hxxps://en[.]wikipedia[.]org/wiki/HAL_9000/unit10

Analysis

max time kernel
3s
max time network
50s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240226-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
08/03/2024, 22:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://en.wikipedia.org/wiki/HAL_9000/unit10

Score

7^/10

antivm spyware stealer

Malware Config

Signatures

Changes its process name 64 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1688	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1688	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1688	Process not Found
Changes the process name, possibly in an attempt to hide itself	glean.dispatche	1687	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1693	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1693	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1692	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1692	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1691	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1691	Process not Found
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1690	Process not Found
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1690	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1689	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1689	Process not Found
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1694	Process not Found
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1694	Process not Found
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1696	Process not Found
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1696	Process not Found
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1698	Process not Found
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1698	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cache2 I/O	1699	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cookie	1700	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cookie	1700	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1701	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1701	Process not Found
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #1	1703	Process not Found
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #0	1702	Process not Found
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1704	Process not Found
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1704	Process not Found
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	1705	Process not Found
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	1705	Process not Found
Changes the process name, possibly in an attempt to hide itself	IndexedDB #1	1706	Process not Found
Changes the process name, possibly in an attempt to hide itself	IndexedDB #1	1706	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC Launch	1709	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC Launch	1709	Process not Found
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	1708	Process not Found
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	1708	Process not Found
Changes the process name, possibly in an attempt to hide itself	Breakpad Server	1707	Process not Found
Changes the process name, possibly in an attempt to hide itself	Sandbox Forked	1710	Process not Found
Changes the process name, possibly in an attempt to hide itself	DOM Worker	1711	Process not Found
Changes the process name, possibly in an attempt to hide itself	DOM Worker	1711	Process not Found
Changes the process name, possibly in an attempt to hide itself	Chroot Helper	1712	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #5	1717	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #5	1717	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #4	1716	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #4	1716	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #3	1715	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #3	1715	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	1714	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	1714	Process not Found
Changes the process name, possibly in an attempt to hide itself	MainThread	1710	firefox
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1718	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1718	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1718	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Process	1710	firefox
Changes the process name, possibly in an attempt to hide itself	FSBroker1710	1719	Process not Found
Changes the process name, possibly in an attempt to hide itself	FSBroker1710	1719	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1720	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1720	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1721	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1721	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1723	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1723	Process not Found
Changes the process name, possibly in an attempt to hide itself	ProfilerChild	1722	Process not Found

Reads user data of web browsers 64 IoCs

Reads stored browser data which can include saved credentials.

spyware stealer

description	ioc	Process
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/extensions.json	Process not Found
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/storage.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/storage/permanent/chrome	Process not Found
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/permissions.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/system-extensions	firefox
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/cookies.sqlite	firefox
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/sessionstore-backups/recovery.baklz4	Process not Found
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/sessionstore-backups/recovery.jsonlz4	Process not Found
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release	firefox
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/sessionstore.js	Process not Found
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/extensions	firefox
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/addons.json	Process not Found
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/key4.db	firefox
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/cert_override.txt	firefox
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/key4.db	Process not Found
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/compatibility.ini	firefox
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/user.js	firefox
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/sessionstore.jsonlz4	Process not Found
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/cert9.db	firefox
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/sessionstore-backups/previous.jsonlz4	Process not Found
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/sessionstore-backups/previous.js	Process not Found
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/cookies.sqlite-journal	firefox
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/extension-preferences.json	Process not Found
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/xulstore.json	firefox
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/cert9.db-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/times.json	Process not Found
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/storage/ls-archive.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/cert9.db-journal	firefox
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/AlternateServices.txt	Process not Found
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/shield-preference-experiments.json	Process not Found
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/search.json.mozlz4	Process not Found
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/storage/ls-archive.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/ClientAuthRememberList.txt	Process not Found
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/sessionstore-backups/recovery.bak	Process not Found
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/sessionstore-backups/recovery.js	Process not Found
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/cookies.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/cookies.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release	Process not Found
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/addonStartup.json.lz4	firefox
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/permissions.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/SiteSecurityServiceState.txt	Process not Found
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/storage/permanent/chrome/idb	Process not Found
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/sessionCheckpoints.json	Process not Found
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/handlers.json	firefox
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/pkcs11.txt	firefox
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/content-prefs.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/content-prefs.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/prefs.js	firefox
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/storage.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/storage	Process not Found
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/key4.db-journal	firefox
File opened for reading	/root/.mozilla/firefox/xse252h2.default-release/cert9.db	Process not Found

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc
File opened for reading	/proc/cpuinfo

Reads CPU attributes 1 TTPs 11 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq	Process not Found
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/size	Process not Found
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/size	Process not Found
File opened for reading	/sys/devices/system/cpu/present	Process not Found

Enumerates kernel/hardware configuration 1 TTPs 60 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/vendor	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/resource	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/irq	Process not Found
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	firefox
File opened for reading	/sys/devices/system/cpu	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/irq	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/irq	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/class	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/vendor	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/device	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/class	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/irq	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/uevent	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_device	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/device	Process not Found
File opened for reading	/sys/kernel/security/apparmor/features/dbus/mask	dbus-daemon
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/vendor	Process not Found

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/1758/cmdline	Process not Found
File opened for reading	/proc/mounts	dbus-daemon
File opened for reading	/proc/1591/attr/current	Process not Found
File opened for reading	/proc/self/fd/48	firefox
File opened for reading	/proc/1749/cmdline	Process not Found
File opened for reading	/proc/self/task/1849/stat	Process not Found
File opened for reading	/proc/sys/kernel/cap_last_cap	Process not Found
File opened for reading	/proc/self/cgroup	firefox
File opened for reading	/proc/self/fd/75	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd/40	firefox
File opened for reading	/proc/self/fd/6	firefox
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/task/1683/stat	Process not Found
File opened for reading	/proc/filesystems	xdg-desktop-portal
File opened for reading	/proc/1729/cmdline	Process not Found
File opened for reading	/proc/1586/cmdline	Process not Found
File opened for reading	/proc/filesystems	xdg-document-portal
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/fd/35	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/1784/statm	Process not Found
File opened for reading	/proc/self/fd/106	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/filesystems	dbus-daemon
File opened for reading	/proc/1591/status	Process not Found
File opened for reading	/proc/self/mountinfo	firefox
File opened for reading	/proc/self/fd/49	firefox
File opened for reading	/proc/1738/cmdline	Process not Found
File opened for reading	/proc/self/fd/77	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/1784/smaps	Process not Found
File opened for reading	/proc/self/fd/45	firefox
File opened for reading	/proc/self/fd/51	firefox
File opened for reading	/proc/filesystems	xdg-desktop-portal-gtk
File opened for reading	/proc/filesystems	gvfsd
File opened for reading	/proc/self/task/1713/stat	Process not Found
File opened for reading	/proc/self/task/1790/stat	Process not Found
File opened for reading	/proc/self/task/1868/stat	Process not Found
File opened for reading	/proc/1681/cmdline	Process not Found
File opened for reading	/proc/self/fd/41	firefox
File opened for reading	/proc/self/fd/42	firefox
File opened for reading	/proc/self/fd/47	firefox
File opened for reading	/proc/1806/smaps	Process not Found
File opened for reading	/proc/self/fd/46	firefox
File opened for reading	/proc/1753/cmdline	Process not Found
File opened for reading	/proc/self/task/1813/stat	Process not Found
File opened for reading	/proc/1806/statm	Process not Found
File opened for reading	/proc/self/fd/34	firefox
File opened for reading	/proc/1734/cmdline	Process not Found
File opened for reading	/proc/filesystems	gvfsd-fuse
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/fd/29	firefox
File opened for reading	/proc/self/fd/43	firefox
File opened for reading	/proc/1607/cmdline	Process not Found
File opened for reading	/proc/self/stat	Process not Found
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/mountinfo	Process not Found
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/fd/50	firefox
File opened for reading	/proc/self/fd/39	firefox

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/firefox/.parentlock	firefox

/usr/bin/xdg-open
xdg-open https://en.wikipedia.org/wiki/HAL_9000/unit10
1⤵
PID:1585
- /usr/bin/dbus-send
  dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
  2⤵
  PID:1586
- - /usr/bin/dbus-launch
    dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
    3⤵
    PID:1587
- /bin/grep
  grep " = \\\"xfce4\\\"\$"
  2⤵
  PID:1593
- /usr/bin/xprop
  xprop -root _DT_SAVE_MODE
  2⤵
  PID:1592
- /bin/grep
  grep -i "^xfce_desktop_window"
  2⤵
  PID:1595
- /usr/bin/xprop
  xprop -root
  2⤵
  PID:1594
- /bin/grep
  grep -q "^Enlightenment"
  2⤵
  PID:1597
- /bin/uname
  uname
  2⤵
  PID:1598
- /bin/grep
  grep -q "^file://"
  2⤵
  PID:1600
- /bin/egrep
  egrep -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1602
- /usr/local/sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1602
- /usr/local/bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1602
- /usr/sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1602
- /usr/bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1602
- /sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1602
- /bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1602
- /usr/bin/xdg-mime
  xdg-mime query default x-scheme-handler/https
  2⤵
  PID:1606
- - /usr/bin/dbus-send
    dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
    3⤵
    PID:1607
  - - /usr/bin/dbus-launch
      dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
      4⤵
      PID:1608
- - /bin/grep
    grep " = \\\"xfce4\\\"\$"
    3⤵
    PID:1612
- - /usr/bin/xprop
    xprop -root _DT_SAVE_MODE
    3⤵
    PID:1611
- - /bin/grep
    grep -i "^xfce_desktop_window"
    3⤵
    PID:1614
- - /usr/bin/xprop
    xprop -root
    3⤵
    PID:1613
- - /bin/grep
    grep -q "^Enlightenment"
    3⤵
    PID:1619
- - /bin/uname
    uname
    3⤵
    PID:1620
- /usr/bin/which
  which firefox
  2⤵
  PID:1666
- /usr/bin/firefox
  /usr/bin/firefox https://en.wikipedia.org/wiki/HAL_9000/unit10
  2⤵
  PID:1681
- - /usr/bin/which
    which /usr/bin/firefox
    3⤵
    PID:1682
- /usr/lib/firefox/firefox
  /usr/lib/firefox/firefox https://en.wikipedia.org/wiki/HAL_9000/unit10
  2⤵
  - Reads user data of web browsers
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1681
- - /usr/bin/dbus-launch
    dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
    3⤵
    PID:1686
- - /usr/local/sbin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1726
- - /usr/local/bin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1726
- - /usr/sbin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1726
- - /usr/bin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1726

/usr/bin/dbus-daemon
/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1589

/bin/sed
sed -n "s/\$^[[:alnum:]+\\.-]*\$:.*\$/\\1/p"
1⤵
- Reads runtime system information
PID:1605

/bin/sed
sed "s/:/ /g"
1⤵
- Reads runtime system information
PID:1623

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1628

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1627

/usr/bin/head
head -n 1
1⤵
PID:1626

/bin/grep
grep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
1⤵
PID:1625

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1633

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1632

/usr/bin/head
head -n 1
1⤵
PID:1631

/bin/grep
grep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
1⤵
PID:1630

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1638

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1637

/usr/bin/head
head -n 1
1⤵
PID:1636

/bin/grep
grep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
1⤵
PID:1635

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1645

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1644

/usr/bin/head
head -n 1
1⤵
PID:1643

/bin/grep
grep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
1⤵
PID:1642

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1650

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1649

/usr/bin/head
head -n 1
1⤵
PID:1648

/bin/grep
grep "x-scheme-handler/https=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache
1⤵
PID:1647

/bin/sed
sed "s/:/ /g"
1⤵
- Reads runtime system information
PID:1653

/bin/sed
sed -e "s|-|/|"
1⤵
PID:1656

/bin/sed
sed -e "s|-|/|"
1⤵
- Reads runtime system information
PID:1659

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1665

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1669

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1672

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1680

/usr/bin/lsb_release
/usr/bin/lsb_release -idrc
1⤵
PID:1697

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -parentBuildID 20230522134052 -prefsLen 19257 -prefMapSize 230809 -appDir /usr/lib/firefox/browser "{9064bb66-3537-4903-b96d-fc93d34137d0}" 1681 true socket
1⤵
- Changes its process name
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1710

/usr/libexec/xdg-desktop-portal
/usr/libexec/xdg-desktop-portal
1⤵
- Reads runtime system information
PID:1729

/usr/libexec/xdg-document-portal
/usr/libexec/xdg-document-portal
1⤵
- Reads runtime system information
PID:1734

/usr/libexec/xdg-permission-store
/usr/libexec/xdg-permission-store
1⤵
PID:1738

/usr/libexec/xdg-desktop-portal-gtk
/usr/libexec/xdg-desktop-portal-gtk
1⤵
- Reads runtime system information
PID:1749

/usr/lib/gvfs/gvfsd
/usr/lib/gvfs/gvfsd
1⤵
- Reads runtime system information
PID:1753

/usr/lib/gvfs/gvfsd-fuse
/usr/lib/gvfs/gvfsd-fuse /root/.gvfs -f -o big_writes
1⤵
- Reads runtime system information
PID:1758

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 21750 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{a1656626-cbc9-4694-8a27-0ec57c00e9f0}" 1681 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1784

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 2 -isForBrowser -prefsLen 21418 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{dc235e14-928c-4e02-93ad-2bbfc76aa8e2}" 1681 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1806

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 3 -isForBrowser -prefsLen 21767 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{f08d73c8-9088-48f5-b537-0ba0a3b0f017}" 1681 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1846

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 4 -isForBrowser -prefsLen 27824 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{82d0d48d-5cff-4449-ad9e-fa960f95b0cf}" 1681 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/root/.cache/dconf/user

Filesize
2B

MD5
56f25ea3b3e30b9bef21aafa2abce374

SHA1
aa017174bc4ebe4eb33bb8cfb7d3020fd58afd6b

SHA256
a96fe66c56d3260e6203d8389086e84b06d36c719f27ce3cbd94d6a84084dd4f

SHA512
68fbd959e6b43b9ec30978dd65382343d23be402d64fa46e53efd047a2f673e5bffa8084566e9e924b8f8857c63cf6bdd5bf48f749849063ae54d95546724c34

Download Submit
/root/.dbus/session-bus/11c67417355f45d397f6be11f62e85a6-0

Filesize
466B

MD5
cda5159368b646f410a880adf89d6120

SHA1
2d16892b7b28b0e50c4f0905eae130d9433a06be

SHA256
7d373eb5e0ab7786e70e6565d88e05cc1aab16ddc372a955e8a5b19edab6c0b5

SHA512
04fc7bd2f20c0c239dbe3716c81cc1c3d25e8865c42abd46d0442fb359a6ea67caedd1dc4a381f989b25eb3f35a64809b500afb8fe84b195071e9357040af771

Download Submit
/root/.mozilla/firefox/Crash Reports/InstallTime20230522134052

Filesize
10B

MD5
24b70980d960714b265c179ce2644b0e

SHA1
de49ba1abefb3c2e0b24d3fcfcb0c97e469d3c6b

SHA256
56ac1dec5eaaaea0d80d962fc046a899766eed1425cdc82698c16193fbb9c17c

SHA512
9f1234d7ccbf74003154855bb93febd6b5343cdd71fd5a109fb7166a029f4ef61c279ce80eee8a41521eb8a52f461bed5395f07a78ca56e9de03db02ba977034

Download Submit
/root/.mozilla/firefox/hnmm60nj.default/times.json

Filesize
47B

MD5
9f7dda8733a17690dd6678abd702078b

SHA1
5e08abf92c58cd3181bc71b386ca2c227bc3b7d6

SHA256
272aced31976395416f746ae9bc96fb915e2d12d870688552d31264a3b329d5b

SHA512
92a552294955c55f7acceaae62bbdd338491ba4af96f5061e049e40115c0b0ffb9b17fbb7bc2492b3f895caef3bca198d33f57960a968df33d6e106db885913f

Download Submit
/root/.mozilla/firefox/installs.ini

Filesize
62B

MD5
e005e8fb202cc4a2774b4c0d8ca54681

SHA1
a875f45ed34f2f6c7fcb1e5b64dbe28b121ea9db

SHA256
040a1ac5d9390b7f9a8b5b4a67e2c48122ac46e1db4c728ddf7015e63098cc02

SHA512
99c37cabeceb06ba36fd43ea69c21a535ed6b3dbdf925387597954de017c287d30974635a20912a3a693121ade0463550985af976d6df0c71c374aafa2641d06

Download Submit
/root/.mozilla/firefox/profiles.ini

Filesize
259B

MD5
adcdf7b8fa051a95ac98b6b04e37280b

SHA1
9f474d6ce418c9cb12cb140694ded7acc22f2528

SHA256
998ad361dea8bafdb558ad31965d0315d0248f80136205950fb606cc6ad258a9

SHA512
aaa097249cc91ffe50fcccbead80396d3b04c577ad99d5ee02b62d9b719c05bec50fab3a166cef034aa47ae404b92eb52c6db192008cc5d485d10b52544f639d

Download Submit
/root/.mozilla/firefox/xse252h2.default-release/cert9.db

Filesize
224KB

MD5
3cb9773be6d81859a41fdcb18f628d99

SHA1
76a986c20052b6a9bb8ca49380aa2315192efd95

SHA256
09dc5906db9aa2245db97925bd4f645301523f311b7366fcfd3386bb15bc4507

SHA512
5d9b104300d55638eb4dbee85768cc7aef442ceec3b833caf23bdbbb5738837c9151f54bbbffca2c24df750ded6bd62a7b05c63e6adc05bcf9e0472d6e473d07

Download Submit
/root/.mozilla/firefox/xse252h2.default-release/compatibility.ini

Filesize
163B

MD5
fe452b7294d5928a9a5863b89ee0a6bd

SHA1
a5d4c245071fa96476ba48b4725bdae7f1b7940f

SHA256
d5bfb07561606a19aa96557ea109b175050dc0eb805cbef9c813503587d77900

SHA512
dc37d8507f08849e3382d2dbafd4a64555dbd57a288c95131e9aefb366630f1585811a9e1456b861bb9d2b816ed88b18ffb7580cd92b41bb9b0227ce1363843e

Download Submit
/root/.mozilla/firefox/xse252h2.default-release/cookies.sqlite

Filesize
96KB

MD5
9535f5fe817accc769c2c1d3354db39f

SHA1
6af62cf08717cf3bfa84eb1a7b311acf522ce560

SHA256
c53c15fcfac2bb57fdc88d23f932fc244dbaf4020f0f6eaecf0f77a37c21f8c5

SHA512
dc9c2c32eb42dda0a7a711e143aea58c603c1e9d885c3677e9fe86f525e1b0b32a46e240756263e56510b07e764ba69f2de13b90ec18210678242e10cfe17837

Download Submit
/root/.mozilla/firefox/xse252h2.default-release/cookies.sqlite

Filesize
96KB

MD5
5caa766855d5613a999f71b7812d6451

SHA1
ad0d9a52a0d5cc7f11858301dbe47377ed99ee37

SHA256
3a8ce2b07e3e8678a13aa58ef5b942c4dccd8f9c84511bdeb8847ef270797e27

SHA512
17bb0f4c87ec178910795b25ce85e74cf599190c769592472c3e872f42930c93f28faf0ff3e448816a9abcc8af0459852bed52bee08cfe25d068879c6dfd8eba

Download Submit
/root/.mozilla/firefox/xse252h2.default-release/key4.db

Filesize
288KB

MD5
9d5bd2b9bc23279be1249eafae76dbdf

SHA1
9ba7a9e437efb935a9e23acb238236268a5c73f5

SHA256
013a4b8c436c604705a93a234cebc26bfd036531a31b19b64be5d2b1803b9e36

SHA512
dd79b4c0a32296eec3a1e1d302866602579d5daa88ae09a979d64d022b4ebc5ddfd729958ed3ca0112a85fc0ffbeb6b95f11a7d4b0fcaa320c1a11d6fd8b83db

Download Submit
/root/.mozilla/firefox/xse252h2.default-release/permissions.sqlite

Filesize
96KB

MD5
232fbc22dd03a8ec41edde02bdbea61c

SHA1
6ab4b39bca95418c52f7f861fd39e5fddb9cc7b6

SHA256
d88bf367aaf79efbb2e8fbdb1dc5bde1c1c3a53e0f4d8188027a63ec55d5f5f0

SHA512
055f1595f4a327347671db53cec8d89a310109d3f871c567e3d5b654b956fc0369d12437f7dc6d9327b973008f1327ee0dfdb5504f1b3cbe00da29941b1e5892

Download Submit
/root/.mozilla/firefox/xse252h2.default-release/prefs-1.js

Filesize
2KB

MD5
c4aadac1ddbc17b1a91e56fd223a7d44

SHA1
3f70e9c58d9f17c4044446fd18869add424840d2

SHA256
a32131b2f1e785e42c4c0f2a5d6dd6a030ac9bf3c8e818d5214279137dec0910

SHA512
015db094ce54058378fe5f7cb064a2a1f55e80fa34412eba006fb812cd7f3907288ee2cde1199cfbda5e97e3e344658eddf21cc8eff199f36c6967af8d840d4d

Download Submit
/root/.mozilla/firefox/xse252h2.default-release/prefs-1.js

Filesize
2KB

MD5
f4808237850472cb31b701535603591b

SHA1
0678a5be8b6630772a85c7193f2f10ffa1b80c4f

SHA256
60190789030310e286bbcd8a196ee3c60543d196966f1a244f410a7b1e0f26a6

SHA512
11b5ee6c0ad9cad988d520d4fdcae1b196abd79d0dd1a400e7335537feafcf9e0a58ad3c07dc5263452ccb5360e6286bc93791e509ca755f39d6c0df11086fc0

Download Submit
/root/.mozilla/firefox/xse252h2.default-release/prefs-1.js

Filesize
3KB

MD5
7ec4b6b8bf6b237456f74e3985afcbf9

SHA1
b84108653b59cf23e5f681bcc532850760ab2199

SHA256
d8f25145c1dfa80494d4065ded820419323471d8e85b40a7e76afcd1e8b3677e

SHA512
6dae040d51f3e62b490b0cc884871213440f8e4be6e8b660e79512c84009947436df2209d157b8a5a9effeac1da841d2e56e8b1cfa53722b9005ca647a72b8ef

Download Submit
/root/.mozilla/firefox/xse252h2.default-release/prefs.js

Filesize
1KB

MD5
3048093b5045ecf3b007b66a2cbf5eeb

SHA1
42392cb869d9a915cd93b1b40b1c984c2f86c998

SHA256
114da858df3c607ec28dcebf90f62b6a03b8caf626bc3b791e41ad22bf195a4b

SHA512
37b0b3f6dff234860a23f6984677ea3eca6373b925996d702c41e6920bdc29c4135a45550b41ed3893ea675e047bacf4307fcb60dfd89ffcf8d2ccd1054daf82

Download Submit
/root/.mozilla/firefox/xse252h2.default-release/storage/ls-archive.sqlite

Filesize
96KB

MD5
e0c613bfd69956a19ce2dc5e925aa223

SHA1
14accb230edcd6cb76967cdc6d4e5686db96b5df

SHA256
0d4cb11f6364c46a75f9eaddfca5c660b90dfd515df3afcd5e0baeca28a0f1ab

SHA512
01643c0131a392be92b3f281d7f633c1f502bff19090b0d716f1ac66aefecc3fcf92f393bef66b03089c9b9c6d8aaeb711b6a4f29d5a6729dd188c838f2272d1

Download Submit
/root/.mozilla/firefox/xse252h2.default-release/storage/ls-archive.sqlite

Filesize
128KB

MD5
178d71e5529d637ac62f7e75fdd75896

SHA1
339f2b949cc4c207b66aea11137448ba28d36dcb

SHA256
7b0050f1bfaab85c8f9067ae7d7369056ff752c0c852ef1462a96c22169004d4

SHA512
ec0e0105fcfbbae356dd55efbcf92975f35bbe5cb93fcabf4c08443e871957635d14830b27c4e1ddefbbaff8f9b7ec3590bf417a9442e1d7ee3607d14d56f664

Download Submit
/root/.mozilla/firefox/xse252h2.default-release/storage/permanent/chrome/.metadata-v2-tmp

Filesize
42B

MD5
8653e79c308752e2334d1a7f4dbbd6e5

SHA1
5a55c53ec934d68417765f9ed4113924379c9510

SHA256
c8ac991598d887fe8b2ed482170451a8706a6ddb473ed872db14be732ac4be2f

SHA512
9cfe65c78634439ba3bdd392103f1248912c263cb99d755cb312f13be012fa5884d9fc4a2f7fbb74cb56bccf3b311b8409dce1bb36df03541c75d7430a3bae7b

Download Submit
/root/.mozilla/firefox/xse252h2.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite

Filesize
44KB

MD5
a8dd7ebaad5528b23f82ccb1534cea18

SHA1
600daceacfb5cf9df0b66ba7dce4516b2ac4df70

SHA256
e5b0d02c18ae36c4a220f41fd97c66060c17aaafcbb324a57ccdc2707c44c4ec

SHA512
67f867a8e2b37fb6bececd5ebc570ca594ea329142badd63d1281d5e735f515a5e329abc6eb9a9d3465aab0a08541b4888018d859964f160a52345ab93532bff

Download Submit
/root/.mozilla/firefox/xse252h2.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite

Filesize
12KB

MD5
7007970a353df4c066ebebc7acb3a8b0

SHA1
1b413fc01952eaa8bd41420300d37afbaed11769

SHA256
c679ed9d430174aa85ba69c7b0d64ce5c345e158f422d5a62e4745c6934b272e

SHA512
543df80e5602ad808525898a0a4abcf29b4825da2da8e2675d4e006bc709a014bca7c456b51c1a086d2428f8af7726f7d35fadae7cf93ec53b948f3440842819

Download Submit
/root/.mozilla/firefox/xse252h2.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite

Filesize
44KB

MD5
7352c8848e88edc39b7fb5e663888187

SHA1
8c3dffe25cc56c7aec1b782292d6fceed81e6304

SHA256
7a462086a26978809c719e57a7ea6a25568767fb7532014e8531fda94b660e0a

SHA512
f2a0dbbab5c2c1702b03bce15a47739481f523e127d1372b40534db9a20b2bc99fb53710ee0e5d44176188817cac704cf4f98cdf087e7e89d244281fcfc3b280

Download Submit
/root/.mozilla/firefox/xse252h2.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite

Filesize
12KB

MD5
cd3b65c9387452abf868251fadb7c467

SHA1
c962357c2ad3f0e7d11812c340b2b514757bf574

SHA256
e974660a8ca1b88b581ce1b42f1543e009eba9b0bc767e9c360a8ee566f12958

SHA512
bebc9cfe61619c83f3af9d280bb109116f84ed0017ea90e612a6552e0c4bee11c659a64c0d9b59a855f429f846044351b485c5f5f64489677a1951c9cec46fec

Download Submit
/root/.mozilla/firefox/xse252h2.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite

Filesize
44KB

MD5
759544297aaa61f5fef8ee42d0ae4393

SHA1
fc2d66f6e60409e3e8d38623ce5f817fc7f571e0

SHA256
1bd2000cd972e80cefaec6e982ba261d224a818f367de0fdf8c51fa5a05d7ab5

SHA512
8aaa2ce66f10d46f7c9200af841ac7bd9f5b55c30308a14f0deda44ac62581c45daae45154487c0073a0d5847d5926cbb4072ca64a702ac6b834ad0bb482804f

Download Submit
/root/.mozilla/firefox/xse252h2.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite

Filesize
12KB

MD5
f67a7057974f8832497ffd8ea892588d

SHA1
6fa357356a0b5a0452d1a6721c970f8d79a3230d

SHA256
55b3397438ce8ed49b64860203a4b78deeff0c46aeee290a8d242b18f1bf27d1

SHA512
afac6e418e1e0485e4198a3ad26c34b0c41a05eec3681cbe020a7b461e9d9cce7e91f2e62bf7135afa65404fc5aa8df00911f0abbab9f5540e893f843b3067f0

Download Submit
/root/.mozilla/firefox/xse252h2.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
44KB

MD5
07a412e08825220262ad2890757ff779

SHA1
f46c127dbc070ded87a6078b3c1c761955f96de8

SHA256
da640f8b665841b520d2262a21cc3f82aeaa881cf81a1ddae27ef501d66544e4

SHA512
0134c783bf3293848e479b478ac57a1e0f4202cddfb8b57bc6275aada7345f398cf8a627e9b1c34fd618192c2f0c9737b1da487daf33f9c557ebc1377105582b

Download Submit
/root/.mozilla/firefox/xse252h2.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
12KB

MD5
8a0e05c7b333c5b691c7d13b97002e81

SHA1
0d44afd2774b5bc0ccfbd6c24e4f692c494b22e5

SHA256
2c26568b8bd11ec3178d08c596d5fa04dbd9a9641e836419f2b64115844bc9bc

SHA512
f1f4034e07f43e95b3f27a61bbeea40e4102dc145d87b1a1c4e92df9b78244743e3621624c666f3fb05bbea7f2d3bd9c516558a29fba50552f0179f0ac42d176

Download Submit
/root/.mozilla/firefox/xse252h2.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
164KB

MD5
641283aaa8d7a0179efdad45ae576738

SHA1
85aa60d50a976dec0efe606a7aef37b3f58d89bb

SHA256
62afefa825522da969522c0ab978b298e01d728d12a443e2d24b6a613bb979e9

SHA512
62815e3b84851d1488daf881d373f654fa706c7ef5163f87cd428b1f84ada63431fce7949188f563371fbc48254952f18a014ada98c65b1b32173ccdd3578b32

Download Submit
/root/.mozilla/firefox/xse252h2.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
148KB

MD5
dd3f6ba37c670af5953593535e435d04

SHA1
ecfe4e650a050bce77e8ff7468de04c1b8acc9a4

SHA256
5cc6fa137a1f3a7d0b615b178877f12c460b22f95702eb7534d5732ee6599561

SHA512
86e0482543faae6fb279ca71e1e6d6461d32317e74baebb3973e0fde9800107faeb9c2347be6cf8a47556ae43c8e6c224a595e952f621e40ad2c5eba920df2b3

Download Submit
/root/.mozilla/firefox/xse252h2.default-release/times.json

Filesize
50B

MD5
d93968050c1bed009b134d8d2a52de62

SHA1
e38dfb9ae931092272a4cc0a8b0667846d1c913a

SHA256
ccbc884191b1b9de7203607ebe772ef718c142c556e56d4047b535131e3084c2

SHA512
61947dae09cc7d7b7d12fa989aad5f1d5e9bc085f86b42890d7f95ddb348b4d7694fc4f97f2d6d7bb8a187fd1c6a0b8f94532ffde7e45a26901a91d1bb10c9d8

Download Submit
/root/.mozilla/firefox/xse252h2.default-release/times.json

Filesize
47B

MD5
d346a5752ea080ee9021776cc56174ea

SHA1
e9be97e4e57f0887b6a3a07f7ec562b6af0061e1

SHA256
d9755739a4211b4c2d4c846ae3bdeb1861bdcb5101b60b6a9cf24a10fe3e8484

SHA512
6dfb9c08f16ae538ff61c0ac465324abd377c28b64be28e541522b13fc8dc744e65dcf2b08fcc7f079acf138d2f93b6068b689fbc027354defe47d0c29a0adb6

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads