Overview
overview
6Static
static
3Backend Ca.../db.js
windows10-2004-x64
3Backend Ca.../db.js
windows11-ltsc_2024-x64
3Backend Ca...are.js
windows10-2004-x64
3Backend Ca...are.js
windows11-ltsc_2024-x64
3Backend Ca...Car.js
windows10-2004-x64
3Backend Ca...Car.js
windows11-ltsc_2024-x64
3Backend Ca...tal.js
windows10-2004-x64
3Backend Ca...tal.js
windows11-ltsc_2024-x64
3Backend Ca...ser.js
windows10-2004-x64
3Backend Ca...ser.js
windows11-ltsc_2024-x64
3Backend Ca...n/mime
ubuntu-18.04-amd64
3Backend Ca...n/mime
debian-9-armhf
4Backend Ca...n/mime
debian-9-mips
3Backend Ca...n/mime
debian-9-mipsel
3Backend Ca...me.cmd
windows10-2004-x64
3Backend Ca...me.cmd
windows11-ltsc_2024-x64
3Backend Ca...me.ps1
ubuntu-18.04-amd64
1Backend Ca...me.ps1
debian-9-armhf
1Backend Ca...me.ps1
debian-9-mips
1Backend Ca...me.ps1
debian-9-mipsel
1Backend Ca...odemon
ubuntu-18.04-amd64
6Backend Ca...odemon
debian-9-armhf
6Backend Ca...odemon
debian-9-mips
3Backend Ca...odemon
debian-9-mipsel
3Backend Ca...on.cmd
windows10-2004-x64
3Backend Ca...on.cmd
windows11-ltsc_2024-x64
3Backend Ca...on.ps1
ubuntu-18.04-amd64
1Backend Ca...on.ps1
debian-9-armhf
1Backend Ca...on.ps1
debian-9-mips
1Backend Ca...on.ps1
debian-9-mipsel
1Backend Ca...etouch
ubuntu-18.04-amd64
3Backend Ca...etouch
debian-9-armhf
4Analysis
- max time kernel
5s - max time network
17s - platform
debian-9_armhf - resource
debian9-armhf-20260513-en - resource tags
arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem - submitted
27/10/2026, 07:50
Static task
static1
Behavioral task
behavioral1
Sample
Backend Car Rentel/backend/config/db.js
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
Backend Car Rentel/backend/config/db.js
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
Backend Car Rentel/backend/middleware/authMiddleware.js
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
Backend Car Rentel/backend/middleware/authMiddleware.js
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
Backend Car Rentel/backend/models/Car.js
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
Backend Car Rentel/backend/models/Car.js
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
Backend Car Rentel/backend/models/Rental.js
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
Backend Car Rentel/backend/models/Rental.js
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
Backend Car Rentel/backend/models/User.js
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
Backend Car Rentel/backend/models/User.js
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
Backend Car Rentel/backend/node_modules/.bin/mime
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
Behavioral task
behavioral12
Sample
Backend Car Rentel/backend/node_modules/.bin/mime
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral13
Sample
Backend Car Rentel/backend/node_modules/.bin/mime
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral14
Sample
Backend Car Rentel/backend/node_modules/.bin/mime
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral15
Sample
Backend Car Rentel/backend/node_modules/.bin/mime.cmd
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
Backend Car Rentel/backend/node_modules/.bin/mime.cmd
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
Backend Car Rentel/backend/node_modules/.bin/mime.ps1
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
Behavioral task
behavioral18
Sample
Backend Car Rentel/backend/node_modules/.bin/mime.ps1
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral19
Sample
Backend Car Rentel/backend/node_modules/.bin/mime.ps1
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral20
Sample
Backend Car Rentel/backend/node_modules/.bin/mime.ps1
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral21
Sample
Backend Car Rentel/backend/node_modules/.bin/nodemon
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
Behavioral task
behavioral22
Sample
Backend Car Rentel/backend/node_modules/.bin/nodemon
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral23
Sample
Backend Car Rentel/backend/node_modules/.bin/nodemon
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral24
Sample
Backend Car Rentel/backend/node_modules/.bin/nodemon
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral25
Sample
Backend Car Rentel/backend/node_modules/.bin/nodemon.cmd
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
Backend Car Rentel/backend/node_modules/.bin/nodemon.cmd
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral27
Sample
Backend Car Rentel/backend/node_modules/.bin/nodemon.ps1
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
Behavioral task
behavioral28
Sample
Backend Car Rentel/backend/node_modules/.bin/nodemon.ps1
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral29
Sample
Backend Car Rentel/backend/node_modules/.bin/nodemon.ps1
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral30
Sample
Backend Car Rentel/backend/node_modules/.bin/nodemon.ps1
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral31
Sample
Backend Car Rentel/backend/node_modules/.bin/nodetouch
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
General
- Target Backend Car Rentel/backend/node_modules/.bin/nodemon
- Size 393B
- Sample261027-jphpmsbv4v
- SHA256 66a2e9a75919b51a98f0fecf4746dd603fbb7784350449408a444a87f8d63d1f
- MD5 737c12e86024f7181c4c77c36bf1b8e0
- SHA1 2806524bcb9e516417a2758dcf1f26b0b5d047fd
- SHA512 08045b0c9f32de5dd2b15e48c933e1a510642fba2560b995b4a5ec98abd275b30ad6368eee0e7497620060796fdec724c210d4a501ee9136581cadc744b1470a
- TLSH T1E5E0D87525E15FBB960942F88D065858416B034378443F5AFD0C3B435BA031DB2E773D
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo node - Reads CPU attributes 1 TTPs 2 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online node File opened for reading /sys/devices/system/cpu/online ps - Command and Scripting Interpreter: Unix Shell 1 TTPs 1 IoCs
Execute scripts via Unix Shell.
pid Process 758 sh - Enumerates kernel/hardware configuration 1 TTPs 1 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/fs/cgroup/memory/memory.limit_in_bytes node -
description ioc Process File opened for reading /proc/filesystems ps File opened for reading /proc/17/stat ps File opened for reading /proc/97/stat ps File opened for reading /proc/294/stat ps File opened for reading /proc/295/status ps File opened for reading /proc/meminfo ps File opened for reading /proc/14/stat ps File opened for reading /proc/20/status ps File opened for reading /proc/284/stat ps File opened for reading /proc/294/status ps File opened for reading /proc/591/stat ps File opened for reading /proc/713/status ps File opened for reading /proc/758/status ps File opened for reading /proc/sys/vm/overcommit_memory node File opened for reading /proc/3/status ps File opened for reading /proc/306/status ps File opened for reading /proc/565/stat ps File opened for reading /proc/582/stat ps File opened for reading /proc/759/status ps File opened for reading /proc/14/status ps File opened for reading /proc/15/status ps File opened for reading /proc/22/stat ps File opened for reading /proc/10/stat ps File opened for reading /proc/29/stat ps File opened for reading /proc/135/status ps File opened for reading /proc/585/stat ps File opened for reading /proc/filesystems sed File opened for reading /proc/4/status ps File opened for reading /proc/2/stat ps File opened for reading /proc/24/stat ps File opened for reading /proc/224/stat ps File opened for reading /proc/327/status ps File opened for reading /proc/712/stat ps File opened for reading /proc/759/stat ps File opened for reading /proc/19/status ps File opened for reading /proc/758/stat ps File opened for reading /proc/21/stat ps File opened for reading /proc/41/stat ps File opened for reading /proc/633/status ps File opened for reading /proc/712/status ps File opened for reading /proc/18/status ps File opened for reading /proc/43/stat ps File opened for reading /proc/301/status ps File opened for reading /proc/719/stat ps File opened for reading /proc/sys/kernel/osrelease ps File opened for reading /proc/27/status ps File opened for reading /proc/135/stat ps File opened for reading /proc/295/stat ps File opened for reading /proc/7/status ps File opened for reading /proc/21/status ps File opened for reading /proc/106/stat ps File opened for reading /proc/106/status ps File opened for reading /proc/710/stat ps File opened for reading /proc/167/stat ps File opened for reading /proc/284/status ps File opened for reading /proc/306/stat ps File opened for reading /proc/uptime ps File opened for reading /proc/2/status ps File opened for reading /proc/3/stat ps File opened for reading /proc/5/stat ps File opened for reading /proc/18/stat ps File opened for reading /proc/291/stat ps File opened for reading /proc/41/status ps File opened for reading /proc/1/stat ps
Processes
-
/tmp/Backend Car Rentel/backend/node_modules/.bin/nodemon"/tmp/Backend Car Rentel/backend/node_modules/.bin/nodemon"1⤵PID:713
-
/bin/sedsed -e "s,\\\\,/,g"2⤵
- Reads runtime system information
PID:717
-
-
/usr/bin/dirnamedirname "/tmp/Backend Car Rentel/backend/node_modules/.bin/nodemon"2⤵PID:714
-
-
/bin/unameuname2⤵PID:718
-
-
/usr/local/sbin/nodenode "/tmp/Backend Car Rentel/backend/node_modules/.bin/../nodemon/bin/nodemon.js"1⤵PID:713
-
/usr/local/bin/nodenode "/tmp/Backend Car Rentel/backend/node_modules/.bin/../nodemon/bin/nodemon.js"1⤵PID:713
-
/usr/sbin/nodenode "/tmp/Backend Car Rentel/backend/node_modules/.bin/../nodemon/bin/nodemon.js"1⤵PID:713
-
/usr/bin/nodenode "/tmp/Backend Car Rentel/backend/node_modules/.bin/../nodemon/bin/nodemon.js"1⤵
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:713 -
/bin/sh/bin/sh -c ps2⤵
- Command and Scripting Interpreter: Unix Shell
PID:758 -
/bin/psps3⤵
- Reads CPU attributes
- Reads runtime system information
PID:759
-
-