hxxps://bit[.]ly/CloneJake

Resubmissions

19-02-2024 16:24

240219-twkgxsfh8v 7

Analysis

max time kernel
2s
max time network
22s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20231221-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20231221-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
19-02-2024 16:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://bit.ly/CloneJake

Score

7^/10

antivm spyware stealer

Malware Config

Signatures

Changes its process name 64 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1640	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1640	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1640	Process not Found
Changes the process name, possibly in an attempt to hide itself	glean.dispatche	1639	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1645	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1645	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1644	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1644	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1643	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1643	Process not Found
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1646	Process not Found
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1646	Process not Found
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1642	Process not Found
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1642	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1641	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1641	Process not Found
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1648	Process not Found
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1648	Process not Found
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1650	Process not Found
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1650	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cache2 I/O	1651	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cookie	1652	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cookie	1652	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1653	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1653	Process not Found
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #1	1655	Process not Found
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #0	1654	Process not Found
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1656	Process not Found
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1656	Process not Found
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	1665	Process not Found
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	1665	Process not Found
Changes the process name, possibly in an attempt to hide itself	IndexedDB #1	1668	Process not Found
Changes the process name, possibly in an attempt to hide itself	IndexedDB #1	1668	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC Launch	1671	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC Launch	1671	Process not Found
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	1670	Process not Found
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	1670	Process not Found
Changes the process name, possibly in an attempt to hide itself	Breakpad Server	1669	Process not Found
Changes the process name, possibly in an attempt to hide itself	DOM Worker	1673	Process not Found
Changes the process name, possibly in an attempt to hide itself	DOM Worker	1673	Process not Found
Changes the process name, possibly in an attempt to hide itself	Sandbox Forked	1672	Process not Found
Changes the process name, possibly in an attempt to hide itself	Chroot Helper	1674	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #5	1678	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #5	1678	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #4	1677	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #4	1677	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #3	1676	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #3	1676	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	1675	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	1675	Process not Found
Changes the process name, possibly in an attempt to hide itself	MainThread	1672	firefox
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1680	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1680	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1680	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Process	1672	firefox
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1681	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1681	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1682	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1682	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1683	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1683	Process not Found
Changes the process name, possibly in an attempt to hide itself	Worker Launcher	1684	Process not Found
Changes the process name, possibly in an attempt to hide itself	Worker Launcher	1684	Process not Found
Changes the process name, possibly in an attempt to hide itself	gmain	1685	Process not Found

Reads user data of web browsers 55 IoCs

Reads stored browser data which can include saved credentials.

spyware stealer

description	ioc	Process
File opened for reading	/root/.mozilla/firefox/qos6sfvn.default-release/sessionstore-backups/recovery.baklz4	Process not Found
File opened for reading	/root/.mozilla/firefox/qos6sfvn.default-release/extensions.json	Process not Found
File opened for reading	/root/.mozilla/firefox/qos6sfvn.default-release/pkcs11.txt	firefox
File opened for reading	/root/.mozilla/firefox/qos6sfvn.default-release/sessionstore.js	Process not Found
File opened for reading	/root/.mozilla/firefox/qos6sfvn.default-release/cert9.db	Process not Found
File opened for reading	/root/.mozilla/firefox/qos6sfvn.default-release/user.js	firefox
File opened for reading	/root/.mozilla/firefox/qos6sfvn.default-release/sessionstore-backups/recovery.jsonlz4	Process not Found
File opened for reading	/root/.mozilla/firefox/qos6sfvn.default-release/sessionstore-backups/previous.jsonlz4	Process not Found
File opened for reading	/root/.mozilla/firefox/qos6sfvn.default-release/sessionCheckpoints.json	Process not Found
File opened for reading	/root/.mozilla/firefox/qos6sfvn.default-release/permissions.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/qos6sfvn.default-release/storage/permanent/chrome/idb	Process not Found
File opened for reading	/root/.mozilla/firefox/qos6sfvn.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/qos6sfvn.default-release/cert9.db	firefox
File opened for reading	/root/.mozilla/firefox/qos6sfvn.default-release/extensions	firefox
File opened for reading	/root/.mozilla/firefox/qos6sfvn.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/qos6sfvn.default-release/storage.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/qos6sfvn.default-release/shield-preference-experiments.json	Process not Found
File opened for reading	/root/.mozilla/firefox/qos6sfvn.default-release/cookies.sqlite-journal	firefox
File opened for reading	/root/.mozilla/firefox/qos6sfvn.default-release/storage.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/qos6sfvn.default-release/sessionstore-backups/recovery.bak	Process not Found
File opened for reading	/root/.mozilla/firefox/qos6sfvn.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/qos6sfvn.default-release/AlternateServices.txt	Process not Found
File opened for reading	/root/.mozilla/firefox/qos6sfvn.default-release/storage/permanent/chrome	Process not Found
File opened for reading	/root/.mozilla/firefox/qos6sfvn.default-release/times.json	Process not Found
File opened for reading	/root/.mozilla/firefox/qos6sfvn.default-release/sessionstore.jsonlz4	Process not Found
File opened for reading	/root/.mozilla/firefox/qos6sfvn.default-release	firefox
File opened for reading	/root/.mozilla/firefox/qos6sfvn.default-release/cert_override.txt	firefox
File opened for reading	/root/.mozilla/firefox/qos6sfvn.default-release/SiteSecurityServiceState.txt	Process not Found
File opened for reading	/root/.mozilla/firefox/qos6sfvn.default-release	Process not Found
File opened for reading	/root/.mozilla/firefox/qos6sfvn.default-release/cookies.sqlite	firefox
File opened for reading	/root/.mozilla/firefox/qos6sfvn.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/qos6sfvn.default-release/cert9.db-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/qos6sfvn.default-release/key4.db	Process not Found
File opened for reading	/root/.mozilla/firefox/qos6sfvn.default-release/storage/ls-archive.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/qos6sfvn.default-release/system-extensions	firefox
File opened for reading	/root/.mozilla/firefox/qos6sfvn.default-release/extension-preferences.json	Process not Found
File opened for reading	/root/.mozilla/firefox/qos6sfvn.default-release/storage	Process not Found
File opened for reading	/root/.mozilla/firefox/qos6sfvn.default-release/cert9.db-journal	firefox
File opened for reading	/root/.mozilla/firefox/qos6sfvn.default-release/key4.db-journal	firefox
File opened for reading	/root/.mozilla/firefox/qos6sfvn.default-release/cookies.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/qos6sfvn.default-release/addonStartup.json.lz4	firefox
File opened for reading	/root/.mozilla/firefox/qos6sfvn.default-release/storage/ls-archive.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/qos6sfvn.default-release/addons.json	Process not Found
File opened for reading	/root/.mozilla/firefox/qos6sfvn.default-release/sessionstore-backups/recovery.js	Process not Found
File opened for reading	/root/.mozilla/firefox/qos6sfvn.default-release/prefs.js	firefox
File opened for reading	/root/.mozilla/firefox/qos6sfvn.default-release/cookies.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/qos6sfvn.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/qos6sfvn.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/qos6sfvn.default-release/ClientAuthRememberList.txt	Process not Found
File opened for reading	/root/.mozilla/firefox/qos6sfvn.default-release/xulstore.json	firefox
File opened for reading	/root/.mozilla/firefox/qos6sfvn.default-release/permissions.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/qos6sfvn.default-release/key4.db	firefox
File opened for reading	/root/.mozilla/firefox/qos6sfvn.default-release/sessionstore-backups/previous.js	Process not Found
File opened for reading	/root/.mozilla/firefox/qos6sfvn.default-release/compatibility.ini	firefox
File opened for reading	/root/.mozilla/firefox/qos6sfvn.default-release/handlers.json	firefox

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc
File opened for reading	/proc/cpuinfo

Reads CPU attributes 1 TTPs 9 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/size	Process not Found
File opened for reading	/sys/devices/system/cpu/present	Process not Found
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq	Process not Found
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/size	Process not Found

Enumerates kernel/hardware configuration 1 TTPs 58 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/resource	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/class	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/device	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/resource	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/uevent	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/vendor	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/class	Process not Found
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/device	Process not Found
File opened for reading	/sys/kernel/security/apparmor/features/dbus/mask	dbus-daemon
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/device	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_device	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/vendor	Process not Found
File opened for reading	/sys/devices/system/cpu	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/resource	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	xdg-desktop-portal
File opened for reading	/proc/filesystems	gvfsd
File opened for reading	/proc/self/fd/50	firefox
File opened for reading	/proc/self/fd/39	firefox
File opened for reading	/proc/filesystems	xdg-document-portal
File opened for reading	/proc/self/task/1751/stat	Process not Found
File opened for reading	/proc/self/fd	Process not Found
File opened for reading	/proc/mounts	dbus-daemon
File opened for reading	/proc/sys/kernel/cap_last_cap	Process not Found
File opened for reading	/proc/self/task/1635/stat	Process not Found
File opened for reading	/proc/self/mountinfo	Process not Found
File opened for reading	/proc/self/fd/49	firefox
File opened for reading	/proc/self/fd/72	firefox
File opened for reading	/proc/1713/cmdline	Process not Found
File opened for reading	/proc/self/cgroup	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/1633/cmdline	Process not Found
File opened for reading	/proc/self/fd/31	firefox
File opened for reading	/proc/self/fd/37	firefox
File opened for reading	/proc/self/fd/51	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/fd/47	firefox
File opened for reading	/proc/self/mountinfo	firefox
File opened for reading	/proc/self/fd/38	firefox
File opened for reading	/proc/self/fd/41	firefox
File opened for reading	/proc/self/fd/44	firefox
File opened for reading	/proc/1745/smaps	Process not Found
File opened for reading	/proc/1551/status	Process not Found
File opened for reading	/proc/self/fd/45	firefox
File opened for reading	/proc/1698/cmdline	Process not Found
File opened for reading	/proc/self/fd/46	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/task/1774/stat	Process not Found
File opened for reading	/proc/1551/attr/current	Process not Found
File opened for reading	/proc/1567/cmdline	Process not Found
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd/29	firefox
File opened for reading	/proc/self/fd/43	firefox
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	dbus-daemon
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd/48	firefox
File opened for reading	/proc/1718/cmdline	Process not Found
File opened for reading	/proc/filesystems	xdg-desktop-portal-gtk
File opened for reading	/proc/1709/cmdline	Process not Found
File opened for reading	/proc/filesystems	gvfsd-fuse
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/fd/42	firefox
File opened for reading	/proc/filesystems	xdg-permission-store
File opened for reading	/proc/1546/cmdline	Process not Found
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/task/1679/stat	Process not Found
File opened for reading	/proc/1745/statm	Process not Found
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/1689/cmdline	Process not Found
File opened for reading	/proc/self/fd/6	firefox
File opened for reading	/proc/self/fd/75	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/stat	Process not Found
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/fd/36	firefox
File opened for reading	/proc/1694/cmdline	Process not Found

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/firefox/.parentlock	firefox

/usr/bin/xdg-open
xdg-open https://bit.ly/CloneJake
1⤵
PID:1545
- /usr/bin/dbus-send
  dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
  2⤵
  PID:1546
- - /usr/bin/dbus-launch
    dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
    3⤵
    PID:1547
- /bin/grep
  grep " = \\\"xfce4\\\"\$"
  2⤵
  PID:1553
- /usr/bin/xprop
  xprop -root _DT_SAVE_MODE
  2⤵
  PID:1552
- /bin/grep
  grep -i "^xfce_desktop_window"
  2⤵
  PID:1555
- /usr/bin/xprop
  xprop -root
  2⤵
  PID:1554
- /bin/grep
  grep -q "^Enlightenment"
  2⤵
  PID:1557
- /bin/uname
  uname
  2⤵
  PID:1558
- /bin/grep
  grep -q "^file://"
  2⤵
  PID:1560
- /bin/egrep
  egrep -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1562
- /usr/local/sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1562
- /usr/local/bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1562
- /usr/sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1562
- /usr/bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1562
- /sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1562
- /bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1562
- /usr/bin/xdg-mime
  xdg-mime query default x-scheme-handler/https
  2⤵
  PID:1566
- - /usr/bin/dbus-send
    dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
    3⤵
    PID:1567
  - - /usr/bin/dbus-launch
      dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
      4⤵
      PID:1568
- - /bin/grep
    grep " = \\\"xfce4\\\"\$"
    3⤵
    PID:1570
- - /usr/bin/xprop
    xprop -root _DT_SAVE_MODE
    3⤵
    PID:1569
- - /bin/grep
    grep -i "^xfce_desktop_window"
    3⤵
    PID:1572
- - /usr/bin/xprop
    xprop -root
    3⤵
    PID:1571
- - /bin/grep
    grep -q "^Enlightenment"
    3⤵
    PID:1574
- - /bin/uname
    uname
    3⤵
    PID:1575
- /usr/bin/which
  which firefox
  2⤵
  PID:1618
- /usr/bin/firefox
  /usr/bin/firefox https://bit.ly/CloneJake
  2⤵
  PID:1633
- - /usr/bin/which
    which /usr/bin/firefox
    3⤵
    PID:1634
- /usr/lib/firefox/firefox
  /usr/lib/firefox/firefox https://bit.ly/CloneJake
  2⤵
  - Reads user data of web browsers
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1633
- - /usr/bin/dbus-launch
    dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
    3⤵
    PID:1638
- - /usr/local/sbin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1686
- - /usr/local/bin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1686
- - /usr/sbin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1686
- - /usr/bin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1686

/usr/bin/dbus-daemon
/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1549

/bin/sed
sed -n "s/\$^[[:alnum:]+\\.-]*\$:.*\$/\\1/p"
1⤵
- Reads runtime system information
PID:1565

/bin/sed
sed "s/:/ /g"
1⤵
- Reads runtime system information
PID:1578

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1583

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1582

/usr/bin/head
head -n 1
1⤵
PID:1581

/bin/grep
grep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
1⤵
PID:1580

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1588

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1587

/usr/bin/head
head -n 1
1⤵
PID:1586

/bin/grep
grep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
1⤵
PID:1585

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1593

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1592

/usr/bin/head
head -n 1
1⤵
PID:1591

/bin/grep
grep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
1⤵
PID:1590

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1598

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1597

/usr/bin/head
head -n 1
1⤵
PID:1596

/bin/grep
grep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
1⤵
PID:1595

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1603

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1602

/usr/bin/head
head -n 1
1⤵
PID:1601

/bin/grep
grep "x-scheme-handler/https=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache
1⤵
PID:1600

/bin/sed
sed "s/:/ /g"
1⤵
- Reads runtime system information
PID:1606

/bin/sed
sed -e "s|-|/|"
1⤵
- Reads runtime system information
PID:1609

/bin/sed
sed -e "s|-|/|"
1⤵
- Reads runtime system information
PID:1612

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1617

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1621

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1624

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1632

/usr/bin/lsb_release
/usr/bin/lsb_release -idrc
1⤵
PID:1649

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -parentBuildID 20230522134052 -prefsLen 19257 -prefMapSize 230809 -appDir /usr/lib/firefox/browser "{391b80c9-9a2a-49f5-84a4-6dc8a533a45d}" 1633 true socket
1⤵
- Changes its process name
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1672

/usr/libexec/xdg-desktop-portal
/usr/libexec/xdg-desktop-portal
1⤵
- Reads runtime system information
PID:1689

/usr/libexec/xdg-document-portal
/usr/libexec/xdg-document-portal
1⤵
- Reads runtime system information
PID:1694

/usr/libexec/xdg-permission-store
/usr/libexec/xdg-permission-store
1⤵
- Reads runtime system information
PID:1698

/usr/libexec/xdg-desktop-portal-gtk
/usr/libexec/xdg-desktop-portal-gtk
1⤵
- Reads runtime system information
PID:1709

/usr/lib/gvfs/gvfsd
/usr/lib/gvfs/gvfsd
1⤵
- Reads runtime system information
PID:1713

/usr/lib/gvfs/gvfsd-fuse
/usr/lib/gvfs/gvfsd-fuse /root/.gvfs -f -o big_writes
1⤵
- Reads runtime system information
PID:1718

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 21750 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{137f4e71-c670-48eb-b2e7-6b31adedf323}" 1633 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1745

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 2 -isForBrowser -prefsLen 21418 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{cf037e37-0bea-476a-a981-8d0b03f61739}" 1633 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1767

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/root/.cache/mozilla/firefox/qos6sfvn.default-release/cache2/entries/3D1E19D09F398691ABF62061591970855193B42F

Filesize
13KB

MD5
ecf974c47669d11e6d352a3e993adc7b

SHA1
5c78798058e67aeb9330c56a77c126f4c58527aa

SHA256
ca0c6ef750d92769419d5b72a1b6ed2042ab1d46d8afe31530c4a57fd719d623

SHA512
24f11134d15a4d0fb6079f0917faa27eb1ad6bc9eaca49c331de3d65737dc18e3d41a35ef5d9b43f5f1da43f6e160a95211a403548829164404f204013f35a2b

Download Submit
/root/.dbus/session-bus/11c67417355f45d397f6be11f62e85a6-0

Filesize
466B

MD5
d102d6d9e9c6f23fe9598ac96b139541

SHA1
d80f7d94de040fc93b7b02cc8da00718a37a2a97

SHA256
8be30c0c7fe6e7433ca30cde90a7b6f7efffe3bb9fda86a202a81ceacee49d02

SHA512
cdbd8ff2b787aa95abd9f3aeb6afcda5d04efcd441e7cacfc15aee4c8ac4f0c5de387caa24bd28eadce34d43b376bfa116b07666004eb1c4495144f1eb166522

Download Submit
/root/.mozilla/firefox/3d3d377h.default/times.json

Filesize
47B

MD5
a26eed15d011039396eabf33ad3b527f

SHA1
2f316daf1c413812fd9f20a7576eedbd84beeae3

SHA256
cead89911492b0fea6bcfb51d6515e49f51f55570f888df320f8040f08b1d7ff

SHA512
31bc9568a5fa2b7dc591eb4e3a54bcc1ed635512f7759b1d2ae1db5f477c694fbe0e159cf2b95e4fb13cac1a58377bdf0072042740c45e4130ab3dfcf74f4ef5

Download Submit
/root/.mozilla/firefox/Crash Reports/InstallTime20230522134052

Filesize
10B

MD5
737952ed25ac33a4dea3f693a1650f15

SHA1
2370f280f0c9c5240e01c933cada9b538aefda54

SHA256
e32da6d41f896d318b9ff84a23d079b2cda5cb412c74aaf904274b1c13b69234

SHA512
1a63e6b796ab9f22b9fc6f02a04a860274445081b916b13a598a5a7406a7232869a66f00ec2933f9507728788e1a5ca27703341d08483b45cdb50e21d8b8b3d7

Download Submit
/root/.mozilla/firefox/installs.ini

Filesize
62B

MD5
968ae94680d958af1188ad7efa5bc369

SHA1
adb88b49d845a8e1234fbc5c1a10b0c7d7ac49a6

SHA256
603485646c7f7a61880471151cf0acdde72af39480db630a25751ecab4c090bf

SHA512
aaaca14cfe8a4dce0257240bb173873816e7087dbf8f5db5ded881c93d60ba50d6ccc4db9c5c61c95c46afe14f1f2b9468afa2da131293f3099ed3851b304466

Download Submit
/root/.mozilla/firefox/profiles.ini

Filesize
259B

MD5
e3734f988f51b046504050c724a457d4

SHA1
f7ccd51b51d28301a5ee6a0bfc234e25f1f8e59b

SHA256
647f4b07c6c5cbf3d47d5b9713e36bf136e117e6e22821107097839a5c4e38c2

SHA512
c47ca9a293c9a8fc599e444f908d2a9097c12178b2ea3b1a1a419b6a99c4940432cb9ea12b8a076611011c0f4192069a37d3b3ce6351532088690a8fd13c8d12

Download Submit
/root/.mozilla/firefox/qos6sfvn.default-release/cert9.db

Filesize
224KB

MD5
59c011a0cb63ddeeb23e6f1dd9d82a44

SHA1
ff7600310edcc8446f2feac65aed0712bd4472a6

SHA256
c819f9f01cd90702328c129500fe276db875ce8ab2efc699f47e1d36eccd9e9f

SHA512
c6bd845626684e3a24dadb296a056205f41f0315405e9256f97f95de0d821414510e59e43fc211da39b6e7b11c77d56f0b16b0735f586f948a2878686734674d

Download Submit
/root/.mozilla/firefox/qos6sfvn.default-release/compatibility.ini

Filesize
163B

MD5
fe452b7294d5928a9a5863b89ee0a6bd

SHA1
a5d4c245071fa96476ba48b4725bdae7f1b7940f

SHA256
d5bfb07561606a19aa96557ea109b175050dc0eb805cbef9c813503587d77900

SHA512
dc37d8507f08849e3382d2dbafd4a64555dbd57a288c95131e9aefb366630f1585811a9e1456b861bb9d2b816ed88b18ffb7580cd92b41bb9b0227ce1363843e

Download Submit
/root/.mozilla/firefox/qos6sfvn.default-release/cookies.sqlite

Filesize
96KB

MD5
9535f5fe817accc769c2c1d3354db39f

SHA1
6af62cf08717cf3bfa84eb1a7b311acf522ce560

SHA256
c53c15fcfac2bb57fdc88d23f932fc244dbaf4020f0f6eaecf0f77a37c21f8c5

SHA512
dc9c2c32eb42dda0a7a711e143aea58c603c1e9d885c3677e9fe86f525e1b0b32a46e240756263e56510b07e764ba69f2de13b90ec18210678242e10cfe17837

Download Submit
/root/.mozilla/firefox/qos6sfvn.default-release/cookies.sqlite

Filesize
96KB

MD5
5caa766855d5613a999f71b7812d6451

SHA1
ad0d9a52a0d5cc7f11858301dbe47377ed99ee37

SHA256
3a8ce2b07e3e8678a13aa58ef5b942c4dccd8f9c84511bdeb8847ef270797e27

SHA512
17bb0f4c87ec178910795b25ce85e74cf599190c769592472c3e872f42930c93f28faf0ff3e448816a9abcc8af0459852bed52bee08cfe25d068879c6dfd8eba

Download Submit
/root/.mozilla/firefox/qos6sfvn.default-release/key4.db

Filesize
288KB

MD5
f6ae4c40ed40a97969bc4051227ada59

SHA1
d4cab727ac6dd76106bd90108d5f066b788b8042

SHA256
3dffff80ce75ca1f9b82d9a5e9e7d756e48b13fa2575ae0bd5beeb1bf37f8b02

SHA512
c149c522272a1cf564da743b16e7c38a94d3ad7b76c6bd37fafe9e8c6796a332abe7952ae4226719ff0e68667b3355f150498509923738389f9239870e4f0b97

Download Submit
/root/.mozilla/firefox/qos6sfvn.default-release/permissions.sqlite

Filesize
96KB

MD5
232fbc22dd03a8ec41edde02bdbea61c

SHA1
6ab4b39bca95418c52f7f861fd39e5fddb9cc7b6

SHA256
d88bf367aaf79efbb2e8fbdb1dc5bde1c1c3a53e0f4d8188027a63ec55d5f5f0

SHA512
055f1595f4a327347671db53cec8d89a310109d3f871c567e3d5b654b956fc0369d12437f7dc6d9327b973008f1327ee0dfdb5504f1b3cbe00da29941b1e5892

Download Submit
/root/.mozilla/firefox/qos6sfvn.default-release/prefs-1.js

Filesize
2KB

MD5
ef3a5d3d326535fe8d74a2bfc7b805b1

SHA1
e2299ae11f146a3b8201b67ab913683ef72933ad

SHA256
6def177ab7cc5d561c1e81bb0ee35600c04285c056315300bf961664ec45b6b5

SHA512
a7a251650f3bf67c94ead2a6164d1049c6328610feb977e14f8856708192a84d10291f0b536d57042228beccf7d0d5523b00141d99ba0d510be42b950f188e90

Download Submit
/root/.mozilla/firefox/qos6sfvn.default-release/prefs-1.js

Filesize
3KB

MD5
c0190914aad419dec9485c4c4c0e8d89

SHA1
982ce9e2eab667294dc18a891f8557449fea9ae1

SHA256
1297b65ed8f55810c1dc24cd4c6f5130ca3abf9cae26db66a3eec82071a79476

SHA512
767642a9e6ff57bbeb1ad86de9983eb2a1296ef44c195be015006151d55836e9a60ca568b4b4ad2d731c81c26b20415cf765247c27eba2d8b0184ad16335ea1d

Download Submit
/root/.mozilla/firefox/qos6sfvn.default-release/prefs-1.js

Filesize
3KB

MD5
0d69aa201d2d0e84a4ac87e94491f896

SHA1
c776e1c51690f2b19ee032917d24debb0817768c

SHA256
1717c96052802c8a9553b741ea531e09a9c41f43a9ffa46a4bf58c91ceca1522

SHA512
4108a6e655a25646aba070845e481c16ef151c86700f499912e112756182f8cb57828510692f2d2c142deebeb8f4ddb3cdb8eff6d17ba993dcae42419714bc2f

Download Submit
/root/.mozilla/firefox/qos6sfvn.default-release/prefs.js

Filesize
1KB

MD5
718ec300a9c28227e72d3b9e11b4cca7

SHA1
9c4e4225ecc1375198a7fae3da1df385d24427e2

SHA256
da304c458fe0b223ac39cafdc34a3a1ec098770b4abd0610697f0fcc0404c5c9

SHA512
c587c0502e1880425f8f38086fe28e45664f38eb966bfc934a685fa97bdfdb9816d6e1abeefb686d2654b56f55e0adaea8fdf4e58078fac5b8b00ce630e8c643

Download Submit
/root/.mozilla/firefox/qos6sfvn.default-release/storage/ls-archive.sqlite

Filesize
96KB

MD5
e0c613bfd69956a19ce2dc5e925aa223

SHA1
14accb230edcd6cb76967cdc6d4e5686db96b5df

SHA256
0d4cb11f6364c46a75f9eaddfca5c660b90dfd515df3afcd5e0baeca28a0f1ab

SHA512
01643c0131a392be92b3f281d7f633c1f502bff19090b0d716f1ac66aefecc3fcf92f393bef66b03089c9b9c6d8aaeb711b6a4f29d5a6729dd188c838f2272d1

Download Submit
/root/.mozilla/firefox/qos6sfvn.default-release/storage/ls-archive.sqlite

Filesize
128KB

MD5
178d71e5529d637ac62f7e75fdd75896

SHA1
339f2b949cc4c207b66aea11137448ba28d36dcb

SHA256
7b0050f1bfaab85c8f9067ae7d7369056ff752c0c852ef1462a96c22169004d4

SHA512
ec0e0105fcfbbae356dd55efbcf92975f35bbe5cb93fcabf4c08443e871957635d14830b27c4e1ddefbbaff8f9b7ec3590bf417a9442e1d7ee3607d14d56f664

Download Submit
/root/.mozilla/firefox/qos6sfvn.default-release/storage/permanent/chrome/.metadata-v2-tmp

Filesize
42B

MD5
a61e76e8f0e59f0fb66f4c03956b8b08

SHA1
21f59216a26e47fa29911096adc7410726c6ea44

SHA256
99663e9a947cb5c42e8b134218693112334a0f86c0074f080cf60622a2b6a7d2

SHA512
b121efb98b21de8450187c5ce59452bc22daf2e63169a2b0c6d89dbaee5aed3ca7ed2e0c70935c31304828f9dce5593f965af914f10dcec2072c557ae1ab1682

Download Submit
/root/.mozilla/firefox/qos6sfvn.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite

Filesize
44KB

MD5
759544297aaa61f5fef8ee42d0ae4393

SHA1
fc2d66f6e60409e3e8d38623ce5f817fc7f571e0

SHA256
1bd2000cd972e80cefaec6e982ba261d224a818f367de0fdf8c51fa5a05d7ab5

SHA512
8aaa2ce66f10d46f7c9200af841ac7bd9f5b55c30308a14f0deda44ac62581c45daae45154487c0073a0d5847d5926cbb4072ca64a702ac6b834ad0bb482804f

Download Submit
/root/.mozilla/firefox/qos6sfvn.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite

Filesize
12KB

MD5
b1437244569f1873849e85bc4fbdcce3

SHA1
98c75ee803afc0703118315728c377096b044414

SHA256
5473a086a3f816c7ea424e978d4b3c642ec6881d8a508669b01ab5717111de96

SHA512
701c6790100cbb92488023a373995e9ce33100d8854ce3dda427654928609eb57cc3c757cdf67fcff651f5b73eac9b8ed17c92c88ed01df74a03e332f377c496

Download Submit
/root/.mozilla/firefox/qos6sfvn.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
44KB

MD5
07a412e08825220262ad2890757ff779

SHA1
f46c127dbc070ded87a6078b3c1c761955f96de8

SHA256
da640f8b665841b520d2262a21cc3f82aeaa881cf81a1ddae27ef501d66544e4

SHA512
0134c783bf3293848e479b478ac57a1e0f4202cddfb8b57bc6275aada7345f398cf8a627e9b1c34fd618192c2f0c9737b1da487daf33f9c557ebc1377105582b

Download Submit
/root/.mozilla/firefox/qos6sfvn.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
12KB

MD5
0007bcb0507a99b61d45f81c6dcfb1a5

SHA1
6303aa8ace9d96cff3fe6f8718fab518f8319cf8

SHA256
8c2a4dfee435049c8ce082d515794aa37babfa67fc673f8e014c6dc3a60e53ea

SHA512
eb183e06f1962970ad4fd4ce5709c0f40d9ebb45f5d61f768cb899c6f68bc463bb7b76aa57579341ad7fbc64c81e4a98aeda25e749f676cf08ec20fca29e3339

Download Submit
/root/.mozilla/firefox/qos6sfvn.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
164KB

MD5
77a74f224e25a6bc10ad443579a941da

SHA1
f54cb29d4ee5575b60a4d86387e074814dced933

SHA256
f21a9e7da222998300bbf62489cef6fa7e1e92a99eecff3de5b9dd606b350dbc

SHA512
534ebd9aabfbf8ffd84d7b1a977af2565ea5f9bca6557f7ee9ebc3f2f9462e261664363927c13fe0f73febff7a4fa61f2f8ee408685482d147598a6c6467a874

Download Submit
/root/.mozilla/firefox/qos6sfvn.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
148KB

MD5
dd3f6ba37c670af5953593535e435d04

SHA1
ecfe4e650a050bce77e8ff7468de04c1b8acc9a4

SHA256
5cc6fa137a1f3a7d0b615b178877f12c460b22f95702eb7534d5732ee6599561

SHA512
86e0482543faae6fb279ca71e1e6d6461d32317e74baebb3973e0fde9800107faeb9c2347be6cf8a47556ae43c8e6c224a595e952f621e40ad2c5eba920df2b3

Download Submit
/root/.mozilla/firefox/qos6sfvn.default-release/times.json

Filesize
50B

MD5
ea13a9f48384545784bb5a01b3014164

SHA1
64da9a944b44b751dc1dccbcf05c4427c819e442

SHA256
f841833909e5bf348cfa87613448249de74280af26563ac082df582e09511524

SHA512
396e0bf47c9ecac9de38aafb8dee16c8fb62ee98603d2ff9f0ef0e8a05dfe94d85d65a4cbcce641cb7cc30da29ae131c566a743730afd95d3f05d60d281a29bb

Download Submit
/root/.mozilla/firefox/qos6sfvn.default-release/times.json

Filesize
47B

MD5
9a921ace4310da9edaca839cb9a7573c

SHA1
5ecbd3d3505c45953c92deddb5002f8264ee4bbf

SHA256
19df8f3c131c3678d3b95f163850c96de5ae40b6cd55680d738ab8b6b964651b

SHA512
1f8307ff9562135e576113ec134e57173febfbcf43141125da608544f1a805a832cb622c4f3e85a9ec5dc431b3aeae497eb64f1fd9b0483ec9fa423aa7a84e9d

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads