Overview

overview

8

Static

static

3

Vilonity Setup.exe

windows10-2004-x64

8

Vilonity Setup.exe

windows11-ltsc_2024-x64

8

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...er.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ll.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows11-ltsc_2024-x64

3

$PLUGINSDIR/app-64.7z

windows10-2004-x64

1

$PLUGINSDIR/app-64.7z

windows11-ltsc_2024-x64

1

resources/...dex.js

windows10-2004-x64

3

resources/...dex.js

windows11-ltsc_2024-x64

3

resources/...pi.dll

windows10-2004-x64

1

resources/...pi.dll

windows11-ltsc_2024-x64

1

resources/...e3.dll

windows10-2004-x64

1

resources/...e3.dll

windows11-ltsc_2024-x64

1

resources/...opy.js

windows10-2004-x64

3

resources/...opy.js

windows11-ltsc_2024-x64

3

resources/...oad.sh

ubuntu-18.04-amd64

7

resources/...oad.sh

debian-9-armhf

4

resources/...oad.sh

debian-9-mips

3

resources/...oad.sh

debian-9-mipsel

3

resources/...ase.js

windows10-2004-x64

3

resources/...ase.js

windows11-ltsc_2024-x64

3

resources/...dex.js

windows10-2004-x64

3

resources/...dex.js

windows11-ltsc_2024-x64

3

resources/...ate.js

windows10-2004-x64

3

resources/...ate.js

windows11-ltsc_2024-x64

3

resources/...kup.js

windows10-2004-x64

3

resources/...kup.js

windows11-ltsc_2024-x64

3

Analysis

  • max time kernel
    22s
  • max time network
    64s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20260513-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    23/08/2026, 22:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    resources/app.asar.unpacked/node_modules/better-sqlite3/deps/download.sh
  • Size 3KB
  • Sample260823-2jae7a1crd
  • SHA256 8501c2c20079610f4e1258eec8860502f8b61aa7f444731dedf0c4e561e76947
  • MD5 SHA1 SHA512 TLSH
Score
3/10
discovery

Malware Config

Signatures

  • Reads runtime system information 4 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 1 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/download.sh
    /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/download.sh
    1⤵
      PID:811
    • /usr/local/sbin/bash
      bash /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/download.sh
      1⤵
        PID:811
      • /usr/local/bin/bash
        bash /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/download.sh
        1⤵
          PID:811
        • /usr/sbin/bash
          bash /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/download.sh
          1⤵
            PID:811
          • /usr/bin/bash
            bash /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/download.sh
            1⤵
              PID:811
            • /sbin/bash
              bash /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/download.sh
              1⤵
                PID:811
              • /bin/bash
                bash /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/download.sh
                1⤵
                • Writes file to tmp directory
                PID:811
                • /usr/bin/dirname
                  dirname -- /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/download.sh
                  2⤵
                    PID:814
                  • /bin/rm
                    rm -rf /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/temp
                    2⤵
                      PID:816
                    • /bin/rm
                      rm -rf /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/sqlite3
                      2⤵
                        PID:818
                      • /bin/mkdir
                        mkdir -p /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/temp
                        2⤵
                        • Reads runtime system information
                        PID:821
                      • /bin/mkdir
                        mkdir -p /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/sqlite3
                        2⤵
                        • Reads runtime system information
                        PID:822
                      • /bin/sed
                        sed -e "/^\\s*\$/d" -e "s/^/-D/"
                        2⤵
                        • Reads runtime system information
                        PID:826
                      • /usr/bin/curl
                        curl "-#f" https://www.sqlite.org/2025/sqlite-src-3500400.zip
                        2⤵
                        • Reads runtime system information
                        • System Network Configuration Discovery
                        PID:827

                    Network

                          MITRE ATT&CK Enterprise v16

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          source.zip
                          • Path /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/temp/source.zip
                          • Size 13.7MB
                          • SHA256 b7b4dc060f36053902fb65b344bbbed592e64b2291a26ac06fe77eec097850e9
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download