Analysis
- max time kernel
0s - max time network
131s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
- submitted
24/07/2026, 03:57
General
- Target ZenithMacros-1.1.6-Unlocked/source/node_modules/node-gyp-build/bin.js
- Size 2KB
- Sample260724-ejba6a1vdt
- SHA256 dc022adc093b9b79e1a0ef4b6bc3e6a52e3d627102113dad4afacbbe81f13a26
Score
3/10
Malware Config
Signatures
- Command and Scripting Interpreter: JavaScript 1 TTPs 4 IoCs
Execution via JavaScript.
- Command and Scripting Interpreter: Unix Shell 1 TTPs 1 IoCs
Execute scripts via Unix Shell.
- Enumerates kernel/hardware configuration 1 TTPs 1 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
- Reads runtime system information 1 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/ZenithMacros-1.1.6-Unlocked/source/node_modules/node-gyp-build/bin.js/tmp/ZenithMacros-1.1.6-Unlocked/source/node_modules/node-gyp-build/bin.js1⤵
-
/usr/local/sbin/nodenode /tmp/ZenithMacros-1.1.6-Unlocked/source/node_modules/node-gyp-build/bin.js1⤵
- Command and Scripting Interpreter: JavaScript
-
/usr/local/bin/nodenode /tmp/ZenithMacros-1.1.6-Unlocked/source/node_modules/node-gyp-build/bin.js1⤵
- Command and Scripting Interpreter: JavaScript
-
/usr/sbin/nodenode /tmp/ZenithMacros-1.1.6-Unlocked/source/node_modules/node-gyp-build/bin.js1⤵
- Command and Scripting Interpreter: JavaScript
-
/usr/bin/nodenode /tmp/ZenithMacros-1.1.6-Unlocked/source/node_modules/node-gyp-build/bin.js1⤵
- Command and Scripting Interpreter: JavaScript
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/bin/sh/bin/sh -c node-gyp-build-test2⤵
- Command and Scripting Interpreter: Unix Shell
-
-
/usr/local/sbin/node-gypnode-gyp rebuild2⤵
-
-
/usr/local/bin/node-gypnode-gyp rebuild2⤵
-
-
/usr/sbin/node-gypnode-gyp rebuild2⤵
-
-
/usr/bin/node-gypnode-gyp rebuild2⤵
-
-
/sbin/node-gypnode-gyp rebuild2⤵
-
-
/bin/node-gypnode-gyp rebuild2⤵
-
-
/snap/bin/node-gypnode-gyp rebuild2⤵
-