Overview

overview

7

Static

static

3

5c23845f69...54.exe

windows10-2004-x64

7

5c23845f69...54.exe

windows11-ltsc_2024-x64

7

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

LICENSES.c...m.html

windows10-2004-x64

3

LICENSES.c...m.html

windows11-ltsc_2024-x64

3

d3dcompiler_47.dll

windows10-2004-x64

1

dxcompiler.dll

windows10-2004-x64

1

dxil.dll

windows10-2004-x64

1

ffmpeg.dll

windows10-2004-x64

1

gate.exe

windows10-2004-x64

7

libEGL.dll

windows10-2004-x64

1

libGLESv2.dll

windows10-2004-x64

1

resources/...e3.dll

windows10-2004-x64

1

resources/...e3.dll

windows11-ltsc_2024-x64

1

resources/...opy.js

windows10-2004-x64

3

resources/...opy.js

windows11-ltsc_2024-x64

3

resources/...oad.sh

ubuntu-18.04-amd64

7

resources/...oad.sh

debian-9-armhf

4

resources/...oad.sh

debian-9-mips

3

resources/...oad.sh

debian-9-mipsel

3

resources/...ase.js

windows10-2004-x64

3

resources/...ase.js

windows11-ltsc_2024-x64

3

resources/...dex.js

windows10-2004-x64

3

resources/...dex.js

windows11-ltsc_2024-x64

3

resources/...ate.js

windows10-2004-x64

3

resources/...ate.js

windows11-ltsc_2024-x64

3

resources/...kup.js

windows10-2004-x64

3

resources/...kup.js

windows11-ltsc_2024-x64

3

resources/...ion.js

windows10-2004-x64

3

Analysis

  • max time kernel
    14s
  • max time network
    151s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20260513-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    31/08/2026, 04:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    resources/app.asar.unpacked/node_modules/better-sqlite3/deps/download.sh
  • Size 3KB
  • Sample260831-ffdsjsxtgv
  • SHA256 dd195036c9b7e7fb420c7e9ee118b33a9be9a5e61266f66663cf7f14b9844257
  • MD5 SHA1 SHA512 TLSH
Score
3/10
discovery

Malware Config

Signatures

  • Reads runtime system information 4 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 1 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/download.sh
    /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/download.sh
    1⤵
      PID:799
    • /usr/local/sbin/bash
      bash /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/download.sh
      1⤵
        PID:799
      • /usr/local/bin/bash
        bash /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/download.sh
        1⤵
          PID:799
        • /usr/sbin/bash
          bash /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/download.sh
          1⤵
            PID:799
          • /usr/bin/bash
            bash /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/download.sh
            1⤵
              PID:799
            • /sbin/bash
              bash /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/download.sh
              1⤵
                PID:799
              • /bin/bash
                bash /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/download.sh
                1⤵
                • Writes file to tmp directory
                PID:799
                • /usr/bin/dirname
                  dirname -- /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/download.sh
                  2⤵
                    PID:802
                  • /bin/rm
                    rm -rf /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/temp
                    2⤵
                      PID:803
                    • /bin/rm
                      rm -rf /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/sqlite3
                      2⤵
                        PID:804
                      • /bin/mkdir
                        mkdir -p /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/temp
                        2⤵
                        • Reads runtime system information
                        PID:805
                      • /bin/mkdir
                        mkdir -p /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/sqlite3
                        2⤵
                        • Reads runtime system information
                        PID:806
                      • /bin/sed
                        sed -e "/^\\s*\$/d" -e "s/^/-D/"
                        2⤵
                        • Reads runtime system information
                        PID:813
                      • /usr/bin/curl
                        curl "-#f" https://www.sqlite.org/2026/sqlite-src-3510300.zip
                        2⤵
                        • Reads runtime system information
                        • System Network Configuration Discovery
                        PID:814

                    Network

                          MITRE ATT&CK Enterprise v16

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          source.zip
                          • Path /tmp/resources/app.asar.unpacked/node_modules/better-sqlite3/deps/temp/source.zip
                          • Size 13.5MB
                          • SHA256 f8a67a1f5b5cae7c6d42f0994ca7bf1a4a5858868c82adc9fc1340bed5eb8cd2
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download