hxxps://www[.]nsa[.]gov/about/contact-us/National-Security-Cyber-Assistance-Program-NSCAP/

Analysis

max time kernel
2s
max time network
63s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20231221-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20231221-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
19/02/2024, 21:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.nsa.gov/about/contact-us/National-Security-Cyber-Assistance-Program-NSCAP/

Score

7^/10

antivm spyware stealer

Malware Config

Signatures

Changes its process name 64 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	glean.dispatche	1648	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1649	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1649	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1649	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1654	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1654	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1653	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1653	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1652	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1652	Process not Found
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1655	Process not Found
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1655	Process not Found
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1651	Process not Found
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1651	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1650	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1650	Process not Found
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1657	Process not Found
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1657	Process not Found
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1659	Process not Found
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1659	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cache2 I/O	1660	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cookie	1661	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cookie	1661	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1662	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1662	Process not Found
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #1	1664	Process not Found
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #0	1663	Process not Found
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1665	Process not Found
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1665	Process not Found
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	1666	Process not Found
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	1666	Process not Found
Changes the process name, possibly in an attempt to hide itself	IndexedDB #1	1667	Process not Found
Changes the process name, possibly in an attempt to hide itself	IndexedDB #1	1667	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC Launch	1670	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC Launch	1670	Process not Found
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	1669	Process not Found
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	1669	Process not Found
Changes the process name, possibly in an attempt to hide itself	Breakpad Server	1668	Process not Found
Changes the process name, possibly in an attempt to hide itself	DOM Worker	1672	Process not Found
Changes the process name, possibly in an attempt to hide itself	DOM Worker	1672	Process not Found
Changes the process name, possibly in an attempt to hide itself	Sandbox Forked	1671	Process not Found
Changes the process name, possibly in an attempt to hide itself	Chroot Helper	1673	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #5	1677	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #5	1677	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #4	1676	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #4	1676	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #3	1675	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #3	1675	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	1674	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	1674	Process not Found
Changes the process name, possibly in an attempt to hide itself	MainThread	1671	firefox
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1679	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1679	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1679	Process not Found
Changes the process name, possibly in an attempt to hide itself	FSBroker1671	1680	Process not Found
Changes the process name, possibly in an attempt to hide itself	FSBroker1671	1680	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Process	1671	firefox
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1682	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1682	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1681	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1681	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1684	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1684	Process not Found
Changes the process name, possibly in an attempt to hide itself	ProfilerChild	1683	Process not Found

Reads user data of web browsers 64 IoCs

Reads stored browser data which can include saved credentials.

spyware stealer

description	ioc	Process
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/prefs.js	firefox
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/sessionstore.jsonlz4	Process not Found
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/cert9.db	firefox
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/key4.db	firefox
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/cert_override.txt	firefox
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/ClientAuthRememberList.txt	Process not Found
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/addonStartup.json.lz4	firefox
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/extension-preferences.json	Process not Found
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/handlers.json	firefox
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/key4.db-journal	firefox
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/storage/ls-archive.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/times.json	Process not Found
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/compatibility.ini	firefox
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/storage.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/sessionstore.js	Process not Found
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release	Process not Found
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/cookies.sqlite	firefox
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/sessionstore-backups/previous.jsonlz4	Process not Found
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/cert9.db-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/content-prefs.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/cookies.sqlite-journal	firefox
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/cert9.db	Process not Found
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/storage.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/sessionstore-backups/recovery.baklz4	Process not Found
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/sessionCheckpoints.json	Process not Found
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/cert9.db-journal	firefox
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/sessionstore-backups/recovery.js	Process not Found
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/sessionstore-backups/recovery.bak	Process not Found
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/user.js	firefox
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/extensions	firefox
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/shield-preference-experiments.json	Process not Found
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/search.json.mozlz4	Process not Found
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/AlternateServices.txt	Process not Found
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/sessionstore-backups/recovery.jsonlz4	Process not Found
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/cookies.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/storage/permanent/chrome/idb	Process not Found
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/system-extensions	firefox
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/storage/ls-archive.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/permissions.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/pkcs11.txt	firefox
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/xulstore.json	firefox
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/extensions.json	Process not Found
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/storage/permanent/chrome	Process not Found
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/cookies.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/storage	Process not Found
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/key4.db	Process not Found
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/addons.json	Process not Found
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/SiteSecurityServiceState.txt	Process not Found
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release	firefox
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/sessionstore-backups/previous.js	Process not Found
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/content-prefs.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/erg28nbs.default-release/permissions.sqlite-journal	Process not Found

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc
File opened for reading	/proc/cpuinfo

Reads CPU attributes 1 TTPs 11 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/size	Process not Found
File opened for reading	/sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq	Process not Found
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/size	Process not Found
File opened for reading	/sys/devices/system/cpu/present	Process not Found
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox

Enumerates kernel/hardware configuration 1 TTPs 60 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/security/apparmor/features/dbus/mask	dbus-daemon
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/device	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/devices/system/cpu	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/irq	Process not Found
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/resource	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/device	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/vendor	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/device	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/class	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/irq	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/class	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/uevent	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/class	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/device	Process not Found

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/self/fd/38	firefox
File opened for reading	/proc/1690/cmdline	Process not Found
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/1768/statm	Process not Found
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/filesystems	dbus-daemon
File opened for reading	/proc/1642/cmdline	Process not Found
File opened for reading	/proc/self/fd/47	firefox
File opened for reading	/proc/self/fd/35	firefox
File opened for reading	/proc/1745/smaps	Process not Found
File opened for reading	/proc/filesystems	gvfsd
File opened for reading	/proc/1552/status	Process not Found
File opened for reading	/proc/self/fd/36	firefox
File opened for reading	/proc/filesystems	xdg-document-portal
File opened for reading	/proc/1695/cmdline	Process not Found
File opened for reading	/proc/filesystems	xdg-desktop-portal-gtk
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/filesystems	xdg-permission-store
File opened for reading	/proc/self/fd/6	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/fd	Process not Found
File opened for reading	/proc/1547/cmdline	Process not Found
File opened for reading	/proc/self/fd/44	firefox
File opened for reading	/proc/self/task/1678/stat	Process not Found
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/task/1775/stat	Process not Found
File opened for reading	/proc/self/task/1818/stat	Process not Found
File opened for reading	/proc/mounts	dbus-daemon
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/mountinfo	Process not Found
File opened for reading	/proc/self/fd/46	firefox
File opened for reading	/proc/self/task/1799/stat	Process not Found
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/sys/kernel/cap_last_cap	Process not Found
File opened for reading	/proc/self/fd/37	firefox
File opened for reading	/proc/self/fd/49	firefox
File opened for reading	/proc/filesystems	xdg-desktop-portal
File opened for reading	/proc/1714/cmdline	Process not Found
File opened for reading	/proc/self/fd/43	firefox
File opened for reading	/proc/self/task/1751/stat	Process not Found
File opened for reading	/proc/1745/statm	Process not Found
File opened for reading	/proc/self/fd/45	firefox
File opened for reading	/proc/self/fd/48	firefox
File opened for reading	/proc/1710/cmdline	Process not Found
File opened for reading	/proc/self/task/1644/stat	Process not Found
File opened for reading	/proc/self/fd/34	firefox
File opened for reading	/proc/self/fd/51	firefox
File opened for reading	/proc/1768/smaps	Process not Found
File opened for reading	/proc/1552/attr/current	Process not Found
File opened for reading	/proc/self/fd/41	firefox
File opened for reading	/proc/self/fd/75	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd/29	firefox
File opened for reading	/proc/self/fd/42	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/1699/cmdline	Process not Found
File opened for reading	/proc/filesystems	gvfsd-fuse
File opened for reading	/proc/self/cgroup	firefox

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/firefox/.parentlock	firefox

