Overview
overview
6Static
static
3budget-bac...ler.js
windows10-2004-x64
3budget-bac...ler.js
windows11-ltsc_2024-x64
3budget-bac...ser.js
windows10-2004-x64
3budget-bac...ser.js
windows11-ltsc_2024-x64
3budget-bac...tes.js
windows10-2004-x64
3budget-bac...tes.js
windows11-ltsc_2024-x64
3budget-bac...dex.js
windows10-2004-x64
3budget-bac...dex.js
windows11-ltsc_2024-x64
3budget-bac...n/mime
ubuntu-18.04-amd64
3budget-bac...n/mime
debian-9-armhf
4budget-bac...n/mime
debian-9-mips
3budget-bac...n/mime
debian-9-mipsel
3budget-bac...me.cmd
windows10-2004-x64
3budget-bac...me.cmd
windows11-ltsc_2024-x64
3budget-bac...me.ps1
ubuntu-18.04-amd64
1budget-bac...me.ps1
debian-9-armhf
1budget-bac...me.ps1
debian-9-mips
1budget-bac...me.ps1
debian-9-mipsel
1budget-bac...mkdirp
ubuntu-18.04-amd64
3budget-bac...mkdirp
debian-9-armhf
4budget-bac...mkdirp
debian-9-mips
3budget-bac...mkdirp
debian-9-mipsel
3budget-bac...rp.cmd
windows10-2004-x64
3budget-bac...rp.cmd
windows11-ltsc_2024-x64
3budget-bac...rp.ps1
ubuntu-18.04-amd64
1budget-bac...rp.ps1
debian-9-armhf
1budget-bac...rp.ps1
debian-9-mips
1budget-bac...rp.ps1
debian-9-mipsel
1budget-bac...odemon
ubuntu-18.04-amd64
6budget-bac...odemon
debian-9-armhf
6budget-bac...odemon
debian-9-mips
3budget-bac...odemon
debian-9-mipsel
3Analysis
- max time kernel
4s - max time network
12s - platform
debian-9_armhf - resource
debian9-armhf-20260513-en - resource tags
arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem - submitted
10/11/2026, 15:55
Static task
static1
Behavioral task
behavioral1
Sample
budget-backend/Controllers/userController.js
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
budget-backend/Controllers/userController.js
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
budget-backend/Models/user.js
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
budget-backend/Models/user.js
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
budget-backend/Routes/userRoutes.js
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
budget-backend/Routes/userRoutes.js
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
budget-backend/index.js
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
budget-backend/index.js
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
budget-backend/node_modules/.bin/mime
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
Behavioral task
behavioral10
Sample
budget-backend/node_modules/.bin/mime
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral11
Sample
budget-backend/node_modules/.bin/mime
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral12
Sample
budget-backend/node_modules/.bin/mime
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral13
Sample
budget-backend/node_modules/.bin/mime.cmd
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
budget-backend/node_modules/.bin/mime.cmd
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
budget-backend/node_modules/.bin/mime.ps1
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
Behavioral task
behavioral16
Sample
budget-backend/node_modules/.bin/mime.ps1
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral17
Sample
budget-backend/node_modules/.bin/mime.ps1
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral18
Sample
budget-backend/node_modules/.bin/mime.ps1
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral19
Sample
budget-backend/node_modules/.bin/mkdirp
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
Behavioral task
behavioral20
Sample
budget-backend/node_modules/.bin/mkdirp
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral21
Sample
budget-backend/node_modules/.bin/mkdirp
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral22
Sample
budget-backend/node_modules/.bin/mkdirp
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral23
Sample
budget-backend/node_modules/.bin/mkdirp.cmd
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
budget-backend/node_modules/.bin/mkdirp.cmd
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral25
Sample
budget-backend/node_modules/.bin/mkdirp.ps1
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
Behavioral task
behavioral26
Sample
budget-backend/node_modules/.bin/mkdirp.ps1
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral27
Sample
budget-backend/node_modules/.bin/mkdirp.ps1
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral28
Sample
budget-backend/node_modules/.bin/mkdirp.ps1
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral29
Sample
budget-backend/node_modules/.bin/nodemon
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
Behavioral task
behavioral30
Sample
budget-backend/node_modules/.bin/nodemon
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral31
Sample
budget-backend/node_modules/.bin/nodemon
Resource
debian9-mipsbe-20260513-en
debian-9-mips
General
- Target budget-backend/node_modules/.bin/nodemon
- Size 393B
- Sample261110-tc7s4sgf27
- SHA256 66a2e9a75919b51a98f0fecf4746dd603fbb7784350449408a444a87f8d63d1f
- MD5 737c12e86024f7181c4c77c36bf1b8e0
- SHA1 2806524bcb9e516417a2758dcf1f26b0b5d047fd
- SHA512 08045b0c9f32de5dd2b15e48c933e1a510642fba2560b995b4a5ec98abd275b30ad6368eee0e7497620060796fdec724c210d4a501ee9136581cadc744b1470a
- TLSH T1E5E0D87525E15FBB960942F88D065858416B034378443F5AFD0C3B435BA031DB2E773D
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo node - Reads CPU attributes 1 TTPs 2 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online node -
pid Process 713 node 713 node 713 node 713 node - Command and Scripting Interpreter: Unix Shell 1 TTPs 1 IoCs
Execute scripts via Unix Shell.
pid Process 759 sh - Enumerates kernel/hardware configuration 1 TTPs 1 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/fs/cgroup/memory/memory.limit_in_bytes node -
description ioc Process File opened for reading /proc/filesystems sed File opened for reading /proc/10/status ps File opened for reading /proc/14/status ps File opened for reading /proc/29/stat ps File opened for reading /proc/222/status ps File opened for reading /proc/259/stat ps File opened for reading /proc/591/status ps File opened for reading /proc/710/status ps File opened for reading /proc/12/stat ps File opened for reading /proc/18/stat ps File opened for reading /proc/18/status ps File opened for reading /proc/23/status ps File opened for reading /proc/107/stat ps File opened for reading /proc/282/stat ps File opened for reading /proc/300/status ps File opened for reading /proc/4/status ps File opened for reading /proc/11/status ps File opened for reading /proc/309/status ps File opened for reading /proc/567/status ps File opened for reading /proc/8/status ps File opened for reading /proc/307/stat ps File opened for reading /proc/1/stat ps File opened for reading /proc/2/stat ps File opened for reading /proc/19/stat ps File opened for reading /proc/19/status ps File opened for reading /proc/21/stat ps File opened for reading /proc/169/status ps File opened for reading /proc/17/stat ps File opened for reading /proc/29/status ps File opened for reading /proc/222/stat ps File opened for reading /proc/712/stat ps File opened for reading /proc/13/status ps File opened for reading /proc/109/stat ps File opened for reading /proc/135/stat ps File opened for reading /proc/582/status ps File opened for reading /proc/760/stat ps File opened for reading /proc/8/stat ps File opened for reading /proc/719/status ps File opened for reading /proc/filesystems ps File opened for reading /proc/110/status ps File opened for reading /proc/138/stat ps File opened for reading /proc/149/status ps File opened for reading /proc/6/stat ps File opened for reading /proc/11/stat ps File opened for reading /proc/16/status ps File opened for reading /proc/25/status ps File opened for reading /proc/10/stat ps File opened for reading /proc/15/status ps File opened for reading /proc/282/status ps File opened for reading /proc/312/status ps File opened for reading /proc/638/stat ps File opened for reading /proc/638/status ps File opened for reading /proc/759/stat ps File opened for reading /proc/169/stat ps File opened for reading /proc/579/stat ps File opened for reading /proc/21/status ps File opened for reading /proc/28/stat ps File opened for reading /proc/160/stat ps File opened for reading /proc/292/status ps File opened for reading /proc/325/status ps File opened for reading /proc/135/status ps File opened for reading /proc/284/status ps File opened for reading /proc/591/stat ps File opened for reading /proc/712/status ps
Processes
-
/tmp/budget-backend/node_modules/.bin/nodemon/tmp/budget-backend/node_modules/.bin/nodemon1⤵PID:713
-
/bin/sedsed -e "s,\\\\,/,g"2⤵
- Reads runtime system information
PID:717
-
-
/usr/bin/dirnamedirname /tmp/budget-backend/node_modules/.bin/nodemon2⤵PID:714
-
-
/bin/unameuname2⤵PID:718
-
-
/usr/local/sbin/nodenode /tmp/budget-backend/node_modules/.bin/../nodemon/bin/nodemon.js1⤵
- Command and Scripting Interpreter: JavaScript
PID:713
-
/usr/local/bin/nodenode /tmp/budget-backend/node_modules/.bin/../nodemon/bin/nodemon.js1⤵
- Command and Scripting Interpreter: JavaScript
PID:713
-
/usr/sbin/nodenode /tmp/budget-backend/node_modules/.bin/../nodemon/bin/nodemon.js1⤵
- Command and Scripting Interpreter: JavaScript
PID:713
-
/usr/bin/nodenode /tmp/budget-backend/node_modules/.bin/../nodemon/bin/nodemon.js1⤵
- Checks CPU configuration
- Reads CPU attributes
- Command and Scripting Interpreter: JavaScript
- Enumerates kernel/hardware configuration
PID:713 -
/bin/sh/bin/sh -c ps2⤵
- Command and Scripting Interpreter: Unix Shell
PID:759 -
/bin/psps3⤵
- Reads CPU attributes
- Reads runtime system information
PID:760
-
-