Benign ruby 2,837,056 installs Download

cybrid_api_organization_ruby 0.129.549

Legitimate Ruby gem with standard dependencies

“View our documentation at https://github.com/Cybrid-app/cybrid-api-organization-ruby/”

VBScript launching PowerShellSystem command execution in method

SHA-2560096093617e05ee4e2295324d1682079f1b35e60a58d087d1b47dcfe9c3bb76e

URLhttps://rubygems.org/gems/cybrid_api_organization_ruby-0.129.549.gem

MaleculeO₆(As₅C₄Xe₃CaCoS)H₈(Cm₉Db₃Ds₂F₁₀HfMg₂Os₃Po₁₁)Md₅(BiBkHe₂Pa₂)

Evidence

Ruby dynamically invokes a method with send lines 49–55

24… ance_variable_defined? :@__better_errors_bindings_stack
      exception.send :remove_instance_variable, :@__better_errors_bindings_stack
    end
52
    @exception =
      begin
        Mar …

Creates a Ruby background thread lines 228–237

49… mediate) do
        count.times do |i|
          threads << Thread.new { yield(i) }
        end
        threads.map(&:value)
⋯5 lines

Process.fork call lines 281–289

18… options[method] || processor_count
      else
        warn "Process.fork is not supported by this Ruby"
        size = 0
      end
⋯4 lines

References /proc/cpuinfo system information path lines 326–335

22… ig::CONFIG["target_os"]
        when /darwin[12]/
          IO.popen("/usr/sbin/sysctl -n hw.physicalcpu").read.to_i
        when /linux/
          cores = {} # unique physical ID / core ID combinations
          phy = 0
          File.read("/proc/cpuinfo").scan(/^physical id.*|^core id.*/) do |ln|
            if ln.start_with?("physical")
              phy = ln[/\d+/]
      …

Ruby mingw or host_os platform string lines 338–346

17… d
          end
          cores.count
        when /mswin|mingw/
          physical_processor_count_windows
        else
          processor_count
        end
      # fall back to l …

Showing the top 5 files — 6 more files (54 regions) not shown.

No evidence locations were recorded for this file. Raw result