Analysis
- max time kernel
0s - max time network
129s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
- submitted
10/09/2026, 20:35
General
- Target package/setup_bun.js
- Size 4KB
- Sample260910-zddvbawbmg
- SHA256 a3894003ad1d293ba96d77881ccd2071446dc3f65f434669b49b3da92421901a
Score
4/10
Malware Config
Signatures
- Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
- Command and Scripting Interpreter: JavaScript 1 TTPs 4 IoCs
Execution via JavaScript.
- Command and Scripting Interpreter: Unix Shell 1 TTPs 2 IoCs
Execute scripts via Unix Shell.
- Enumerates kernel/hardware configuration 1 TTPs 1 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
- Reads runtime system information 1 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/package/setup_bun.js/tmp/package/setup_bun.js1⤵
-
/usr/local/sbin/nodenode /tmp/package/setup_bun.js1⤵
- Command and Scripting Interpreter: JavaScript
-
/usr/local/bin/nodenode /tmp/package/setup_bun.js1⤵
- Command and Scripting Interpreter: JavaScript
-
/usr/sbin/nodenode /tmp/package/setup_bun.js1⤵
- Command and Scripting Interpreter: JavaScript
-
/usr/bin/nodenode /tmp/package/setup_bun.js1⤵
- Command and Scripting Interpreter: JavaScript
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/bin/sh/bin/sh -c "which bun"2⤵
- Command and Scripting Interpreter: Unix Shell
-
/usr/bin/whichwhich bun3⤵
-
-
-
/bin/sh/bin/sh -c "curl -fsSL https://bun.sh/install | bash"2⤵
- Command and Scripting Interpreter: Unix Shell
-
/bin/bashbash3⤵
-
/bin/unameuname -ms4⤵
-
-
/bin/grepgrep avx24⤵
-
-
/bin/catcat /proc/cpuinfo4⤵
- Checks CPU configuration
-
-
-
/usr/bin/curlcurl -fsSL https://bun.sh/install3⤵
-
-