a3894003ad1d293ba96d77881ccd2071446dc3f65f434669b49b3da92421901a

Analysis

max time kernel
4s
max time network
7s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
10/09/2026, 20:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
package/setup_bun.js
Size 4KB
Sample260910-zddvbawbmg
SHA256 a3894003ad1d293ba96d77881ccd2071446dc3f65f434669b49b3da92421901a
MD5 4d6b9efc22ec229be58b90c7991c02dd
SHA1 d1829b4708126dcc7bea7437c04d1f10eacd4a16
SHA512 f5ed37c62d3a77c03c5e7d5b5c8817516272b031501301d75a70a5e1a397b583978a026a4d1f773fe0ad9d86c4b5d25b0d93ff9a1c6f2a085795a7746972b397
SSDEEP 96:oRidw8n2VyIIz9iIIsn8n5N1ZsWLC2BPZFJy3wh18e4k5BJMedXC91f4:oRij2VyTRiIPnsNcWLC2BPZFJygPZFlV
TLSH
T1B7A1764E87F71A316AA3BA9D1B4F1515142B92133149ED6879CC87846F11A3883F2EFF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

antivm discovery execution

Malware Config

Signatures

Checks CPU configuration 1 TTPs 2 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	node
File opened for reading	/proc/cpuinfo	curl

Reads CPU attributes 1 TTPs 1 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	node

Command and Scripting Interpreter: JavaScript 1 TTPs 4 IoCs

Execution via JavaScript.

execution

JavaScript

T1059.007

pid	Process
672	node
672	node
672	node
672	node

Command and Scripting Interpreter: Unix Shell 1 TTPs 2 IoCs

Execute scripts via Unix Shell.

execution

Unix Shell

T1059.004

pid	Process
727	sh
729	sh

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/cgroup/memory/memory.limit_in_bytes	node

Reads runtime system information 3 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/meminfo	node
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl

/tmp/package/setup_bun.js
/tmp/package/setup_bun.js
1⤵
PID:672

/usr/local/sbin/node
node /tmp/package/setup_bun.js
1⤵
- Command and Scripting Interpreter: JavaScript
PID:672

/usr/local/bin/node
node /tmp/package/setup_bun.js
1⤵
- Command and Scripting Interpreter: JavaScript
PID:672

/usr/sbin/node
node /tmp/package/setup_bun.js
1⤵
- Command and Scripting Interpreter: JavaScript
PID:672

/usr/bin/node
node /tmp/package/setup_bun.js
1⤵
- Checks CPU configuration
- Reads CPU attributes
- Command and Scripting Interpreter: JavaScript
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:672
- /bin/sh
  /bin/sh -c "which bun"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:727
- - /usr/bin/which
    which bun
    3⤵
    PID:728
- /bin/sh
  /bin/sh -c "curl -fsSL https://bun.sh/install | bash"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:729
- - /bin/bash
    bash
    3⤵
    PID:731
  - - /bin/uname
      uname -ms
      4⤵
      PID:734
- - /usr/bin/curl
    curl -fsSL https://bun.sh/install
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    PID:730