Analysis
- user interaction
yes - max time kernel
292s - max time network
295s - platform
debian-12_armhf - resource
debian12-armhf-20260127-en - resource tags
- submitted
03/10/2026, 23:59
General
- Target server.js
- Size 4KB
- Sample261003-3147ka1vbz
- SHA256 2d621150f6cdbb79aa1f56959464666395d1eb80ad95178c6c7b0c67e993f09c
Score
6/10
Malware Config
Signatures
- Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
- Command and Scripting Interpreter: JavaScript 1 TTPs 1 IoCs
Execution via JavaScript.
- Enumerates kernel/hardware configuration 1 TTPs 2 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
- Reads runtime system information 3 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/usr/bin/nodenode /tmp/server.js1⤵
- Checks CPU configuration
- Command and Scripting Interpreter: JavaScript
- Enumerates kernel/hardware configuration
- Reads runtime system information