/usr/bin/xdg-open
xdg-open https://www.nsa.gov/about/contact-us/National-Security-Cyber-Assistance-Program-NSCAP/
1⤵
PID:1546
- /usr/bin/dbus-send
  dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
  2⤵
  PID:1547
- - /usr/bin/dbus-launch
    dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
    3⤵
    PID:1548
- /bin/grep
  grep " = \\\"xfce4\\\"\$"
  2⤵
  PID:1558
- /usr/bin/xprop
  xprop -root _DT_SAVE_MODE
  2⤵
  PID:1557
- /bin/grep
  grep -i "^xfce_desktop_window"
  2⤵
  PID:1561
- /usr/bin/xprop
  xprop -root
  2⤵
  PID:1560
- /bin/grep
  grep -q "^Enlightenment"
  2⤵
  PID:1563
- /bin/uname
  uname
  2⤵
  PID:1564
- /bin/grep
  grep -q "^file://"
  2⤵
  PID:1566
- /bin/egrep
  egrep -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1568
- /usr/local/sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1568
- /usr/local/bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1568
- /usr/sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1568
- /usr/bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1568
- /sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1568
- /bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1568
- /usr/bin/xdg-mime
  xdg-mime query default x-scheme-handler/https
  2⤵
  PID:1572
- - /usr/bin/dbus-send
    dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
    3⤵
    PID:1573
  - - /usr/bin/dbus-launch
      dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
      4⤵
      PID:1574
- - /bin/grep
    grep " = \\\"xfce4\\\"\$"
    3⤵
    PID:1578
- - /usr/bin/xprop
    xprop -root _DT_SAVE_MODE
    3⤵
    PID:1577
- - /bin/grep
    grep -i "^xfce_desktop_window"
    3⤵
    PID:1580
- - /usr/bin/xprop
    xprop -root
    3⤵
    PID:1579
- - /bin/grep
    grep -q "^Enlightenment"
    3⤵
    PID:1582
- - /bin/uname
    uname
    3⤵
    PID:1583
- /usr/bin/which
  which firefox
  2⤵
  PID:1627
- /usr/bin/firefox
  /usr/bin/firefox https://www.nsa.gov/about/contact-us/National-Security-Cyber-Assistance-Program-NSCAP/
  2⤵
  PID:1642
- - /usr/bin/which
    which /usr/bin/firefox
    3⤵
    PID:1643
- /usr/lib/firefox/firefox
  /usr/lib/firefox/firefox https://www.nsa.gov/about/contact-us/National-Security-Cyber-Assistance-Program-NSCAP/
  2⤵
  - Reads user data of web browsers
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1642
- - /usr/bin/dbus-launch
    dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
    3⤵
    PID:1647
- - /usr/local/sbin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1687
- - /usr/local/bin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1687
- - /usr/sbin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1687
- - /usr/bin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1687

/usr/bin/dbus-daemon
/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1550

/bin/sed
sed -n "s/\$^[[:alnum:]+\\.-]*\$:.*\$/\\1/p"
1⤵
- Reads runtime system information
PID:1571

/bin/sed
sed "s/:/ /g"
1⤵
- Reads runtime system information
PID:1586

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1591

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1590

/usr/bin/head
head -n 1
1⤵
PID:1589

/bin/grep
grep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
1⤵
PID:1588

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1596

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1595

/usr/bin/head
head -n 1
1⤵
PID:1594

/bin/grep
grep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
1⤵
PID:1593

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1601

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1600

/usr/bin/head
head -n 1
1⤵
PID:1599

/bin/grep
grep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
1⤵
PID:1598

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1606

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1605

/usr/bin/head
head -n 1
1⤵
PID:1604

/bin/grep
grep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
1⤵
PID:1603

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1611

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1610

/usr/bin/head
head -n 1
1⤵
PID:1609

/bin/grep
grep "x-scheme-handler/https=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache
1⤵
PID:1608

/bin/sed
sed "s/:/ /g"
1⤵
- Reads runtime system information
PID:1615

/bin/sed
sed -e "s|-|/|"
1⤵
- Reads runtime system information
PID:1618

/bin/sed
sed -e "s|-|/|"
1⤵
- Reads runtime system information
PID:1621

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1626

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1633

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1636

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1641

/usr/bin/lsb_release
/usr/bin/lsb_release -idrc
1⤵
PID:1658

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -parentBuildID 20230522134052 -prefsLen 19257 -prefMapSize 230809 -appDir /usr/lib/firefox/browser "{2b920945-b853-4d96-b378-fee347d57bb6}" 1642 true socket
1⤵
- Changes its process name
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1671

/usr/libexec/xdg-desktop-portal
/usr/libexec/xdg-desktop-portal
1⤵
- Reads runtime system information
PID:1690

/usr/libexec/xdg-document-portal
/usr/libexec/xdg-document-portal
1⤵
- Reads runtime system information
PID:1695

/usr/libexec/xdg-permission-store
/usr/libexec/xdg-permission-store
1⤵
- Reads runtime system information
PID:1699

/usr/libexec/xdg-desktop-portal-gtk
/usr/libexec/xdg-desktop-portal-gtk
1⤵
- Reads runtime system information
PID:1710

/usr/lib/gvfs/gvfsd
/usr/lib/gvfs/gvfsd
1⤵
- Reads runtime system information
PID:1714

/usr/lib/gvfs/gvfsd-fuse
/usr/lib/gvfs/gvfsd-fuse /root/.gvfs -f -o big_writes
1⤵
- Reads runtime system information
PID:1719

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 21750 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{558ab137-cb4e-4257-9665-c04d49998f47}" 1642 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1745

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 2 -isForBrowser -prefsLen 21418 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{d4d6d9b2-5ec9-4eb7-abed-1a19db21ac69}" 1642 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1768

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 3 -isForBrowser -prefsLen 21767 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{1afd6fdc-1f99-4ff6-81b0-00197607e0cc}" 1642 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1796

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 4 -isForBrowser -prefsLen 27824 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{76c71bc7-d734-4fac-8b60-1e87dd8179d5}" 1642 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1814

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/root/.cache/dconf/user

Filesize
2B

MD5
c4103f122d27677c9db144cae1394a66

SHA1
1489f923c4dca729178b3e3233458550d8dddf29

SHA256
96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

SHA512
5ea71dc6d0b4f57bf39aadd07c208c35f06cd2bac5fde210397f70de11d439c62ec1cdf3183758865fd387fcea0bada2f6c37a4a17851dd1d78fefe6f204ee54

Download Submit
/root/.cache/mozilla/firefox/erg28nbs.default-release/cache2/entries/3D1E19D09F398691ABF62061591970855193B42F

Filesize
13KB

MD5
1dcb21ff50a04c4845ad41c0a4396e8a

SHA1
f15c6544353ae1361d709d55f32453156a634798

SHA256
34d25e87b9141fefc2311c611abd0c4d3df7a0248c5fc451de5b1f33f180bb65

SHA512
65181272c3839c7b0f3a72123e6259f1a4485fcf710d0613f999fae83a66485675f934f9f21a508dfb97c33e54b226e2375e23368c8db354edc06accc68a65cc

Download Submit
/root/.dbus/session-bus/11c67417355f45d397f6be11f62e85a6-0

Filesize
466B

MD5
a7d5db4470c50c798f52db2292617353

SHA1
379e31a95f5df26b80a6107ab99c5b01c9aec40d

SHA256
bde2f90f42dad27085082169c84548a00c5559ccea5a4b3a2ccc939d89f77544

SHA512
c104cf1a7cc2ca0bddd60ad777b5644718f871e7eb8553b885e0d629afe0f5b79eea6cf0b99f3fcef6d7bde4d4724f67f2298031fdc8efb5db8c35b0537b8ecb

Download Submit
/root/.mozilla/firefox/Crash Reports/InstallTime20230522134052

Filesize
10B

MD5
eecda7f4f67edcf06c5ee5a9d6f69aa1

SHA1
7a2f9af2e44d9cd684055b7065e9b6e37ff3b527

SHA256
92040807a85e61ff705ec9b7758af395ee633100597b9730951fa4f8515d98c7

SHA512
f44e40a8cda2398b9347fdb3ea7f505c7c7fc9b95c55ecd143185e9f5c40f462ff37550525978205fad7c36481a640f64df1b9fb5d003d18faeca77315993173

Download Submit
/root/.mozilla/firefox/erg28nbs.default-release/cert9.db

Filesize
224KB

MD5
025045828e077c08a47742c565a60079

SHA1
01a9856d131d4cd4fc5417e1df744b02ad5a965e

SHA256
f63943f985c9bf8cb845b47dcd848335308d1298088ca1ab081a27edd8d08317

SHA512
adc4aa33739cc09cf890464c7af2bdd09765724aaa039cc61b1afb8613937e985e94ee72bb0bbfd233269be4a3691f4cff03977946f3e0416326bc167db999db

Download Submit
/root/.mozilla/firefox/erg28nbs.default-release/compatibility.ini

Filesize
163B

MD5
fe452b7294d5928a9a5863b89ee0a6bd

SHA1
a5d4c245071fa96476ba48b4725bdae7f1b7940f

SHA256
d5bfb07561606a19aa96557ea109b175050dc0eb805cbef9c813503587d77900

SHA512
dc37d8507f08849e3382d2dbafd4a64555dbd57a288c95131e9aefb366630f1585811a9e1456b861bb9d2b816ed88b18ffb7580cd92b41bb9b0227ce1363843e

Download Submit
/root/.mozilla/firefox/erg28nbs.default-release/cookies.sqlite

Filesize
96KB

MD5
9535f5fe817accc769c2c1d3354db39f

SHA1
6af62cf08717cf3bfa84eb1a7b311acf522ce560

SHA256
c53c15fcfac2bb57fdc88d23f932fc244dbaf4020f0f6eaecf0f77a37c21f8c5

SHA512
dc9c2c32eb42dda0a7a711e143aea58c603c1e9d885c3677e9fe86f525e1b0b32a46e240756263e56510b07e764ba69f2de13b90ec18210678242e10cfe17837

Download Submit
/root/.mozilla/firefox/erg28nbs.default-release/cookies.sqlite

Filesize
96KB

MD5
5caa766855d5613a999f71b7812d6451

SHA1
ad0d9a52a0d5cc7f11858301dbe47377ed99ee37

SHA256
3a8ce2b07e3e8678a13aa58ef5b942c4dccd8f9c84511bdeb8847ef270797e27

SHA512
17bb0f4c87ec178910795b25ce85e74cf599190c769592472c3e872f42930c93f28faf0ff3e448816a9abcc8af0459852bed52bee08cfe25d068879c6dfd8eba

Download Submit
/root/.mozilla/firefox/erg28nbs.default-release/key4.db

Filesize
288KB

MD5
698042d63829f5875669da370dc3a381

SHA1
94cd969db7a8952420ec4b7962c85381521599af

SHA256
eca6673d6a6589945f3193db533094a058760881616de1f16bc7b7b5adecec01

SHA512
31272f16d19813de736269e1251df198a772d82f3bc54f932065f483e6cd36bcd6884d4f9d10c41a8ffcb2e8074c40362374ad2d98885779bfd1f09ca80bba77

Download Submit
/root/.mozilla/firefox/erg28nbs.default-release/permissions.sqlite

Filesize
96KB

MD5
232fbc22dd03a8ec41edde02bdbea61c

SHA1
6ab4b39bca95418c52f7f861fd39e5fddb9cc7b6

SHA256
d88bf367aaf79efbb2e8fbdb1dc5bde1c1c3a53e0f4d8188027a63ec55d5f5f0

SHA512
055f1595f4a327347671db53cec8d89a310109d3f871c567e3d5b654b956fc0369d12437f7dc6d9327b973008f1327ee0dfdb5504f1b3cbe00da29941b1e5892

Download Submit
/root/.mozilla/firefox/erg28nbs.default-release/prefs-1.js

Filesize
2KB

MD5
c1952ac8d07fae69dbb8c53db902be0f

SHA1
199fd8a7f13d318807a70c3d1df97469619f6ca0

SHA256
7431a5b16a7dc7b31db2dcecf61af868f18246a16b024c5a35f54ee9d1f0d202

SHA512
d8457a8b676fe4650821a3f6c7a2616dc3ebb6ac730ff60c1527811a89e2ca8dc0d52ac6e4fb5c4519496cf2e732fc0ab58d33b34046b38c7bf3dcb085f52ed3

Download Submit
/root/.mozilla/firefox/erg28nbs.default-release/prefs-1.js

Filesize
2KB

MD5
0b8e7a3f95c9d39191aa9ca3d80b434a

SHA1
19db26396505628ed3fd2d5b35231d3d081493e1

SHA256
20ad03e21ab877e3ebf54f3fb0f37d9bb2c545c3de30904f45c06fc765f6876b

SHA512
dc37fcdf9036ea61dbfd8a70691d952efd24bc8079a75ec874a836a4f019458ad63b83a6321179043f04571a977dd07b7d4b7c92f46b853c29e540b8761a7e57

Download Submit
/root/.mozilla/firefox/erg28nbs.default-release/prefs-1.js

Filesize
3KB

MD5
f7fff9e96d86e9023a3b374f23fad390

SHA1
77e4cdaeaaf5705756b3914f4c7c16cbef78de38

SHA256
6440d21ddae828d21e64bb2e73ccf64b8dc430bf7e2c2859f02851425779f8c4

SHA512
8d58fac9bcb49a07f0d73a3d388129509d2ced842aefc4ae05357c8f17ef7669d5c654d201d09bdf00d1f4cfcd883da7f557795faa941785d864771d2746d1c6

Download Submit
/root/.mozilla/firefox/erg28nbs.default-release/prefs.js

Filesize
1KB

MD5
dc361dc7457b95500bb20c87b1de66d6

SHA1
55ddec2d28a48285b0162204075051e5291a1acb

SHA256
7098c033c89067bdb26b1f2f96f8a118b255a6a9634b6ecbc082b01d2138e5ff

SHA512
f470c3a8af4c7aae5fad0000003a02d6dbd04773e72a5bb3b307edc28eedee6d0df48366bd94ecfd16d2adf18e7e8f611ac9aa7798a6914cb922cb9d429c9ddc

Download Submit
/root/.mozilla/firefox/erg28nbs.default-release/storage/ls-archive.sqlite

Filesize
96KB

MD5
e0c613bfd69956a19ce2dc5e925aa223

SHA1
14accb230edcd6cb76967cdc6d4e5686db96b5df

SHA256
0d4cb11f6364c46a75f9eaddfca5c660b90dfd515df3afcd5e0baeca28a0f1ab

SHA512
01643c0131a392be92b3f281d7f633c1f502bff19090b0d716f1ac66aefecc3fcf92f393bef66b03089c9b9c6d8aaeb711b6a4f29d5a6729dd188c838f2272d1

Download Submit
/root/.mozilla/firefox/erg28nbs.default-release/storage/ls-archive.sqlite

Filesize
128KB

MD5
178d71e5529d637ac62f7e75fdd75896

SHA1
339f2b949cc4c207b66aea11137448ba28d36dcb

SHA256
7b0050f1bfaab85c8f9067ae7d7369056ff752c0c852ef1462a96c22169004d4

SHA512
ec0e0105fcfbbae356dd55efbcf92975f35bbe5cb93fcabf4c08443e871957635d14830b27c4e1ddefbbaff8f9b7ec3590bf417a9442e1d7ee3607d14d56f664

Download Submit
/root/.mozilla/firefox/erg28nbs.default-release/storage/permanent/chrome/.metadata-v2-tmp

Filesize
42B

MD5
6b323d14744c0d47183954fdafbcacb8

SHA1
ff475d23041784c6bb082f141d2d14df41ddd69a

SHA256
d79e963eba1d0efcd53ea436a1027cbfbaf64f0426c97aa0b9455d67aeabb508

SHA512
d897c338f099c936bea52dacce71eb99549930a7543bd70d26d30ac16b65c9af0e59e3966c0e6cb3074cf65a2112ca1b955f6268b3dcda5cfa8c2d84d281f7b3

Download Submit
/root/.mozilla/firefox/erg28nbs.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite

Filesize
44KB

MD5
a8dd7ebaad5528b23f82ccb1534cea18

SHA1
600daceacfb5cf9df0b66ba7dce4516b2ac4df70

SHA256
e5b0d02c18ae36c4a220f41fd97c66060c17aaafcbb324a57ccdc2707c44c4ec

SHA512
67f867a8e2b37fb6bececd5ebc570ca594ea329142badd63d1281d5e735f515a5e329abc6eb9a9d3465aab0a08541b4888018d859964f160a52345ab93532bff

Download Submit
/root/.mozilla/firefox/erg28nbs.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite

Filesize
12KB

MD5
74509c300196ebfa9f1084b2c6f1d57d

SHA1
3b72bb14ca923f05be188ef5e40c787aab56079b

SHA256
4be562ce6bd270b897b81795b389932efc695707e734f1d0904427c391cc111c

SHA512
0dff61018b1c08a1357946b0eba53b590390d0edd1d765360691776eaf83acd6331d4c5b352230818ad12d71605576baab57a0c8102d45b047cd383ef1acb6c8

Download Submit
/root/.mozilla/firefox/erg28nbs.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite

Filesize
44KB

MD5
7352c8848e88edc39b7fb5e663888187

SHA1
8c3dffe25cc56c7aec1b782292d6fceed81e6304

SHA256
7a462086a26978809c719e57a7ea6a25568767fb7532014e8531fda94b660e0a

SHA512
f2a0dbbab5c2c1702b03bce15a47739481f523e127d1372b40534db9a20b2bc99fb53710ee0e5d44176188817cac704cf4f98cdf087e7e89d244281fcfc3b280

Download Submit
/root/.mozilla/firefox/erg28nbs.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite

Filesize
12KB

MD5
d47525b25336e4d4cfd169aa156ddde9

SHA1
4cddf1c4b723f15f2de2fc1616d5377678d9cfa5

SHA256
7922851346de724914b2708a1eed2c9b836a97a1c8f5f121a76b848567dfe4b4

SHA512
2bd8e1a3a562d769ce389a4209d6c92acdf17aa6f40db518f61c81dca7ca77ab6411a1f8cb173a884aeaf591c637c94d4f93df04bdaa50c5395365e6f04e1b4f

Download Submit
/root/.mozilla/firefox/erg28nbs.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite

Filesize
44KB

MD5
759544297aaa61f5fef8ee42d0ae4393

SHA1
fc2d66f6e60409e3e8d38623ce5f817fc7f571e0

SHA256
1bd2000cd972e80cefaec6e982ba261d224a818f367de0fdf8c51fa5a05d7ab5

SHA512
8aaa2ce66f10d46f7c9200af841ac7bd9f5b55c30308a14f0deda44ac62581c45daae45154487c0073a0d5847d5926cbb4072ca64a702ac6b834ad0bb482804f

Download Submit
/root/.mozilla/firefox/erg28nbs.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite

Filesize
12KB

MD5
bfa9698d93bf177b29b476dfc3533c24

SHA1
c9eb2d6440bbcce2d44e6991b95cfd6ed7830962

SHA256
37bad1ddf5c1b4036f9504283c77aa30000f33c02ff0bf5ea76bacf500e19214

SHA512
a8e72dff045b6a795a3ac21fe7fa49eddd005b1f03041f669b0a887b76a3c54665f38fb7f614d5545ef28aefdaef46687967d30ae25b0689092395832c30ec2e

Download Submit
/root/.mozilla/firefox/erg28nbs.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
44KB

MD5
07a412e08825220262ad2890757ff779

SHA1
f46c127dbc070ded87a6078b3c1c761955f96de8

SHA256
da640f8b665841b520d2262a21cc3f82aeaa881cf81a1ddae27ef501d66544e4

SHA512
0134c783bf3293848e479b478ac57a1e0f4202cddfb8b57bc6275aada7345f398cf8a627e9b1c34fd618192c2f0c9737b1da487daf33f9c557ebc1377105582b

Download Submit
/root/.mozilla/firefox/erg28nbs.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
12KB

MD5
b53ee54cfa45d12123dc6e7b77bc7495

SHA1
72dbbd3d45ec4af3679b225d895759b3f97d6c1a

SHA256
52a320f848e3edc9560cf56006cf27cc59dcf01bf83f071cc17417df37a6bcdb

SHA512
4336e72d566f62651fb85c19d20fb767d56504e5f7581967d25ca720a67302f60b07de27bb262525f474bcd95383ccd0f76d17c7b8bdffac237a37a18f3da1ed

Download Submit
/root/.mozilla/firefox/erg28nbs.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
164KB

MD5
7393619c52773d61d2b6f436c785b5bf

SHA1
2a2280937d4e14f25b60804a6291ed9b583c1280

SHA256
4f158639aee34af0d467a718749744e6f2dc83630026f07026a24d9cacb43bd0

SHA512
7f19d8c308ed64697f916f2f3403b4e39f983b49794fc9bf8f07528f8a1e7ebb4cf979fe20cba8b4b2126eff06e150a0087a1d25ecb00461070fc5e248fa73e5

Download Submit
/root/.mozilla/firefox/erg28nbs.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
148KB

MD5
dd3f6ba37c670af5953593535e435d04

SHA1
ecfe4e650a050bce77e8ff7468de04c1b8acc9a4

SHA256
5cc6fa137a1f3a7d0b615b178877f12c460b22f95702eb7534d5732ee6599561

SHA512
86e0482543faae6fb279ca71e1e6d6461d32317e74baebb3973e0fde9800107faeb9c2347be6cf8a47556ae43c8e6c224a595e952f621e40ad2c5eba920df2b3

Download Submit
/root/.mozilla/firefox/erg28nbs.default-release/times.json

Filesize
50B

MD5
3d890dbb668d46a13935e9f02243e9a8

SHA1
671d7b48ebfb936a41a4b0300131b331a4df57ef

SHA256
9cc1d078ca55597598fd8ac6ebcd00d5dc2e86b4b6d4044613041f2f65ccc70b

SHA512
55599a4bdc2595a23503f15e3fdaea03ae7657dccf8a7347448154a56ba192c5a592eb0b4ce03c8ab2b6a70a8a31e1b084466c74727ab957b7329b4fa24cde67

Download Submit
/root/.mozilla/firefox/erg28nbs.default-release/times.json

Filesize
47B

MD5
417197b1cb1460d74df9867d09f1a8d6

SHA1
be997f05f665b6b2d22a38270f979af43fb23126

SHA256
c28f6db55683fea7b1c41ddbbfcfb1c489f20e96d97f287fab469b1d634f434f

SHA512
803e1eeb58ae2518f9a6af68ec98de456286496ecb924d601b6d8b4e25e5066415e8ce80b96fdb9cdce55a6dc80303e828cdfeb33baf3756f538db379b636e9a

Download Submit
/root/.mozilla/firefox/installs.ini

Filesize
62B

MD5
380af33736ec9a7cdd5361dc1960a859

SHA1
17dfc9275de005d101977a185f52c7be85c40847

SHA256
13b391bbdb66ba4a7ccd14a4dab5584539ff5ff1f8b1a84abba17b1189f1835b

SHA512
55fab929dcaa2f5e337d0cf7c9981a92a0acee7db3b01309366db56eb6c62510433285275de6a1c301703e50cb64b60aeb29b96de23ba8d58fa07221bd61eef1

Download Submit
/root/.mozilla/firefox/profiles.ini

Filesize
259B

MD5
fcd8f6cab3627c896ed074b8bc088cfc

SHA1
e6f341fbbfb46ccd00a5b2474bd9cc8a15b2345c

SHA256
001c7580dd9804e72e2a5aed6c3e8a7bd88b8d38dc49c98521e924f00e6de29f

SHA512
72be428e5f55e3861e357f5a601be0744d80f8861c2a6c9fc94daf6a277414762620a6638c945e9a035b043807c85577b6371dadc91556eec1a7b49938033aa0

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads