavaScript
PID:813

/usr/local/bin/node
node /tmp/resources/app.asar.unpacked/node_modules/koffi/src/koffi/tools/write_trampolines.js
1⤵
- Command and Scripting Interpreter: JavaScript
PID:813

/usr/sbin/node
node /tmp/resources/app.asar.unpacked/node_modules/koffi/src/koffi/tools/write_trampolines.js
1⤵
- Command and Scripting Interpreter: JavaScript
PID:813

/usr/bin/node
node /tmp/resources/app.asar.unpacked/node_modules/koffi/src/koffi/tools/write_trampolines.js
1⤵
- Command and Scripting Interpreter: JavaScript
PID:813

/sbin/node
node /tmp/resources/app.asar.unpacked/node_modules/koffi/src/koffi/tools/write_trampolines.js
1⤵
- Command and Scripting Interpreter: JavaScript
PID:813

/bin/node
node /tmp/resources/app.asar.unpacked/node_modules/koffi/src/koffi/tools/write_trampolines.js
1⤵
- Command and Scripting Interpreter: JavaScript
PID:813

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads