66a2e9a75919b51a98f0fecf4746dd603fbb7784350449408a444a87f8d63d1f

Analysis

max time kernel
1s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
10/11/2026, 15:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
budget-backend/node_modules/.bin/nodemon
Size 393B
Sample261110-tc7s4sgf27
SHA256 66a2e9a75919b51a98f0fecf4746dd603fbb7784350449408a444a87f8d63d1f
MD5 737c12e86024f7181c4c77c36bf1b8e0
SHA1 2806524bcb9e516417a2758dcf1f26b0b5d047fd
SHA512 08045b0c9f32de5dd2b15e48c933e1a510642fba2560b995b4a5ec98abd275b30ad6368eee0e7497620060796fdec724c210d4a501ee9136581cadc744b1470a
TLSH
T1E5E0D87525E15FBB960942F88D065858416B034378443F5AFD0C3B435BA031DB2E773D
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: JavaScript 1 TTPs 6 IoCs

Execution via JavaScript.

execution

JavaScript

T1059.007

pid	Process
741	node
741	node
741	node
741	node
741	node
741	node

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	sed

/tmp/budget-backend/node_modules/.bin/nodemon
/tmp/budget-backend/node_modules/.bin/nodemon
1⤵
PID:741
- /bin/sed
  sed -e "s,\\\\,/,g"
  2⤵
  - Reads runtime system information
  PID:745
- /usr/bin/dirname
  dirname /tmp/budget-backend/node_modules/.bin/nodemon
  2⤵
  PID:742
- /bin/uname
  uname
  2⤵
  PID:750

/usr/local/sbin/node
node /tmp/budget-backend/node_modules/.bin/../nodemon/bin/nodemon.js
1⤵
- Command and Scripting Interpreter: JavaScript
PID:741

/usr/local/bin/node
node /tmp/budget-backend/node_modules/.bin/../nodemon/bin/nodemon.js
1⤵
- Command and Scripting Interpreter: JavaScript
PID:741

/usr/sbin/node
node /tmp/budget-backend/node_modules/.bin/../nodemon/bin/nodemon.js
1⤵
- Command and Scripting Interpreter: JavaScript
PID:741

/usr/bin/node
node /tmp/budget-backend/node_modules/.bin/../nodemon/bin/nodemon.js
1⤵
- Command and Scripting Interpreter: JavaScript
PID:741

/sbin/node
node /tmp/budget-backend/node_modules/.bin/../nodemon/bin/nodemon.js
1⤵
- Command and Scripting Interpreter: JavaScript
PID:741

/bin/node
node /tmp/budget-backend/node_modules/.bin/../nodemon/bin/nodemon.js
1⤵
- Command and Scripting Interpreter: JavaScript
PID:741

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads