hxxp://steamcommunity[.]com/gift/906353439838

Analysis

max time kernel
9s
max time network
38s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240226-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
28/02/2024, 20:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://steamcommunity.com/gift/906353439838

Score

7^/10

antivm spyware stealer

Malware Config

Signatures

Changes its process name 64 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	glean.dispatche	1660	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1661	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1661	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1661	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1666	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1664	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1662	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1664	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1662	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1666	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1665	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1665	Process not Found
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1663	Process not Found
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1663	Process not Found
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1667	Process not Found
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1667	Process not Found
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1669	Process not Found
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1669	Process not Found
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1671	Process not Found
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1671	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cache2 I/O	1672	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cookie	1673	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cookie	1673	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1674	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1674	Process not Found
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #0	1675	Process not Found
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #1	1676	Process not Found
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1677	Process not Found
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1677	Process not Found
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	1678	Process not Found
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	1678	Process not Found
Changes the process name, possibly in an attempt to hide itself	IndexedDB #1	1679	Process not Found
Changes the process name, possibly in an attempt to hide itself	IndexedDB #1	1679	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC Launch	1682	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC Launch	1682	Process not Found
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	1681	Process not Found
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	1681	Process not Found
Changes the process name, possibly in an attempt to hide itself	Breakpad Server	1680	Process not Found
Changes the process name, possibly in an attempt to hide itself	Sandbox Forked	1683	Process not Found
Changes the process name, possibly in an attempt to hide itself	DOM Worker	1684	Process not Found
Changes the process name, possibly in an attempt to hide itself	DOM Worker	1684	Process not Found
Changes the process name, possibly in an attempt to hide itself	Chroot Helper	1685	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #5	1690	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #5	1690	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #4	1689	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #4	1689	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #3	1688	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #3	1688	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	1687	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	1687	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #6	1691	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #6	1691	Process not Found
Changes the process name, possibly in an attempt to hide itself	MainThread	1683	firefox
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1692	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1692	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1692	Process not Found
Changes the process name, possibly in an attempt to hide itself	FSBroker1683	1693	Process not Found
Changes the process name, possibly in an attempt to hide itself	FSBroker1683	1693	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Process	1683	firefox
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1694	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1694	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1695	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1695	Process not Found
Changes the process name, possibly in an attempt to hide itself	ProfilerChild	1696	Process not Found

Reads user data of web browsers 64 IoCs

Reads stored browser data which can include saved credentials.

spyware stealer

description	ioc	Process
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/cert9.db	Process not Found
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/sessionstore-backups/previous.js	Process not Found
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/prefs.js	firefox
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/sessionCheckpoints.json	Process not Found
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/sessionstore-backups/recovery.js	Process not Found
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/system-extensions	firefox
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/SiteSecurityServiceState.txt	Process not Found
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/sessionstore-backups/recovery.baklz4	Process not Found
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/places.sqlite-journal	firefox
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/cert9.db-journal	firefox
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/favicons.sqlite-wal	firefox
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/storage/ls-archive.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/storage/permanent/chrome	Process not Found
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/pkcs11.txt	firefox
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/extensions	firefox
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/cookies.sqlite	firefox
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/cookies.sqlite-journal	firefox
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/key4.db-journal	firefox
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/search.json.mozlz4	Process not Found
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/storage/permanent/chrome/idb	Process not Found
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/permissions.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/sessionstore-backups/recovery.jsonlz4	Process not Found
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/sessionstore.js	Process not Found
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/sessionstore-backups/previous.jsonlz4	Process not Found
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/sessionstore-backups/recovery.bak	Process not Found
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/storage.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/storage	Process not Found
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/favicons.sqlite	firefox
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/places.sqlite-wal	firefox
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/compatibility.ini	firefox
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/times.json	Process not Found
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/sessionstore.jsonlz4	Process not Found
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/permissions.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release	firefox
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/AlternateServices.txt	Process not Found
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release	Process not Found
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/cert9.db-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/extension-settings.json	Process not Found
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/places.sqlite	firefox
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/extensions.json	Process not Found
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/extension-preferences.json	Process not Found
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/key4.db	Process not Found
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/cookies.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/addons.json	Process not Found
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/shield-preference-experiments.json	Process not Found
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/user.js	firefox
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/cookies.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/storage.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/handlers.json	firefox
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/key4.db	firefox
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/cert_override.txt	firefox
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/content-prefs.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/f8iirqi7.default-release/ExperimentStoreData.json	Process not Found

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc
File opened for reading	/proc/cpuinfo

Reads CPU attributes 1 TTPs 11 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/size	Process not Found
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/size	Process not Found
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq	Process not Found
File opened for reading	/sys/devices/system/cpu/present	Process not Found
File opened for reading	/sys/devices/system/cpu/present	firefox

Enumerates kernel/hardware configuration 1 TTPs 60 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/vendor	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/uevent	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/vendor	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/vendor	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/resource	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/vendor	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/device	Process not Found
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/resource	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/class	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/class	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_vendor	Process not Found
File opened for reading	/sys/devices/system/cpu	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices	Process not Found
File opened for reading	/sys/kernel/security/apparmor/features/dbus/mask	dbus-daemon

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/1564/status	Process not Found
File opened for reading	/proc/self/task/1648/stat	Process not Found
File opened for reading	/proc/self/fd/40	firefox
File opened for reading	/proc/self/fd/45	firefox
File opened for reading	/proc/self/fd/51	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/fd	Process not Found
File opened for reading	/proc/1564/attr/current	Process not Found
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd/49	firefox
File opened for reading	/proc/1767/statm	Process not Found
File opened for reading	/proc/mounts	dbus-daemon
File opened for reading	/proc/self/fd/33	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/task/1822/stat	Process not Found
File opened for reading	/proc/sys/kernel/cap_last_cap	Process not Found
File opened for reading	/proc/1723/cmdline	Process not Found
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/fd/39	firefox
File opened for reading	/proc/filesystems	gvfsd-fuse
File opened for reading	/proc/self/task/1844/stat	Process not Found
File opened for reading	/proc/1767/smaps	Process not Found
File opened for reading	/proc/1789/statm	Process not Found
File opened for reading	/proc/1789/smaps	Process not Found
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd/46	firefox
File opened for reading	/proc/1712/cmdline	Process not Found
File opened for reading	/proc/filesystems	gvfsd
File opened for reading	/proc/self/fd/75	firefox
File opened for reading	/proc/self/fd/43	firefox
File opened for reading	/proc/self/fd/48	firefox
File opened for reading	/proc/filesystems	xdg-document-portal
File opened for reading	/proc/filesystems	xdg-permission-store
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/fd/50	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/1727/cmdline	Process not Found
File opened for reading	/proc/self/fd/66	firefox
File opened for reading	/proc/1819/smaps	Process not Found
File opened for reading	/proc/1708/cmdline	Process not Found
File opened for reading	/proc/self/fd/36	firefox
File opened for reading	/proc/self/fd/42	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/filesystems	xdg-desktop-portal
File opened for reading	/proc/1819/statm	Process not Found
File opened for reading	/proc/1703/cmdline	Process not Found
File opened for reading	/proc/self/fd/76	firefox
File opened for reading	/proc/self/fd/38	firefox
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/fd/31	firefox
File opened for reading	/proc/self/fd/47	firefox
File opened for reading	/proc/self/cgroup	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/filesystems	dbus-daemon
File opened for reading	/proc/self/stat	Process not Found
File opened for reading	/proc/self/mountinfo	Process not Found
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/filesystems	xdg-desktop-portal-gtk
File opened for reading	/proc/self/task/1796/stat	Process not Found
File opened for reading	/proc/filesystems	firefox

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/firefox/.parentlock	firefox

/usr/bin/xdg-open
xdg-open http://steamcommunity.com/gift/906353439838
1⤵
PID:1558
- /usr/bin/dbus-send
  dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
  2⤵
  PID:1559
- - /usr/bin/dbus-launch
    dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
    3⤵
    PID:1560
- /bin/grep
  grep " = \\\"xfce4\\\"\$"
  2⤵
  PID:1566
- /usr/bin/xprop
  xprop -root _DT_SAVE_MODE
  2⤵
  PID:1565
- /bin/grep
  grep -i "^xfce_desktop_window"
  2⤵
  PID:1568
- /usr/bin/xprop
  xprop -root
  2⤵
  PID:1567
- /bin/grep
  grep -q "^Enlightenment"
  2⤵
  PID:1570
- /bin/uname
  uname
  2⤵
  PID:1571
- /bin/grep
  grep -q "^file://"
  2⤵
  PID:1573
- /bin/egrep
  egrep -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1575
- /usr/local/sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1575
- /usr/local/bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1575
- /usr/sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1575
- /usr/bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1575
- /sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1575
- /bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1575
- /usr/bin/xdg-mime
  xdg-mime query default x-scheme-handler/http
  2⤵
  PID:1579
- - /usr/bin/dbus-send
    dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
    3⤵
    PID:1580
  - - /usr/bin/dbus-launch
      dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
      4⤵
      PID:1581
- - /bin/grep
    grep " = \\\"xfce4\\\"\$"
    3⤵
    PID:1583
- - /usr/bin/xprop
    xprop -root _DT_SAVE_MODE
    3⤵
    PID:1582
- - /bin/grep
    grep -i "^xfce_desktop_window"
    3⤵
    PID:1585
- - /usr/bin/xprop
    xprop -root
    3⤵
    PID:1584
- - /bin/grep
    grep -q "^Enlightenment"
    3⤵
    PID:1587
- - /bin/uname
    uname
    3⤵
    PID:1588
- /usr/bin/which
  which firefox
  2⤵
  PID:1634
- /usr/bin/firefox
  /usr/bin/firefox http://steamcommunity.com/gift/906353439838
  2⤵
  PID:1646
- - /usr/bin/which
    which /usr/bin/firefox
    3⤵
    PID:1647
- /usr/lib/firefox/firefox
  /usr/lib/firefox/firefox http://steamcommunity.com/gift/906353439838
  2⤵
  - Reads user data of web browsers
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1646
- - /usr/bin/dbus-launch
    dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
    3⤵
    PID:1659
- - /usr/local/sbin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1700
- - /usr/local/bin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1700
- - /usr/sbin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1700
- - /usr/bin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1700

/usr/bin/dbus-daemon
/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1562

/bin/sed
sed -n "s/\$^[[:alnum:]+\\.-]*\$:.*\$/\\1/p"
1⤵
- Reads runtime system information
PID:1578

/bin/sed
sed "s/:/ /g"
1⤵
PID:1591

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1596

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1595

/usr/bin/head
head -n 1
1⤵
PID:1594

/bin/grep
grep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
1⤵
PID:1593

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1601

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1600

/usr/bin/head
head -n 1
1⤵
PID:1599

/bin/grep
grep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
1⤵
PID:1598

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1606

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1605

/usr/bin/head
head -n 1
1⤵
PID:1604

/bin/grep
grep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
1⤵
PID:1603

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1612

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1611

/usr/bin/head
head -n 1
1⤵
PID:1610

/bin/grep
grep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
1⤵
PID:1608

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1619

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1618

/usr/bin/head
head -n 1
1⤵
PID:1617

/bin/grep
grep "x-scheme-handler/http=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache
1⤵
PID:1616

/bin/sed
sed "s/:/ /g"
1⤵
- Reads runtime system information
PID:1622

/bin/sed
sed -e "s|-|/|"
1⤵
- Reads runtime system information
PID:1625

/bin/sed
sed -e "s|-|/|"
1⤵
- Reads runtime system information
PID:1628

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1633

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1637

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1640

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1645

/usr/bin/lsb_release
/usr/bin/lsb_release -idrc
1⤵
PID:1670

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -parentBuildID 20230522134052 -prefsLen 19257 -prefMapSize 230809 -appDir /usr/lib/firefox/browser "{8dc93538-af5c-426c-ab5d-0f938137f667}" 1646 true socket
1⤵
- Changes its process name
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1683

/usr/libexec/xdg-desktop-portal
/usr/libexec/xdg-desktop-portal
1⤵
- Reads runtime system information
PID:1703

/usr/libexec/xdg-document-portal
/usr/libexec/xdg-document-portal
1⤵
- Reads runtime system information
PID:1708

/usr/libexec/xdg-permission-store
/usr/libexec/xdg-permission-store
1⤵
- Reads runtime system information
PID:1712

/usr/libexec/xdg-desktop-portal-gtk
/usr/libexec/xdg-desktop-portal-gtk
1⤵
- Reads runtime system information
PID:1723

/usr/lib/gvfs/gvfsd
/usr/lib/gvfs/gvfsd
1⤵
- Reads runtime system information
PID:1727

/usr/lib/gvfs/gvfsd-fuse
/usr/lib/gvfs/gvfsd-fuse /root/.gvfs -f -o big_writes
1⤵
- Reads runtime system information
PID:1732

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 21742 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{c9e4d9b7-ad08-4c36-bd84-df460ab02929}" 1646 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1767

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 2 -isForBrowser -prefsLen 21410 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{a652686b-69cd-4f86-8e7c-508e84c054ce}" 1646 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1789

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 3 -isForBrowser -prefsLen 21824 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{0740cf70-7a95-48d1-9e6e-27f4878e4a37}" 1646 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1819

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 4 -isForBrowser -prefsLen 27881 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{6b4424ec-1f13-49e0-a557-50c10a8b0641}" 1646 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1841

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/root/.cache/dconf/user

Filesize
2B

MD5
233a918e720c69424cb9d426c418e012

SHA1
aee0f3fd21afd3411aafb35be196fd62c1729eb2

SHA256
58fe086fe8376a7f83e2774a29fb609cde97ea058d84c931194e2b967b79bef3

SHA512
0f7149f233b858903af466029ffe89f602384d85ed14f562598bab210e0e26d935f4195a654087b8b0af3e1d7f2fd5b7a2ffe2e4241f9380870aa8ee2e491001

Download Submit
/root/.cache/mozilla/firefox/f8iirqi7.default-release/cache2/entries/3D1E19D09F398691ABF62061591970855193B42F

Filesize
13KB

MD5
a977812a68e0690c190b323993afcf06

SHA1
bcb5c4139856c741556f396cc779c384e546ba77

SHA256
f93a702819c18c048fe190ed44fbd4ac88b335cf77a43934350c9357ca6203ea

SHA512
c655c8fd13273a98bbc37104e0e3b0ae34132ce56a2f83745c088eca3d9b3f9351da5f76279cc451fa8b46b43905f76dee57e328cdb31af1699ec0ebcb085d73

Download Submit
/root/.dbus/session-bus/11c67417355f45d397f6be11f62e85a6-0

Filesize
466B

MD5
db0280949f29f89c3a048443d62e7bb7

SHA1
acf73b25c8152c876d5a336b2fdebcf5f4437754

SHA256
66208d8120fbac04045c73f97258a014564152f1a5dbd0e3c748d7d5b9d0c68f

SHA512
b55adf4c3e78d3c50b0d7c8575ee21840e87f924fe097bb8908a83aa383f350c4cb5e097eec231928b9170a85422f53dc5b4d8e174542ba3ba8ebb89d323ee21

Download Submit
/root/.mozilla/firefox/78a1puh1.default/times.json

Filesize
47B

MD5
53fcb63e0a4eafe4092a4e96329cbcf0

SHA1
de43cad30579ae69d3ef596aa948b6c42cb0dffa

SHA256
f443f26fdcca0d33e668039249bb0cdd7c5d723e493ffdef51313a5925a6709c

SHA512
519f468dccd76b223ff5284ff3533e1b3d7a49a0c314f05c367e872d646e6ec2690bda3c6d551dea42162481e0c14ae14c57a1ef147c8ee951974af4154f3fb5

Download Submit
/root/.mozilla/firefox/Crash Reports/InstallTime20230522134052

Filesize
10B

MD5
21c5bc4f2a0331d8e48dc79c5c97f50e

SHA1
f74cde2f15662ed3b8286be7404df838dfecea8e

SHA256
1e1d050b115f6dc3ef571315b352f645360ad3dc0f01e0f2cac287c55237b83f

SHA512
a130317e6583f3ca0e94dbbc548c7cc78216f717ab93c5da182b8674fe649ac5b152731513b0b9cc6038ca4321bb07989660287d3e9aca45a22400bd9da2c8ea

Download Submit
/root/.mozilla/firefox/f8iirqi7.default-release/cert9.db

Filesize
224KB

MD5
8da8a2b46688a0095a7e0fe98cdab46f

SHA1
40608b61a98eb481938ced4f2630afbbee72d0cb

SHA256
21988ee1e5758e79832ef1a46868e0113f2be6027128bcb2a9ff6352363a7f32

SHA512
d4246fcaae3159dfe47516d43864a80b8e5b3167843dafda20279e33e1bb58fc97226c6509c61d1667b50df08c889d71bddf3142682a8e9fbc6462d66b154c1c

Download Submit
/root/.mozilla/firefox/f8iirqi7.default-release/cert9.db

Filesize
224KB

MD5
3478c5c96fd20e1ab231a23f5cd6b33a

SHA1
9f4b12eea79022a8b6e15e86e0f43a0368a24b2d

SHA256
9d2ebcae7ffc1ac743e16137899e660691f5314e393cec8959ce884c163e0bd0

SHA512
b7da157669914f0ec181a1208f72a900747ecaa0ec9cf09ec214275e72e2a8ba31fed29a850f50bd9af3da21a7b6fb5d71c7678e01c01a83242e7078e0c11906

Download Submit
/root/.mozilla/firefox/f8iirqi7.default-release/cert9.db

Filesize
224KB

MD5
22d420f62d26d8e77c427888d009b2f9

SHA1
ae561f07498d65741a2b764c0ab1b0517d236115

SHA256
166daeecdd92fbc4343e44bf15af068bb3367a8083c7ae12416d73320cc02ef5

SHA512
6643a0178491396d8d3114af900746cd4eeda02215055af846fd38a7e5b59064de026a1c3430ba1f242898ce713c2794fac4a3bff6dee530fb5e6054c194c691

Download Submit
/root/.mozilla/firefox/f8iirqi7.default-release/compatibility.ini

Filesize
163B

MD5
fe452b7294d5928a9a5863b89ee0a6bd

SHA1
a5d4c245071fa96476ba48b4725bdae7f1b7940f

SHA256
d5bfb07561606a19aa96557ea109b175050dc0eb805cbef9c813503587d77900

SHA512
dc37d8507f08849e3382d2dbafd4a64555dbd57a288c95131e9aefb366630f1585811a9e1456b861bb9d2b816ed88b18ffb7580cd92b41bb9b0227ce1363843e

Download Submit
/root/.mozilla/firefox/f8iirqi7.default-release/cookies.sqlite

Filesize
96KB

MD5
9535f5fe817accc769c2c1d3354db39f

SHA1
6af62cf08717cf3bfa84eb1a7b311acf522ce560

SHA256
c53c15fcfac2bb57fdc88d23f932fc244dbaf4020f0f6eaecf0f77a37c21f8c5

SHA512
dc9c2c32eb42dda0a7a711e143aea58c603c1e9d885c3677e9fe86f525e1b0b32a46e240756263e56510b07e764ba69f2de13b90ec18210678242e10cfe17837

Download Submit
/root/.mozilla/firefox/f8iirqi7.default-release/cookies.sqlite

Filesize
96KB

MD5
5caa766855d5613a999f71b7812d6451

SHA1
ad0d9a52a0d5cc7f11858301dbe47377ed99ee37

SHA256
3a8ce2b07e3e8678a13aa58ef5b942c4dccd8f9c84511bdeb8847ef270797e27

SHA512
17bb0f4c87ec178910795b25ce85e74cf599190c769592472c3e872f42930c93f28faf0ff3e448816a9abcc8af0459852bed52bee08cfe25d068879c6dfd8eba

Download Submit
/root/.mozilla/firefox/f8iirqi7.default-release/favicons.sqlite

Filesize
224KB

MD5
3c0a1ec298284608bfa51081ea539be3

SHA1
e51b58f6fe89d45fd8a1d935b51da172d5f6f32e

SHA256
34c4fe7ab2d3e44f193b489ebe84c17d67b336546af9ef231897ec09d7ff16f2

SHA512
8550f530377f7a98c46a6989bec2c43ed644274509a5b987e8e0d034bf867b3315dcc75a2c851a5ac43a45b40bf51c789d828a9a69c02157b3e900467341a28f

Download Submit
/root/.mozilla/firefox/f8iirqi7.default-release/key4.db

Filesize
288KB

MD5
126734363f7a96058e1a16a4024471e6

SHA1
7655d560026aa5edc315828e59f6a1dbcc8eee32

SHA256
77481c2d60186d7901243bf120aea61886e3473e94aa8e65b0346fdf63dfab5d

SHA512
b262dffcf95c9c4bce2881a073a16d807fcebdcc9d62467a4e011202bb9e2d6407474753606b8f40f4654ddafa4381ef349490e671ff9de461a9483171909315

Download Submit
/root/.mozilla/firefox/f8iirqi7.default-release/permissions.sqlite

Filesize
96KB

MD5
232fbc22dd03a8ec41edde02bdbea61c

SHA1
6ab4b39bca95418c52f7f861fd39e5fddb9cc7b6

SHA256
d88bf367aaf79efbb2e8fbdb1dc5bde1c1c3a53e0f4d8188027a63ec55d5f5f0

SHA512
055f1595f4a327347671db53cec8d89a310109d3f871c567e3d5b654b956fc0369d12437f7dc6d9327b973008f1327ee0dfdb5504f1b3cbe00da29941b1e5892

Download Submit
/root/.mozilla/firefox/f8iirqi7.default-release/places.sqlite

Filesize
1.3MB

MD5
ecbbdd20cbde4c0fb7028b84ee4fb0fc

SHA1
591eba0d8cf2ac77293c060b1cb47345b5ab549f

SHA256
1d6c8781429065260f1368a637622c090fadcfd88cd8663b036ffb2f9b0e71a9

SHA512
c82132d35c1ff67d2f90b3c691c75f8151ac415ba3aea83836eeefacaa62379a1baf9656d4e59729b1c1d5b85f3546a283ff1bf11854fea0a52d7da5625b692d

Download Submit
/root/.mozilla/firefox/f8iirqi7.default-release/prefs-1.js

Filesize
1KB

MD5
d72ac10b2ae043ba10cf9dd2e80d0b5a

SHA1
348d9340ca46ac2de98b294afda4dd51660d79d2

SHA256
c96c49311b9d6edc0dc90d8dbe6d0a85e45e85cae55ab59f3757e9374b8f7e45

SHA512
4d3cab508e92dd9ed025fa901ae18e5b0739ae2e246cc0677bf1097ea32f03717911853c9c8c15e4105cb6aef8399b459ea43f1562a3975d8e7aa796c5b886b2

Download Submit
/root/.mozilla/firefox/f8iirqi7.default-release/prefs-1.js

Filesize
1KB

MD5
5557236843253d159b302807d28905ac

SHA1
c1b758a4853fa1d51e24b06b5deb849c9453f9eb

SHA256
a52091e61a55ca8437ac0878f0b9533411d7be23915c5c7b1cd6ccf79289182c

SHA512
0de766322a8d358166f3868999ad7bb0b86a472d3650254c13b14b13a6da3142e620897d508614c157af4c7c0cb21891a6f6a5c8886f83ad3a2117f57d0d24d1

Download Submit
/root/.mozilla/firefox/f8iirqi7.default-release/prefs-1.js

Filesize
2KB

MD5
72cc12c09c201dd4dafa96a9d383e730

SHA1
1d28b5156d240387930cb7e092bd6a25ba51d696

SHA256
37e544d7ad5afaa729bab85eb074bb5240163efc83beda72619630466a169a2d

SHA512
e3686596bc80f7244383329c8fc40b67679b2d0e5ab506ef686bfdceca3a1d5be647d72da9cb943829d26383737b573ef1023656352bcffbae9398e63f674db4

Download Submit
/root/.mozilla/firefox/f8iirqi7.default-release/prefs-1.js

Filesize
2KB

MD5
1179b096bac1fc5c19cdcb796eed319e

SHA1
6ac8e6b5a32ed5c4fdc0c49101a394b7672f5f79

SHA256
777c4e236d8f67e81aafab663c8d3b89649a5ae8a4051a25370644ec42ae5620

SHA512
0e64a3e0a1c121a5a62955dbf2690988eefd5062d9c9193f9e2745cd3107b2b1960703bfd362395299a9a2ed50674b038b9e111d9ef8f7d048c193a78ae1683b

Download Submit
/root/.mozilla/firefox/f8iirqi7.default-release/prefs-1.js

Filesize
2KB

MD5
487c7090abed2756182014d8a2c80103

SHA1
0481aedd57146f0a49f4c3993395864295bd0368

SHA256
7a9b45d18cc08a9c25b083c8feda9e8e32cb502d3088d329783dcbb1f774d762

SHA512
d36c7f5bab5f2c726b6f31290900180becfaf81cb73bc1a88513ad6541582375a8a93ab110ae86bb82e5d9cb5f7ec09ecd7231a0d7bd4813b59a791f3be9c2c2

Download Submit
/root/.mozilla/firefox/f8iirqi7.default-release/prefs-1.js

Filesize
3KB

MD5
c8547a1a54e2094d23a0c83539d12ba2

SHA1
f5f1ac45d2c83d2a8162f0f52cdbfc1745a0a94e

SHA256
8dfcbddab298deef34a992cfe00000be0e30c50e8812e0de6942a657c22c73d7

SHA512
cdface41b3f2b3b9548da0ea052b60efc4afc1b6b1e1108c65a34833638881c9a1eac51bb727561dc7a2e123e0dc6b3f560fd159716858714c0ff634ce0c8d2d

Download Submit
/root/.mozilla/firefox/f8iirqi7.default-release/prefs-1.js

Filesize
4KB

MD5
20d02288065968376e165e0bce05ce26

SHA1
8bcd96078ed39c6f86c1c401d406ac3ba36900e0

SHA256
45fdd05cc628eef0e3bc38367864208610b46fd93dc841eef9d529a88c82cb59

SHA512
13bd8e79f8b9ea609ac93868ef6ec55b6f99a216c4c2959b7f88520f16e62ee6298527c94cef23741201980561018646347aef4fbfb968c9fc7ed44ba37f51b2

Download Submit
/root/.mozilla/firefox/f8iirqi7.default-release/prefs.js

Filesize
776B

MD5
62cbcb6b730a3d2562cf30a3c78c4148

SHA1
3ef4fe27526353aa9721ee24d6ce8b1c41d81662

SHA256
46a689c06eda852bda8219f3d0d50bf4e59017bbd20aae191bf80324df5ae650

SHA512
e37bb476de48a4b6fbe2fbdaf1306a9c0611c13f4b817eb61d96be4abed53ad14c1849fdff7fc47d4976ddde5540d622a4a1598ada626d68717dbe47b99ac988

Download Submit
/root/.mozilla/firefox/f8iirqi7.default-release/storage/ls-archive.sqlite

Filesize
96KB

MD5
e0c613bfd69956a19ce2dc5e925aa223

SHA1
14accb230edcd6cb76967cdc6d4e5686db96b5df

SHA256
0d4cb11f6364c46a75f9eaddfca5c660b90dfd515df3afcd5e0baeca28a0f1ab

SHA512
01643c0131a392be92b3f281d7f633c1f502bff19090b0d716f1ac66aefecc3fcf92f393bef66b03089c9b9c6d8aaeb711b6a4f29d5a6729dd188c838f2272d1

Download Submit
/root/.mozilla/firefox/f8iirqi7.default-release/storage/ls-archive.sqlite

Filesize
128KB

MD5
178d71e5529d637ac62f7e75fdd75896

SHA1
339f2b949cc4c207b66aea11137448ba28d36dcb

SHA256
7b0050f1bfaab85c8f9067ae7d7369056ff752c0c852ef1462a96c22169004d4

SHA512
ec0e0105fcfbbae356dd55efbcf92975f35bbe5cb93fcabf4c08443e871957635d14830b27c4e1ddefbbaff8f9b7ec3590bf417a9442e1d7ee3607d14d56f664

Download Submit
/root/.mozilla/firefox/f8iirqi7.default-release/storage/permanent/chrome/.metadata-v2-tmp

Filesize
42B

MD5
034d0b1af4f0fa516ab569923fe1d00c

SHA1
bf40124c99805ac6ed8e8da39885f22b88ebf010

SHA256
9a1fdd065b2367f8f304ed2111f383e15716dd58eafd76db20bd10cced8c5ba2

SHA512
b3260334312862b337a676831f07a7d0d14a02c37380d28b361d2a94ca23a0a690200e1275d1d5af859686315a274372096726cb67f7a9d197e32ee466322843

Download Submit
/root/.mozilla/firefox/f8iirqi7.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite

Filesize
44KB

MD5
a8dd7ebaad5528b23f82ccb1534cea18

SHA1
600daceacfb5cf9df0b66ba7dce4516b2ac4df70

SHA256
e5b0d02c18ae36c4a220f41fd97c66060c17aaafcbb324a57ccdc2707c44c4ec

SHA512
67f867a8e2b37fb6bececd5ebc570ca594ea329142badd63d1281d5e735f515a5e329abc6eb9a9d3465aab0a08541b4888018d859964f160a52345ab93532bff

Download Submit
/root/.mozilla/firefox/f8iirqi7.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite

Filesize
12KB

MD5
ab428103e9a98f738031a8dbb26feb9c

SHA1
38f45bbf93bee7498017f3a3ef9a1ef54895b5b4

SHA256
49904965ef4137f2163ac3188d25b3efd6ed73d859a9a21b5cdc75bea268ea5c

SHA512
27bf574de8e19c860b2053caa7fee439dca2f480eb9b59e5d25ac02e30a345032529f1c5e4f482a03fc8b7f8935f44b52a0ae46a625357b05de44692443e92dd

Download Submit
/root/.mozilla/firefox/f8iirqi7.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite

Filesize
44KB

MD5
7352c8848e88edc39b7fb5e663888187

SHA1
8c3dffe25cc56c7aec1b782292d6fceed81e6304

SHA256
7a462086a26978809c719e57a7ea6a25568767fb7532014e8531fda94b660e0a

SHA512
f2a0dbbab5c2c1702b03bce15a47739481f523e127d1372b40534db9a20b2bc99fb53710ee0e5d44176188817cac704cf4f98cdf087e7e89d244281fcfc3b280

Download Submit
/root/.mozilla/firefox/f8iirqi7.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite

Filesize
12KB

MD5
d31bee3792c8d95c7fba2937d64cfbe3

SHA1
a35ae700a50b2e1a04226123ca622173beecfa80

SHA256
de570057e45a182854c0f3e9c7cfb02f55909e1006b5917de56b0232d3b75618

SHA512
ad3e01c11e9945cb0c0fe5c260c8fdec915f45da51729c4e4c79814f691452018b675b096bc3978037477e0e04188feee8124dffc042fb7f86a6c3ee2c87071c

Download Submit
/root/.mozilla/firefox/f8iirqi7.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite

Filesize
44KB

MD5
759544297aaa61f5fef8ee42d0ae4393

SHA1
fc2d66f6e60409e3e8d38623ce5f817fc7f571e0

SHA256
1bd2000cd972e80cefaec6e982ba261d224a818f367de0fdf8c51fa5a05d7ab5

SHA512
8aaa2ce66f10d46f7c9200af841ac7bd9f5b55c30308a14f0deda44ac62581c45daae45154487c0073a0d5847d5926cbb4072ca64a702ac6b834ad0bb482804f

Download Submit
/root/.mozilla/firefox/f8iirqi7.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite

Filesize
12KB

MD5
de2de44f24fe7c5d38f73cb6179bec2c

SHA1
d7a343b59f165ddf2667086e615e38828d7bd370

SHA256
d2525e4e8806939785e629293124500f9bf2f871145de36876d3a33100432cf6

SHA512
7372d8ac9c4dd1c765e13420d9272768412c2a23133f5a097e435511f737765bb717e1a98653cfbb7f7b20d7bda6fe0239eea850da2c97b2abfeee8b70f9e9ad

Download Submit
/root/.mozilla/firefox/f8iirqi7.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite

Filesize
16KB

MD5
7fb1003ecb6fba276e2ad9b1c1a92c07

SHA1
1b050c7e9dc7e3e6dd25b538b32d5b85eb2aebdf

SHA256
323d07f0845d665a2f1b7690f91b064479b57e880c7e34f7c3ef07420f177160

SHA512
0ac4c3511a527ce8e6d0422b5764e27b29777807867f7d923e426d891d7cd2709c05a4b2eda5da312df45c0b579c8c6d33b7629d1259e47b1031ab0537fbd637

Download Submit
/root/.mozilla/firefox/f8iirqi7.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
44KB

MD5
07a412e08825220262ad2890757ff779

SHA1
f46c127dbc070ded87a6078b3c1c761955f96de8

SHA256
da640f8b665841b520d2262a21cc3f82aeaa881cf81a1ddae27ef501d66544e4

SHA512
0134c783bf3293848e479b478ac57a1e0f4202cddfb8b57bc6275aada7345f398cf8a627e9b1c34fd618192c2f0c9737b1da487daf33f9c557ebc1377105582b

Download Submit
/root/.mozilla/firefox/f8iirqi7.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
12KB

MD5
92366a0a4d3bab4bd7b6b266fe893c39

SHA1
21a981c3d09ec6d999db8bfd59bf5d61902f457a

SHA256
27ec5107f9716ea7c1d638d6e74623e3f916e7684bd1becce90e08cd97709e22

SHA512
854044c7899d9633139b45c22b321b0b5f29d26a199427aea26ad88e222db4fbccbf1e1ec236fb4208371bef7ec189b29091526f3cea787d5bd9806f4accaf34

Download Submit
/root/.mozilla/firefox/f8iirqi7.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
164KB

MD5
baebd4815b80e5405c8f1ed059830ad7

SHA1
3c200a720fb73e6adcfdb240a5aeb8cbd747c476

SHA256
29b03e486cab0b42b272462146e91321c4dc264863a3a03c9046061c6ef64d41

SHA512
869ae77c8d034e7333eaf9ce75e5b482e78d399198350c706f083f4173763b0997d657f44159c3a3b4794d636bcbb94127f82cf9bbd310c9e594bfd8290323aa

Download Submit
/root/.mozilla/firefox/f8iirqi7.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
148KB

MD5
dd3f6ba37c670af5953593535e435d04

SHA1
ecfe4e650a050bce77e8ff7468de04c1b8acc9a4

SHA256
5cc6fa137a1f3a7d0b615b178877f12c460b22f95702eb7534d5732ee6599561

SHA512
86e0482543faae6fb279ca71e1e6d6461d32317e74baebb3973e0fde9800107faeb9c2347be6cf8a47556ae43c8e6c224a595e952f621e40ad2c5eba920df2b3

Download Submit
/root/.mozilla/firefox/f8iirqi7.default-release/times.json

Filesize
50B

MD5
87868b4a60a02fd17992f33fae13a9bd

SHA1
a5a006010c8fcf5debc2fcbe82ca31ad5b0ff629

SHA256
9a537707e7f97db19f413b5dcefd546a309b285fc0f996c97d703f774ec82d8e

SHA512
fa8f34ddd2f955f3aea577662c7a173119b30d21f27542118930eccb2151ca79c1ebfbdb834c21bf5540b053a4e8aa595058553572d1168fce8a1a691225d741

Download Submit
/root/.mozilla/firefox/f8iirqi7.default-release/times.json

Filesize
47B

MD5
f20007d9284dae12fcd6f09c4b984779

SHA1
a9ccfa4ed3d654752bbd71cb72df74b9fe821f4b

SHA256
e38b84ce9d37749335bf48ffbee150af8975f826d50f329bd016a228a4940e9f

SHA512
88e5ffe00a1a55c76dc967dc7bd127c9b249c5de6d621df6a9664aad1f0a3fec7c3fa0c90bb2873ac1f1f91d7d56f73749ea02fc1692d6dd7afa851b5bcb27c3

Download Submit
/root/.mozilla/firefox/installs.ini

Filesize
62B

MD5
cc2c031ff991c67900dd8bee331657d7

SHA1
21c063481027ff0495658a14b26458637c09a8bd

SHA256
688240f533bc91f8581fa315b4362e3b0a1cfb0c96a1c4d5b47b801bad0c2429

SHA512
797008485710cd444a3e27dd7ec526ea8f003a1b853ced4955d7f8fd162319fd0884e14c3705575ab19bb36747745ad4403d237da0253ccdfb456f335d3785d6

Download Submit
/root/.mozilla/firefox/profiles.ini

Filesize
259B

MD5
64c5cd73b1efed7c2e28c7777d4b952e

SHA1
a96ed635f2d7ce0fa3289f46c5bfd5c91f45c1d9

SHA256
fa91df15039c10da337bcf1a32a37801de495ed71055084487fc7d1fa3746dda

SHA512
367f10b5c5494b3cd8ada8c4be2d7d7e3f301ee3e91757385e5d26ade605793ef234b9bba76d8b8403f9d4d7b8959241aa465f92f6fe407ff8f126e19add0b98

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads