394b93eaaac25f18a20d7cdd80920ecca1fe43c8e5b37501389e644944c6e01f

Analysis

max time kernel
0s
max time network
130s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20261019-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20261019-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
10/11/2026, 15:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
budget-backend/node_modules/.bin/mime
Size 371B
Sample261110-tc7s4sgf27
SHA256 394b93eaaac25f18a20d7cdd80920ecca1fe43c8e5b37501389e644944c6e01f
MD5 7ab5bfff58b0a878a4614cddbe424702
SHA1 e75ad406ef2f9fcb1a9bde44ba669f416c824c4f
SHA512 36f59fb7f2a1f985210ce39fb90e6e7998e4ba8030f172496eda22a12c66b58c651211d0f682c2b0ec58a6e1ae19d59380d1fe0c6849f15fcf381df60123aaeb
TLSH
T19AE0D87114A15F76910942F9DD155858415A1347B4043F95FD0C3B435BA031DB2E7B2D
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: JavaScript 1 TTPs 4 IoCs

Execution via JavaScript.

execution

JavaScript

T1059.007

pid	Process
1511	node
1511	node
1511	node
1511	node

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/cgroup/memory/memory.limit_in_bytes	node

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/meminfo	node

/tmp/budget-backend/node_modules/.bin/mime
/tmp/budget-backend/node_modules/.bin/mime
1⤵
PID:1511
- /bin/sed
  sed -e "s,\\\\,/,g"
  2⤵
  - Reads runtime system information
  PID:1515
- /usr/bin/dirname
  dirname /tmp/budget-backend/node_modules/.bin/mime
  2⤵
  PID:1512
- /bin/uname
  uname
  2⤵
  PID:1516

/usr/local/sbin/node
node /tmp/budget-backend/node_modules/.bin/../mime/cli.js
1⤵
- Command and Scripting Interpreter: JavaScript
PID:1511

/usr/local/bin/node
node /tmp/budget-backend/node_modules/.bin/../mime/cli.js
1⤵
- Command and Scripting Interpreter: JavaScript
PID:1511

/usr/sbin/node
node /tmp/budget-backend/node_modules/.bin/../mime/cli.js
1⤵
- Command and Scripting Interpreter: JavaScript
PID:1511

/usr/bin/node
node /tmp/budget-backend/node_modules/.bin/../mime/cli.js
1⤵
- Command and Scripting Interpreter: JavaScript
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1511

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads