5de8af6e9f41fc1b5f6d280cdc55d62c2a210faf722c7e529b6b3427be7c80a8

Analysis

max time kernel
4s
max time network
48s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
09/08/2026, 13:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
resources/app.asar.unpacked/node_modules/better-sqlite3/deps/download.sh
Size 3KB
Sample260809-qfpvxsyapb
SHA256 5de8af6e9f41fc1b5f6d280cdc55d62c2a210faf722c7e529b6b3427be7c80a8
MD5 cf1d12194f2ffaadb8152502571c19a1
SHA1 68777900b2d533d72ae32ede40862a0db8196791
SHA512 8b20362f71c1ead34bb448d9acf31ccade3ead4c3fab326e7abc4617c0abb1a56a36eecc3218ad87e43af8289c8bf0280469c0e59dd1d0f6d5cc3246a6a1730c
TLSH
T1118160F7A789067D24C70069A12D62CABA23C32F8B7478485089566C0530AE45FBACFF
MD5 SHA1 SHA512 TLSH

Score

4^/10

antivm discovery

Malware Config

Signatures

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 5 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/filesystems	mkdir

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
767	curl

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/temp/source.zip	bash

/tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/download.sh
/tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/download.sh
1⤵
PID:752

/usr/local/sbin/bash
bash /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/download.sh
1⤵
PID:752

/usr/local/bin/bash
bash /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/download.sh
1⤵
PID:752

/usr/sbin/bash
bash /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/download.sh
1⤵
PID:752

/usr/bin/bash
bash /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/download.sh
1⤵
PID:752

/sbin/bash
bash /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/download.sh
1⤵
PID:752

/bin/bash
bash /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/download.sh
1⤵
- Writes file to tmp directory
PID:752
- /usr/bin/dirname
  dirname -- /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/download.sh
  2⤵
  PID:755
- /bin/rm
  rm -rf /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/temp
  2⤵
  PID:756
- /bin/rm
  rm -rf /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/sqlite3
  2⤵
  PID:757
- /bin/mkdir
  mkdir -p /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/temp
  2⤵
  - Reads runtime system information
  PID:758
- /bin/mkdir
  mkdir -p /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/sqlite3
  2⤵
  - Reads runtime system information
  PID:761
- /bin/sed
  sed -e "/^\\s*\$/d" -e "s/^/-D/"
  2⤵
  - Reads runtime system information
  PID:766
- /usr/bin/curl
  curl "-#f" https://www.sqlite.org/2025/sqlite-src-3490200.zip
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:767

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

source.zip

Path /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/temp/source.zip
Size 13.7MB
SHA256 c3101978244669a43bc09f44fa21e47a4e25cdf440f1829e9eff176b9a477862
MD5 e9e6dee0a5308225f75af8ad70a2eee2
SHA1 5dc2992cf75aac85d8b8a54b87cdbe68ef04f13d
SHA512 d07600391df9fd635b1d43cff208021450a18cedad67221e239b0ed86ef287f2f31c040ac413c8a69123615f01658b68f26b6e70a71da39be3ead372a13c8bdc
SSDEEP 196608:lebQpCjeYeSsdhh5A1RHTn6FYg6RE/KfoHoXB9eCwX3kMDFUNSMBPpAPWgsf9IoK:le6aeYeSdT6OgdHs95sxDSBmPWgKK
TLSH
T1ADE612B8C53B8C27DA4F8024CB9C9DEAD977C40E9586A42B2C1453C1DFA905A5E73F4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads