hxxp://192[.]168[.]2[.]1

Resubmissions

20/02/2024, 02:57

240220-dfzc5shg9v 4

19/02/2024, 22:12

240219-14hrmaed8t 7

Analysis

max time kernel
2s
max time network
49s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20231222-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20231222-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
19/02/2024, 22:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://192.168.2.1

Score

7^/10

antivm spyware stealer

Malware Config

Signatures

Changes its process name 64 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1672	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1672	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1672	Process not Found
Changes the process name, possibly in an attempt to hide itself	glean.dispatche	1671	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1677	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1677	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1676	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1676	Process not Found
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1678	Process not Found
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1678	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1675	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1675	Process not Found
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1674	Process not Found
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1674	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1673	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1673	Process not Found
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1680	Process not Found
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1680	Process not Found
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1682	Process not Found
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1682	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cache2 I/O	1683	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cookie	1684	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cookie	1684	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1685	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1685	Process not Found
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #1	1687	Process not Found
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #0	1686	Process not Found
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1688	Process not Found
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1688	Process not Found
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	1689	Process not Found
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	1689	Process not Found
Changes the process name, possibly in an attempt to hide itself	IndexedDB #1	1690	Process not Found
Changes the process name, possibly in an attempt to hide itself	IndexedDB #1	1690	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC Launch	1693	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC Launch	1693	Process not Found
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	1692	Process not Found
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	1692	Process not Found
Changes the process name, possibly in an attempt to hide itself	Breakpad Server	1691	Process not Found
Changes the process name, possibly in an attempt to hide itself	Sandbox Forked	1694	Process not Found
Changes the process name, possibly in an attempt to hide itself	DOM Worker	1695	Process not Found
Changes the process name, possibly in an attempt to hide itself	DOM Worker	1695	Process not Found
Changes the process name, possibly in an attempt to hide itself	Chroot Helper	1696	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #5	1700	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #5	1700	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #4	1699	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #4	1699	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #3	1698	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #3	1698	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	1697	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	1697	Process not Found
Changes the process name, possibly in an attempt to hide itself	MainThread	1694	firefox
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1702	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1702	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1702	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Process	1694	firefox
Changes the process name, possibly in an attempt to hide itself	FSBroker1694	1703	Process not Found
Changes the process name, possibly in an attempt to hide itself	FSBroker1694	1703	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1705	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1705	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1704	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1704	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1707	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1707	Process not Found
Changes the process name, possibly in an attempt to hide itself	ProfilerChild	1706	Process not Found

Reads user data of web browsers 64 IoCs

Reads stored browser data which can include saved credentials.

spyware stealer

description	ioc	Process
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/cookies.sqlite-journal	firefox
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/extensions.json	Process not Found
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/pkcs11.txt	firefox
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/content-prefs.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/cert9.db-journal	firefox
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/extension-settings.json	Process not Found
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/SiteSecurityServiceState.txt	Process not Found
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/storage/ls-archive.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/AlternateServices.txt	Process not Found
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/sessionstore-backups/recovery.baklz4	Process not Found
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/sessionstore.js	Process not Found
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/cert_override.txt	firefox
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/search.json.mozlz4	Process not Found
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/cert9.db-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/cookies.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release	Process not Found
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/sessionCheckpoints.json	Process not Found
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/times.json	Process not Found
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/prefs.js	firefox
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/system-extensions	firefox
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/cookies.sqlite	firefox
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/user.js	firefox
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/storage	Process not Found
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/key4.db-journal	firefox
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/content-prefs.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/extensions	firefox
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/permissions.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/sessionstore-backups/recovery.bak	Process not Found
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/cookies.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/storage.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/storage/permanent/chrome/idb	Process not Found
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/sessionstore-backups/previous.jsonlz4	Process not Found
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/addonStartup.json.lz4	firefox
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/extension-preferences.json	Process not Found
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/handlers.json	firefox
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/cert9.db	Process not Found
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/addons.json	Process not Found
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/sessionstore-backups/recovery.jsonlz4	Process not Found
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/cert9.db	firefox
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/sessionstore-backups/recovery.js	Process not Found
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/compatibility.ini	firefox
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/storage.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/storage/permanent/chrome	Process not Found
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/permissions.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/storage/ls-archive.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/sessionstore.jsonlz4	Process not Found
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/ClientAuthRememberList.txt	Process not Found
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/shield-preference-experiments.json	Process not Found
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/xulstore.json	firefox
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/ExperimentStoreData.json	Process not Found
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release	firefox
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/key4.db	firefox
File opened for reading	/root/.mozilla/firefox/u61d4gv6.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite-wal	Process not Found

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc
File opened for reading	/proc/cpuinfo

Reads CPU attributes 1 TTPs 11 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/size	Process not Found
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq	Process not Found
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/size	Process not Found
File opened for reading	/sys/devices/system/cpu/present	Process not Found
File opened for reading	/sys/devices/system/cpu/present	firefox

Enumerates kernel/hardware configuration 1 TTPs 60 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/vendor	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/uevent	Process not Found
File opened for reading	/sys/bus/pci/devices	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/vendor	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/class	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/devices/system/cpu	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/class	Process not Found
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/class	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/vendor	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/irq	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/resource	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/irq	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/device	Process not Found
File opened for reading	/sys/kernel/security/apparmor/features/dbus/mask	dbus-daemon
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/vendor	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_device	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/self/fd	Process not Found
File opened for reading	/proc/1599/cmdline	Process not Found
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/fd/41	firefox
File opened for reading	/proc/1722/cmdline	Process not Found
File opened for reading	/proc/self/cgroup	firefox
File opened for reading	/proc/self/fd/6	firefox
File opened for reading	/proc/self/task/1701/stat	Process not Found
File opened for reading	/proc/1713/cmdline	Process not Found
File opened for reading	/proc/self/fd/31	firefox
File opened for reading	/proc/self/fd/29	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/1789/statm	Process not Found
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/1583/attr/current	Process not Found
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/fd/49	firefox
File opened for reading	/proc/filesystems	gvfsd-fuse
File opened for reading	/proc/self/task/1796/stat	Process not Found
File opened for reading	/proc/filesystems	dbus-daemon
File opened for reading	/proc/self/task/1664/stat	Process not Found
File opened for reading	/proc/self/fd/39	firefox
File opened for reading	/proc/self/fd/47	firefox
File opened for reading	/proc/self/fd/48	firefox
File opened for reading	/proc/1733/cmdline	Process not Found
File opened for reading	/proc/self/fd/43	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/mountinfo	firefox
File opened for reading	/proc/1789/smaps	Process not Found
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/filesystems	xdg-desktop-portal
File opened for reading	/proc/filesystems	xdg-document-portal
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/1767/smaps	Process not Found
File opened for reading	/proc/mounts	dbus-daemon
File opened for reading	/proc/1583/status	Process not Found
File opened for reading	/proc/sys/kernel/cap_last_cap	Process not Found
File opened for reading	/proc/self/mountinfo	Process not Found
File opened for reading	/proc/self/task/1839/stat	Process not Found
File opened for reading	/proc/1737/cmdline	Process not Found
File opened for reading	/proc/1767/statm	Process not Found
File opened for reading	/proc/self/fd/75	firefox
File opened for reading	/proc/self/fd/87	firefox
File opened for reading	/proc/self/task/1821/stat	Process not Found
File opened for reading	/proc/self/stat	Process not Found
File opened for reading	/proc/self/fd/40	firefox
File opened for reading	/proc/filesystems	gvfsd
File opened for reading	/proc/1742/cmdline	Process not Found
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/filesystems	xdg-permission-store
File opened for reading	/proc/self/fd/50	firefox
File opened for reading	/proc/1662/cmdline	Process not Found
File opened for reading	/proc/self/fd/36	firefox
File opened for reading	/proc/self/fd/35	firefox
File opened for reading	/proc/self/task/1773/stat	Process not Found
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	xdg-desktop-portal-gtk
File opened for reading	/proc/self/fd/34	firefox
File opened for reading	/proc/self/fd/46	firefox
File opened for reading	/proc/filesystems	sed

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/firefox/.parentlock	firefox

/usr/bin/xdg-open
xdg-open http://192.168.2.1
1⤵
PID:1577
- /usr/bin/dbus-send
  dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
  2⤵
  PID:1578
- - /usr/bin/dbus-launch
    dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
    3⤵
    PID:1579
- /bin/grep
  grep " = \\\"xfce4\\\"\$"
  2⤵
  PID:1585
- /usr/bin/xprop
  xprop -root _DT_SAVE_MODE
  2⤵
  PID:1584
- /bin/grep
  grep -i "^xfce_desktop_window"
  2⤵
  PID:1587
- /usr/bin/xprop
  xprop -root
  2⤵
  PID:1586
- /bin/grep
  grep -q "^Enlightenment"
  2⤵
  PID:1589
- /bin/uname
  uname
  2⤵
  PID:1590
- /bin/grep
  grep -q "^file://"
  2⤵
  PID:1592
- /bin/egrep
  egrep -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1594
- /usr/local/sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1594
- /usr/local/bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1594
- /usr/sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1594
- /usr/bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1594
- /sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1594
- /bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1594
- /usr/bin/xdg-mime
  xdg-mime query default x-scheme-handler/http
  2⤵
  PID:1598
- - /usr/bin/dbus-send
    dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
    3⤵
    PID:1599
  - - /usr/bin/dbus-launch
      dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
      4⤵
      PID:1600
- - /bin/grep
    grep " = \\\"xfce4\\\"\$"
    3⤵
    PID:1602
- - /usr/bin/xprop
    xprop -root _DT_SAVE_MODE
    3⤵
    PID:1601
- - /bin/grep
    grep -i "^xfce_desktop_window"
    3⤵
    PID:1604
- - /usr/bin/xprop
    xprop -root
    3⤵
    PID:1603
- - /bin/grep
    grep -q "^Enlightenment"
    3⤵
    PID:1606
- - /bin/uname
    uname
    3⤵
    PID:1607
- /usr/bin/which
  which firefox
  2⤵
  PID:1650
- /usr/bin/firefox
  /usr/bin/firefox http://192.168.2.1
  2⤵
  PID:1662
- - /usr/bin/which
    which /usr/bin/firefox
    3⤵
    PID:1663
- /usr/lib/firefox/firefox
  /usr/lib/firefox/firefox http://192.168.2.1
  2⤵
  - Reads user data of web browsers
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1662
- - /usr/bin/dbus-launch
    dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
    3⤵
    PID:1670
- - /usr/local/sbin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1710
- - /usr/local/bin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1710
- - /usr/sbin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1710
- - /usr/bin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1710

/usr/bin/dbus-daemon
/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1581

/bin/sed
sed -n "s/\$^[[:alnum:]+\\.-]*\$:.*\$/\\1/p"
1⤵
PID:1597

/bin/sed
sed "s/:/ /g"
1⤵
- Reads runtime system information
PID:1610

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1615

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1614

/usr/bin/head
head -n 1
1⤵
PID:1613

/bin/grep
grep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
1⤵
PID:1612

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1620

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1619

/usr/bin/head
head -n 1
1⤵
PID:1618

/bin/grep
grep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
1⤵
PID:1617

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1625

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1624

/usr/bin/head
head -n 1
1⤵
PID:1623

/bin/grep
grep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
1⤵
PID:1622

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1630

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1629

/usr/bin/head
head -n 1
1⤵
PID:1628

/bin/grep
grep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
1⤵
PID:1627

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1635

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1634

/usr/bin/head
head -n 1
1⤵
PID:1633

/bin/grep
grep "x-scheme-handler/http=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache
1⤵
PID:1632

/bin/sed
sed "s/:/ /g"
1⤵
- Reads runtime system information
PID:1638

/bin/sed
sed -e "s|-|/|"
1⤵
- Reads runtime system information
PID:1641

/bin/sed
sed -e "s|-|/|"
1⤵
- Reads runtime system information
PID:1644

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1649

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1653

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1656

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1661

/usr/bin/lsb_release
/usr/bin/lsb_release -idrc
1⤵
PID:1681

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -parentBuildID 20230522134052 -prefsLen 19257 -prefMapSize 230809 -appDir /usr/lib/firefox/browser "{a2a66ceb-5995-4115-b78e-20866626297e}" 1662 true socket
1⤵
- Changes its process name
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1694

/usr/libexec/xdg-desktop-portal
/usr/libexec/xdg-desktop-portal
1⤵
- Reads runtime system information
PID:1713

/usr/libexec/xdg-document-portal
/usr/libexec/xdg-document-portal
1⤵
- Reads runtime system information
PID:1718

/usr/libexec/xdg-permission-store
/usr/libexec/xdg-permission-store
1⤵
- Reads runtime system information
PID:1722

/usr/libexec/xdg-desktop-portal-gtk
/usr/libexec/xdg-desktop-portal-gtk
1⤵
- Reads runtime system information
PID:1733

/usr/lib/gvfs/gvfsd
/usr/lib/gvfs/gvfsd
1⤵
- Reads runtime system information
PID:1737

/usr/lib/gvfs/gvfsd-fuse
/usr/lib/gvfs/gvfsd-fuse /root/.gvfs -f -o big_writes
1⤵
- Reads runtime system information
PID:1742

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 21750 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{ec211f5a-17b6-4e2c-8439-eeebd7e14373}" 1662 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1767

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 2 -isForBrowser -prefsLen 21418 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{2b8bed9f-1d61-4a58-80d5-f35960906071}" 1662 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1789

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 3 -isForBrowser -prefsLen 21767 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{04f9b4cb-e9cd-487b-804a-0c3f4c8ded8b}" 1662 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1817

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 4 -isForBrowser -prefsLen 27824 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{b4adcee2-991c-4d90-ba6d-3a37ee989a7a}" 1662 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1835

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/root/.cache/dconf/user

Filesize
2B

MD5
441077cc9e57554dd476bdfb8b8b8102

SHA1
3f29546453678b855931c174a97d6c0894b8f546

SHA256
b413f47d13ee2fe6c845b2ee141af81de858df4ec549a58b7970bb96645bc8d2

SHA512
80536c6170dd8626dc081af148d39ec2fd5d090cc578a76647e7903fd34bd02e4333ece57b0e24ff116f43429b6ff541834bd40ef0c8d3563acef5ed0fd254b8

Download Submit
/root/.dbus/session-bus/11c67417355f45d397f6be11f62e85a6-0

Filesize
466B

MD5
ca251e13aeb33ee6509d61c1ef980897

SHA1
ae3f3f39d07c9ea8d1ef9a0a1ed7ffe1d37c0131

SHA256
4ec3f7e82c8465cb1a2acb012e3a4407d9a919329d277f818b4a49603a8118ca

SHA512
a75c2f2fbe0b8557783f3feba44b27046ccfc1d904f311a78aa7d4af57051eac6cd503f7c11445e42e98ab95d41b684b789e3a9da95df243aac312082d6f191a

Download Submit
/root/.mozilla/firefox/Crash Reports/InstallTime20230522134052

Filesize
10B

MD5
000de8bbfc4a7566deed5f498db8003a

SHA1
6630a7c7db969f88605ce5fd37cc7dbd7b587493

SHA256
f117d4198ae2ca3aa25c37e78e26c963d1461cd5b3f1a708731fbf5f54406cb8

SHA512
b5e7263cc22a19c82c126d2e6358ec188f83ced67491a8cd331650d74709cdd2d45556ac11d12a81f18604451488477ba977bf99c6aad49ebdd16830011ac7ab

Download Submit
/root/.mozilla/firefox/installs.ini

Filesize
62B

MD5
4df459d80bfaeb229386a55c53ca4cac

SHA1
ccc0e3ec310a06b5435cc1758a87ef5081050a2c

SHA256
823dfad0710969e0801d58b63f46ebdd923bd654a0cc99505a2c56f2b99eacde

SHA512
35ca333a4e3c92828b387fa80c45434530d97ca6965bcb80a9b0d4e670d3cbfeec7c4e12fdab29276681b1391bd5905d476e262a4d16aff05d4a4d42917853b2

Download Submit
/root/.mozilla/firefox/profiles.ini

Filesize
259B

MD5
d7b76e9de1cfc51bfebfd657270a9f49

SHA1
61a6ac9f2e403c33a612365c7dd28f88b6dc2f5f

SHA256
79cf216ff2350ffbaea9060612861dd689fa722be8b50a276836a865ab78b520

SHA512
239731fe6a21f9a59275e66434c176eaad1b8f2b51d61e595471e4fb18aef40498a74510b7b190c56af39efbe07be2a09437f0d5e92e1551f846f9809995c0ed

Download Submit
/root/.mozilla/firefox/u61d4gv6.default-release/cert9.db

Filesize
224KB

MD5
3cb9773be6d81859a41fdcb18f628d99

SHA1
76a986c20052b6a9bb8ca49380aa2315192efd95

SHA256
09dc5906db9aa2245db97925bd4f645301523f311b7366fcfd3386bb15bc4507

SHA512
5d9b104300d55638eb4dbee85768cc7aef442ceec3b833caf23bdbbb5738837c9151f54bbbffca2c24df750ded6bd62a7b05c63e6adc05bcf9e0472d6e473d07

Download Submit
/root/.mozilla/firefox/u61d4gv6.default-release/compatibility.ini

Filesize
163B

MD5
fe452b7294d5928a9a5863b89ee0a6bd

SHA1
a5d4c245071fa96476ba48b4725bdae7f1b7940f

SHA256
d5bfb07561606a19aa96557ea109b175050dc0eb805cbef9c813503587d77900

SHA512
dc37d8507f08849e3382d2dbafd4a64555dbd57a288c95131e9aefb366630f1585811a9e1456b861bb9d2b816ed88b18ffb7580cd92b41bb9b0227ce1363843e

Download Submit
/root/.mozilla/firefox/u61d4gv6.default-release/cookies.sqlite

Filesize
96KB

MD5
9535f5fe817accc769c2c1d3354db39f

SHA1
6af62cf08717cf3bfa84eb1a7b311acf522ce560

SHA256
c53c15fcfac2bb57fdc88d23f932fc244dbaf4020f0f6eaecf0f77a37c21f8c5

SHA512
dc9c2c32eb42dda0a7a711e143aea58c603c1e9d885c3677e9fe86f525e1b0b32a46e240756263e56510b07e764ba69f2de13b90ec18210678242e10cfe17837

Download Submit
/root/.mozilla/firefox/u61d4gv6.default-release/cookies.sqlite

Filesize
96KB

MD5
5caa766855d5613a999f71b7812d6451

SHA1
ad0d9a52a0d5cc7f11858301dbe47377ed99ee37

SHA256
3a8ce2b07e3e8678a13aa58ef5b942c4dccd8f9c84511bdeb8847ef270797e27

SHA512
17bb0f4c87ec178910795b25ce85e74cf599190c769592472c3e872f42930c93f28faf0ff3e448816a9abcc8af0459852bed52bee08cfe25d068879c6dfd8eba

Download Submit
/root/.mozilla/firefox/u61d4gv6.default-release/key4.db

Filesize
288KB

MD5
edba182a9f8284027472255d3a68484c

SHA1
887a90095976f77f44e3079eac280530033b7e52

SHA256
4c29d041acccd0357a04cccf8d69b218e2f8e53d887737c1c3c44a5f473d1f17

SHA512
a15288d32ff1c91f9698a38e2d10eb068614a695f0b9b7b3d6c3d39d580e0dceadbf40ba5d85ae46cbf286e65ccb988a8a51256e8991a4b333cc323a6053d8ce

Download Submit
/root/.mozilla/firefox/u61d4gv6.default-release/permissions.sqlite

Filesize
96KB

MD5
232fbc22dd03a8ec41edde02bdbea61c

SHA1
6ab4b39bca95418c52f7f861fd39e5fddb9cc7b6

SHA256
d88bf367aaf79efbb2e8fbdb1dc5bde1c1c3a53e0f4d8188027a63ec55d5f5f0

SHA512
055f1595f4a327347671db53cec8d89a310109d3f871c567e3d5b654b956fc0369d12437f7dc6d9327b973008f1327ee0dfdb5504f1b3cbe00da29941b1e5892

Download Submit
/root/.mozilla/firefox/u61d4gv6.default-release/prefs-1.js

Filesize
2KB

MD5
e96f4f48dba0f4c0efe488f8341ef558

SHA1
f8f5ef00893559561c9bb88131b5287ec00db11a

SHA256
3e2133e9dc385b0c3b6abe47ecdd1c495e5982bcc0691a78132a11ebfa31ec3d

SHA512
056f4f98645dd87b2223b51a2ad9d794435c3c70497bf04ce60d178cd5df62be33b10d369ab80ca38497d876315a553ee01be9a721f40b2778d460ea65b38a43

Download Submit
/root/.mozilla/firefox/u61d4gv6.default-release/prefs-1.js

Filesize
2KB

MD5
7ce36d8c0cc8e27167c2605ed8c9ed69

SHA1
8de75be101660c8adcea142f65598ffc6bd2ff46

SHA256
2ca8c9a59d558ea8d83aee69dcd05fd0919666e7d6a6db8ae8803c20a128ef32

SHA512
0fc54b484dfa4b90e9b8b9a472d42846872e5fda49d0fd69bdf6ca8b82b640b4ffd6caa754317ae435fa4825d187becc4ebf04e58f1159b892e33e615f948a56

Download Submit
/root/.mozilla/firefox/u61d4gv6.default-release/prefs-1.js

Filesize
3KB

MD5
8dd0b6808c1c6d0a1e6c95e237e819f5

SHA1
bc5c38ac9870c5bc7de4b96b698e765c700bc0da

SHA256
9bab3a9642a68367e6dbd03c65f46fbf18905b394b0167b98f2970a2c3daf833

SHA512
a5861d338fc8174ab75dc7b0253867497848b36fed7327c4faa1c4e7d6ffbc24be8de2131d6d16eae081c90cfb7764483bd0b719a0ab7b9a46482bdd6fb9d8e4

Download Submit
/root/.mozilla/firefox/u61d4gv6.default-release/prefs-1.js

Filesize
3KB

MD5
a3cab50a634bbc89e13a06e40a853921

SHA1
00a725fc87e43c14a5677f0724912a092ca4c7cd

SHA256
0c49c6fb75601f4350d6a6eb572e672225f1c3e2d2d9563cb35cb55a49a407ff

SHA512
60788aa2756caf78bdf718ea03cddb7f48a5d76fd8dd78635d01b7a6eee9f5db2c146f16b18b430fe8e162db542645bd8ace1df27e024a8003a57488057fc4a5

Download Submit
/root/.mozilla/firefox/u61d4gv6.default-release/prefs-1.js

Filesize
4KB

MD5
b0d67e369285704b4a8c4379e41031b6

SHA1
d4afa5864cf24bb5c45645877c99e7942c9a52c6

SHA256
bae07031700525567a17145b7b739a02966b013bbe27712288a347193ab38825

SHA512
44c84d795f1d3b5e032492fa947c193c758112e1775abc75f7c41d7416caf1a54fff273d6f715417ce52b8a6c53ad179dccf367241006d74ccc2f05303e25ad0

Download Submit
/root/.mozilla/firefox/u61d4gv6.default-release/prefs.js

Filesize
1KB

MD5
0a1333e49b4741a6326d241088dda2b3

SHA1
6c32f061ecc8271bad35159369bb722af34a19d2

SHA256
6ab884ab17c8f6c8e291482317f4d9be8823e10497dac357bd6c9ce61fe4b054

SHA512
548ecacbd1a174bdf289ab3caeb484be1180217ed38f7bc5c63bdc36600a5fa06ca91972eeed8824824f55256585d715b4ff17e5a16387aea14c278638921a38

Download Submit
/root/.mozilla/firefox/u61d4gv6.default-release/storage/ls-archive.sqlite

Filesize
96KB

MD5
e0c613bfd69956a19ce2dc5e925aa223

SHA1
14accb230edcd6cb76967cdc6d4e5686db96b5df

SHA256
0d4cb11f6364c46a75f9eaddfca5c660b90dfd515df3afcd5e0baeca28a0f1ab

SHA512
01643c0131a392be92b3f281d7f633c1f502bff19090b0d716f1ac66aefecc3fcf92f393bef66b03089c9b9c6d8aaeb711b6a4f29d5a6729dd188c838f2272d1

Download Submit
/root/.mozilla/firefox/u61d4gv6.default-release/storage/ls-archive.sqlite

Filesize
128KB

MD5
178d71e5529d637ac62f7e75fdd75896

SHA1
339f2b949cc4c207b66aea11137448ba28d36dcb

SHA256
7b0050f1bfaab85c8f9067ae7d7369056ff752c0c852ef1462a96c22169004d4

SHA512
ec0e0105fcfbbae356dd55efbcf92975f35bbe5cb93fcabf4c08443e871957635d14830b27c4e1ddefbbaff8f9b7ec3590bf417a9442e1d7ee3607d14d56f664

Download Submit
/root/.mozilla/firefox/u61d4gv6.default-release/storage/permanent/chrome/.metadata-v2-tmp

Filesize
42B

MD5
c862f53582337ba47ba28d25e85c5c2a

SHA1
46e01f5d964c96a43396263821a75549dd8a04e1

SHA256
8b6492ef0142dbce08b2c137bb14f901d4a7d34b6cee73cda1cac526ad158ed7

SHA512
2aafea38e435d1041ce03112ed5cba986b6e34880fc06cd01b097d3138d003a765c25cc602ec16a0556d5eca7be2a23e6eefcb90ff3b71b85327c2d687108e09

Download Submit
/root/.mozilla/firefox/u61d4gv6.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite

Filesize
44KB

MD5
a8dd7ebaad5528b23f82ccb1534cea18

SHA1
600daceacfb5cf9df0b66ba7dce4516b2ac4df70

SHA256
e5b0d02c18ae36c4a220f41fd97c66060c17aaafcbb324a57ccdc2707c44c4ec

SHA512
67f867a8e2b37fb6bececd5ebc570ca594ea329142badd63d1281d5e735f515a5e329abc6eb9a9d3465aab0a08541b4888018d859964f160a52345ab93532bff

Download Submit
/root/.mozilla/firefox/u61d4gv6.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite

Filesize
12KB

MD5
97e499f10fbf39c984fd2767e1cdc5a7

SHA1
8d9482d3cdd694ff8473edbe44db43d8b179b2df

SHA256
eea44c9f10d8af4e021add79cd203a77425b6a09cb031e629ec103d4cbdf1e21

SHA512
94a08095f0b0bb16f478aacf3b5d3ba3ef72b9e6ed7801e1850260c4978f3544978a49ba96beb7cc1a80fe350d677bb5e095d27918a40c0a7deae46d0834e3bb

Download Submit
/root/.mozilla/firefox/u61d4gv6.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite

Filesize
44KB

MD5
7352c8848e88edc39b7fb5e663888187

SHA1
8c3dffe25cc56c7aec1b782292d6fceed81e6304

SHA256
7a462086a26978809c719e57a7ea6a25568767fb7532014e8531fda94b660e0a

SHA512
f2a0dbbab5c2c1702b03bce15a47739481f523e127d1372b40534db9a20b2bc99fb53710ee0e5d44176188817cac704cf4f98cdf087e7e89d244281fcfc3b280

Download Submit
/root/.mozilla/firefox/u61d4gv6.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite

Filesize
12KB

MD5
1846538a2ad0bfbb9966b105406b2772

SHA1
0fab8038f4753d910bd60d08e541c78696027dfd

SHA256
f5f218fd209e636499335957fca6d587d312d1d7f2fba5de57f1ca85ce33ad20

SHA512
3724b617119edce377ed1e01202921dc5bf304f9d84e30aca9fa1c762643350d85a925e83babaa023dd8334fed406ecb27f65ea4da328826f5ad5f37247c3b8f

Download Submit
/root/.mozilla/firefox/u61d4gv6.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite

Filesize
44KB

MD5
759544297aaa61f5fef8ee42d0ae4393

SHA1
fc2d66f6e60409e3e8d38623ce5f817fc7f571e0

SHA256
1bd2000cd972e80cefaec6e982ba261d224a818f367de0fdf8c51fa5a05d7ab5

SHA512
8aaa2ce66f10d46f7c9200af841ac7bd9f5b55c30308a14f0deda44ac62581c45daae45154487c0073a0d5847d5926cbb4072ca64a702ac6b834ad0bb482804f

Download Submit
/root/.mozilla/firefox/u61d4gv6.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite

Filesize
12KB

MD5
a10fa0259987d6e7bc80460d0463fa99

SHA1
11c062ebe782768be65f5d707e5226e30ce7962f

SHA256
363e2adca7235fbb7ffaa8cf1f851d502e232842ab4d3076ca1c7ce1c680e5c0

SHA512
a20092334765f3148084960943d4831a6ac1b448bccc45f8b813fc10c7d7b05f65a6e576e97170b3acef01665a1d53ba207730455b3b95b732f4e6f76704912e

Download Submit
/root/.mozilla/firefox/u61d4gv6.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
44KB

MD5
07a412e08825220262ad2890757ff779

SHA1
f46c127dbc070ded87a6078b3c1c761955f96de8

SHA256
da640f8b665841b520d2262a21cc3f82aeaa881cf81a1ddae27ef501d66544e4

SHA512
0134c783bf3293848e479b478ac57a1e0f4202cddfb8b57bc6275aada7345f398cf8a627e9b1c34fd618192c2f0c9737b1da487daf33f9c557ebc1377105582b

Download Submit
/root/.mozilla/firefox/u61d4gv6.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
12KB

MD5
1a06505fa7b1dfd1765507526223ff81

SHA1
d0df949e56ddb4163d77b695be5d9fae69422562

SHA256
cbdbcb0f9ff0dd80f18507c394489ef8f77a785d7d9dcbc5f61d082fcda81a62

SHA512
66e2b114d5d70e7fbe3ac7274448775932fc636ec623f3947d46ff1e334323f23f6ce46eaf14f1e491c3238620116c60841a08b5ade90b2aaf88b86f0b734925

Download Submit
/root/.mozilla/firefox/u61d4gv6.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
164KB

MD5
6a171688d7cbcda9f88f3a332d03bf57

SHA1
c514aca9b82073d1e9f7d31b339132b7aafc077c

SHA256
1777e22ceda16cfffa5cd846ebd1ca4975d2f45a2681452d69d936da213534f3

SHA512
721409ea497876774ce8231ca7f2d3de134885bef394a6a19ddbae4bd1b30fbb4b31da0e8152e87167aa1472f49095480ea8161135a79f8e36bdb127700ff30b

Download Submit
/root/.mozilla/firefox/u61d4gv6.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
148KB

MD5
dd3f6ba37c670af5953593535e435d04

SHA1
ecfe4e650a050bce77e8ff7468de04c1b8acc9a4

SHA256
5cc6fa137a1f3a7d0b615b178877f12c460b22f95702eb7534d5732ee6599561

SHA512
86e0482543faae6fb279ca71e1e6d6461d32317e74baebb3973e0fde9800107faeb9c2347be6cf8a47556ae43c8e6c224a595e952f621e40ad2c5eba920df2b3

Download Submit
/root/.mozilla/firefox/u61d4gv6.default-release/times.json

Filesize
50B

MD5
8ce3e3a5d466383849fdf5fea2698cc4

SHA1
4df3d686eb4b605a03e390e550e85b856adb4433

SHA256
14fb9c6b232c513dcca49ea9e91bd0ed6f2f140749a30d44bbb89b9e94bce3c5

SHA512
9df05e87c735f60d21e2221e8b54fffdf3df207ac72c5b5332eb9e80ea50238a761e8a624f1214618ce09c064d3c80aca69c1c2fa2bff927c051af656dfea309

Download Submit
/root/.mozilla/firefox/u61d4gv6.default-release/times.json

Filesize
47B

MD5
38fbf3adad290f0f350b93296eba431f

SHA1
8ab253b6804ce9547a2b1edd47c670cb664e6e84

SHA256
8e6d97a899a85cd7682124702617e642846151c6b44acbfe016c0fab97488fa8

SHA512
69490cecf20d4a4e40ab88edd712143839f6e675e4c9bbd254ff0fa7f128a7a93c702a097fc2775ed65a06d39ceaf554fb6f2360eb4df6565888cbe8888e36ce

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads