Analysis
- max time kernel
5s - platform
debian-9_armhf - resource
debian9-armhf-20260513-en - resource tags
- submitted
04/11/2026, 18:52
General
- Target node_modules/.bin/ejs
- Size 296B
- Sample261104-xjhdkstycw
- SHA256 6a3d8e1bdff738330d53d1218578ba8662f2492c0a096cf8b44657c68f9f0978
Score
4/10
Malware Config
Signatures
- Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
- Reads CPU attributes 1 TTPs 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs 4 IoCs
Execution via JavaScript.
- Enumerates kernel/hardware configuration 1 TTPs 1 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
- Reads runtime system information 2 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/node_modules/.bin/ejs/tmp/node_modules/.bin/ejs1⤵
-
/bin/sedsed -e "s,\\\\,/,g"2⤵
- Reads runtime system information
-
-
/usr/bin/dirnamedirname /tmp/node_modules/.bin/ejs2⤵
-
-
/bin/unameuname2⤵
-
-
/usr/local/sbin/nodenode /tmp/node_modules/.bin/../ejs/bin/cli.js1⤵
- Command and Scripting Interpreter: JavaScript
-
/usr/local/bin/nodenode /tmp/node_modules/.bin/../ejs/bin/cli.js1⤵
- Command and Scripting Interpreter: JavaScript
-
/usr/sbin/nodenode /tmp/node_modules/.bin/../ejs/bin/cli.js1⤵
- Command and Scripting Interpreter: JavaScript
-
/usr/bin/nodenode /tmp/node_modules/.bin/../ejs/bin/cli.js1⤵
- Checks CPU configuration
- Reads CPU attributes
- Command and Scripting Interpreter: JavaScript
- Enumerates kernel/hardware configuration
- Reads runtime system information