hxxps://e-z[.]bio/vojtax

Analysis

max time kernel
149s
max time network
153s
platform
ubuntu-20.04_amd64
resource
ubuntu2004-amd64-20240221-en
resource tags

arch:amd64arch:i386image:ubuntu2004-amd64-20240221-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
submitted
09/03/2024, 20:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://e-z.bio/vojtax

Score

7^/10

spyware stealer

Malware Config

Signatures

Changes its process name 64 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	gmain	1684	Process not Found
Changes the process name, possibly in an attempt to hide itself	gdbus	1696	Process not Found
Changes the process name, possibly in an attempt to hide itself	glean.dispatche	1702	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1704	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1704	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1704	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1881	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1881	Process not Found
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1883	Process not Found
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1883	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1884	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1884	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1885	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1885	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1886	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1886	Process not Found
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1887	Process not Found
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1887	Process not Found
Changes the process name, possibly in an attempt to hide itself	pool-firefox	1890	Process not Found
Changes the process name, possibly in an attempt to hide itself	pool-firefox	1891	Process not Found
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1894	Process not Found
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1894	Process not Found
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1912	Process not Found
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1912	Process not Found
Changes the process name, possibly in an attempt to hide itself	glxtest:disk$0	1918	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cache2 I/O	1931	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cookie	1933	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cookie	1933	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	2004	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	2004	Process not Found
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #1	2006	Process not Found
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #0	2005	Process not Found
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	2007	Process not Found
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	2007	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #3	2011	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	2010	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #3	2011	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	2010	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #4	2012	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #4	2012	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #5	2013	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #5	2013	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #6	2014	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #6	2014	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #7	2015	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #7	2015	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #8	2016	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #8	2016	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #9	2017	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #9	2017	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #10	2018	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #10	2018	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #11	2019	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #11	2019	Process not Found
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	2020	Process not Found
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	2020	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC Launch	2156	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC Launch	2156	Process not Found
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	2155	Process not Found
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	2155	Process not Found
Changes the process name, possibly in an attempt to hide itself	Breakpad Server	2154	Process not Found
Changes the process name, possibly in an attempt to hide itself	Sandbox Forked	2158	Process not Found
Changes the process name, possibly in an attempt to hide itself	Chroot Helper	2159	Process not Found
Changes the process name, possibly in an attempt to hide itself	MainThread	2158	firefox

Reads user data of web browsers 32 IoCs

Reads stored browser data which can include saved credentials.

spyware stealer

description	ioc	Process
File opened for reading	/root/.mozilla/firefox/8guja9i9.default-release/extensions.json	Process not Found
File opened for reading	/root/.mozilla/firefox/8guja9i9.default-release/storage.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/8guja9i9.default-release/extensions	firefox
File opened for reading	/root/.mozilla/firefox/8guja9i9.default-release/extension-preferences.json	Process not Found
File opened for reading	/root/.mozilla/firefox/8guja9i9.default-release/storage/ls-archive.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/8guja9i9.default-release/cert9.db	firefox
File opened for reading	/root/.mozilla/firefox/8guja9i9.default-release/user.js	firefox
File opened for reading	/root/.mozilla/firefox/8guja9i9.default-release	Process not Found
File opened for reading	/root/.mozilla/firefox/8guja9i9.default-release/cookies.sqlite-journal	firefox
File opened for reading	/root/.mozilla/firefox/8guja9i9.default-release/key4.db	firefox
File opened for reading	/root/.mozilla/firefox/8guja9i9.default-release/compatibility.ini	firefox
File opened for reading	/root/.mozilla/firefox/8guja9i9.default-release/prefs.js	firefox
File opened for reading	/root/.mozilla/firefox/8guja9i9.default-release/cert9.db-journal	firefox
File opened for reading	/root/.mozilla/firefox/8guja9i9.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/8guja9i9.default-release/permissions.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/8guja9i9.default-release/permissions.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/8guja9i9.default-release/addonStartup.json.lz4	firefox
File opened for reading	/root/.mozilla/firefox/8guja9i9.default-release/storage/ls-archive.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/8guja9i9.default-release/pkcs11.txt	firefox
File opened for reading	/root/.mozilla/firefox/8guja9i9.default-release/cert_override.txt	firefox
File opened for reading	/root/.mozilla/firefox/8guja9i9.default-release/cookies.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/8guja9i9.default-release/storage	Process not Found
File opened for reading	/root/.mozilla/firefox/8guja9i9.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/8guja9i9.default-release/storage.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/8guja9i9.default-release/storage/permanent/chrome	Process not Found
File opened for reading	/root/.mozilla/firefox/8guja9i9.default-release/storage/permanent/chrome/idb	Process not Found
File opened for reading	/root/.mozilla/firefox/8guja9i9.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/8guja9i9.default-release/key4.db-journal	firefox
File opened for reading	/root/.mozilla/firefox/8guja9i9.default-release/cookies.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/8guja9i9.default-release/system-extensions	firefox
File opened for reading	/root/.mozilla/firefox/8guja9i9.default-release/cookies.sqlite	firefox
File opened for reading	/root/.mozilla/firefox/8guja9i9.default-release	firefox

Reads CPU attributes 1 TTPs 2 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox

Enumerates kernel/hardware configuration 1 TTPs 55 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/class	glxtest
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/class	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/vendor	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/uevent	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/device	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_device	glxtest
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/resource	glxtest
File opened for reading	/sys/kernel/security/apparmor/features/dbus/mask	dbus-daemon
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/device	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/vendor	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_vendor	glxtest
File opened for reading	/sys/devices/system/cpu	glxtest
File opened for reading	/sys/bus/pci/devices	glxtest

Reads runtime system information 40 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/filesystems	dbus-daemon
File opened for reading	/proc/1490/status	Process not Found
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/mountinfo	Process not Found
File opened for reading	/proc/self/fd/46	firefox
File opened for reading	/proc/self/fd/50	firefox
File opened for reading	/proc/1490/attr/current	Process not Found
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/stat	Process not Found
File opened for reading	/proc/self/fd/32	firefox
File opened for reading	/proc/self/fd/28	firefox
File opened for reading	/proc/self/fd/45	firefox
File opened for reading	/proc/self/mountinfo	firefox
File opened for reading	/proc/self/fd	Process not Found
File opened for reading	/proc/1570/cmdline	Process not Found
File opened for reading	/proc/self/fd/41	firefox
File opened for reading	/proc/self/fd/47	firefox
File opened for reading	/proc/mounts	dbus-daemon
File opened for reading	/proc/1507/cmdline	Process not Found
File opened for reading	/proc/self/fd/35	firefox
File opened for reading	/proc/self/task/2160/stat	Process not Found
File opened for reading	/proc/sys/kernel/cap_last_cap	Process not Found
File opened for reading	/proc/self/fd/34	firefox
File opened for reading	/proc/1469/cmdline	Process not Found
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/fd/44	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/task/1572/stat	Process not Found
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/fd/48	firefox
File opened for reading	/proc/self/fd/49	firefox
File opened for reading	/proc/self/fd/51	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	glxtest
File opened for reading	/proc/self/fd/42	firefox
File opened for reading	/proc/self/fd/43	firefox
File opened for reading	/proc/self/fd/52	firefox

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/firefox/.parentlock	firefox

/usr/bin/xdg-open
xdg-open https://e-z.bio/vojtax
1⤵
PID:1468
- /usr/bin/dbus-send
  dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
  2⤵
  PID:1469
- - /usr/bin/dbus-launch
    dbus-launch --autolaunch 4816dd152e8c48ff97e9117d197c13d8 --binary-syntax --close-stderr
    3⤵
    PID:1471
- /usr/bin/grep
  grep " = \\\"xfce4\\\"\$"
  2⤵
  PID:1492
- /usr/bin/xprop
  xprop -root _DT_SAVE_MODE
  2⤵
  PID:1491
- /usr/bin/grep
  grep -i "^xfce_desktop_window"
  2⤵
  PID:1494
- /usr/bin/xprop
  xprop -root
  2⤵
  PID:1493
- /usr/bin/grep
  grep -q "^Enlightenment"
  2⤵
  PID:1497
- /usr/bin/uname
  uname
  2⤵
  PID:1498
- /usr/bin/grep
  grep -q "^file://"
  2⤵
  PID:1500
- /usr/bin/egrep
  egrep -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1502
- /usr/local/sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1502
- /usr/local/bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1502
- /usr/sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1502
- /usr/bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1502
- /usr/bin/xdg-mime
  xdg-mime query default x-scheme-handler/https
  2⤵
  PID:1506
- - /usr/bin/dbus-send
    dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
    3⤵
    PID:1507
  - - /usr/bin/dbus-launch
      dbus-launch --autolaunch 4816dd152e8c48ff97e9117d197c13d8 --binary-syntax --close-stderr
      4⤵
      PID:1508
- - /usr/bin/grep
    grep " = \\\"xfce4\\\"\$"
    3⤵
    PID:1510
- - /usr/bin/xprop
    xprop -root _DT_SAVE_MODE
    3⤵
    PID:1509
- - /usr/bin/grep
    grep -i "^xfce_desktop_window"
    3⤵
    PID:1512
- - /usr/bin/xprop
    xprop -root
    3⤵
    PID:1511
- - /usr/bin/grep
    grep -q "^Enlightenment"
    3⤵
    PID:1514
- - /usr/bin/uname
    uname
    3⤵
    PID:1515
- /usr/bin/which
  which firefox
  2⤵
  PID:1558
- /usr/bin/firefox
  /usr/bin/firefox https://e-z.bio/vojtax
  2⤵
  PID:1570
- - /usr/bin/which
    which /usr/bin/firefox
    3⤵
    PID:1571
- /usr/lib/firefox/firefox
  /usr/lib/firefox/firefox https://e-z.bio/vojtax
  2⤵
  - Reads user data of web browsers
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1570
- - /usr/local/sbin/dbus-launch
    dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
    3⤵
    PID:1685
- - /usr/local/bin/dbus-launch
    dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
    3⤵
    PID:1685
- - /usr/sbin/dbus-launch
    dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
    3⤵
    PID:1685
- - /usr/bin/dbus-launch
    dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
    3⤵
    PID:1685
- - /usr/lib/firefox/glxtest
    /usr/lib/firefox/glxtest -f 13
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:1703

/usr/bin/dbus-daemon
/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1479

/usr/bin/sed
sed -n "s/\$^[[:alnum:]+\\.-]*\$:.*\$/\\1/p"
1⤵
- Reads runtime system information
PID:1505

/usr/bin/sed
sed "s/:/ /g"
1⤵
- Reads runtime system information
PID:1518

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1522

/usr/bin/head
head -n 1
1⤵
PID:1521

/usr/bin/grep
grep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
1⤵
PID:1520

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1523

/usr/bin/head
head -n 1
1⤵
PID:1526

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1528

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1527

/usr/bin/grep
grep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
1⤵
PID:1525

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1533

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1532

/usr/bin/head
head -n 1
1⤵
PID:1531

/usr/bin/grep
grep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
1⤵
PID:1530

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1538

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1537

/usr/bin/head
head -n 1
1⤵
PID:1536

/usr/bin/grep
grep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
1⤵
PID:1535

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1543

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1542

/usr/bin/head
head -n 1
1⤵
PID:1541

/usr/bin/grep
grep "x-scheme-handler/https=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache
1⤵
PID:1540

/usr/bin/sed
sed "s/:/ /g"
1⤵
- Reads runtime system information
PID:1546

/usr/bin/sed
sed -e "s|-|/|"
1⤵
- Reads runtime system information
PID:1549

/usr/bin/sed
sed -e "s|-|/|"
1⤵
- Reads runtime system information
PID:1552

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1557

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1561

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1564

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1569

/usr/bin/lsb_release
/usr/bin/lsb_release -idrc
1⤵
PID:1895

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -parentBuildID 20240108143603 -prefsLen 20252 -prefMapSize 231436 -appDir /usr/lib/firefox/browser "{d9730a36-49e5-410f-a7c4-44c672c5f6d4}" 1570 true socket
1⤵
- Changes its process name
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2158

/usr/local/sbin/dbus-launch
dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
1⤵
PID:2277

/usr/local/bin/dbus-launch
dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
1⤵
PID:2277

/usr/sbin/dbus-launch
dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
1⤵
PID:2277

/usr/bin/dbus-launch
dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
1⤵
PID:2277

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/root/.cache/dconf/user

Filesize
2B

MD5
c4103f122d27677c9db144cae1394a66

SHA1
1489f923c4dca729178b3e3233458550d8dddf29

SHA256
96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

SHA512
5ea71dc6d0b4f57bf39aadd07c208c35f06cd2bac5fde210397f70de11d439c62ec1cdf3183758865fd387fcea0bada2f6c37a4a17851dd1d78fefe6f204ee54

Download Submit
/root/.cache/mozilla/firefox/8guja9i9.default-release/startupCache/startupCache.8.little

Filesize
1.0MB

MD5
219612fc4f504322cd02489338c2a3e0

SHA1
a36ffeb6cd15ca04a9f7f4371697fbd73fc097ed

SHA256
bb40c9f10b0cf1b06945805f1fd0b09db03717e30c282591c96d026f3168a3ae

SHA512
6241a9a0e5ffa18ae76ca20de434c06ea0f1de7f72b3b6d33a214fa9cbb9ed9e0d883fd63fd1f4a2fa71292adda23bc8d2a777be244a5d8756d9589aec8eaeb6

Download Submit
/root/.dbus/session-bus/4816dd152e8c48ff97e9117d197c13d8-0

Filesize
466B

MD5
bc96ab2418e7d2487c610fb1302e598c

SHA1
56fafa6605cf543220e1070c5919ab640812442d

SHA256
ec24acf449e6f7f9f938fd9afb2cb6c6f30db50f3eb80ef6c23b966800bd0d94

SHA512
b626e98a03e3930a3f454064f6068491e9ca115283b61609706efcd326a81d3dfb00b442ee3440b31a9ccf022eb27c5fe31b434f8a0564be738567a61e4dfa21

Download Submit
/root/.mozilla/firefox/8guja9i9.default-release/compatibility.ini

Filesize
163B

MD5
2d41a6f5736821b90ef44850dd3873fe

SHA1
a47c4bc1431234a5b58e460ede5b571acd38e562

SHA256
b4bf5c8334f6db20ae94105141ae7a721342ddccd94ec65289dc291e76a31814

SHA512
047a1455211e7aa29ef5f32f07c89d8a0c8d86d871bc664e4d8958a2a014dbe32f0613cd9eb66e7307c0e2439f74ca0b829652a52fa48e8c60d64b41f69914eb

Download Submit
/root/.mozilla/firefox/8guja9i9.default-release/cookies.sqlite

Filesize
32KB

MD5
026b637578261077a90dc1d37830e6af

SHA1
7097e5d175331b48a876d3a7dc88a2f841013ca2

SHA256
c8a9907517b566e9d0c2bbc7568c227f3f0a119cd487eadb08390a5ae440bce5

SHA512
12e5b4e0ce1f6de33da8241760ccc7550cd65a18c4f9ab525bbd66c5fa4998bb4d5e24a22e4285e7030071aaab2a34bdfd10bf22950e42e83db8107b0f63ec5c

Download Submit
/root/.mozilla/firefox/8guja9i9.default-release/cookies.sqlite

Filesize
96KB

MD5
102a8b6e82208a1b69224bdca8a5b10f

SHA1
8413dc3772127c4159e6d6b51372990a06b805ee

SHA256
5ebf89b32937916a76a8432832040cf0f6b99c2f006cc42f856712d403ec182c

SHA512
49c5c27c6749a7a73b4b944eea64ceb053a272619e6319bfd433ffbe126c8fbccc110961018165a4c7de781a86cf38d2bd9e52ec71b10bc73c9fd05fe841a46c

Download Submit
/root/.mozilla/firefox/8guja9i9.default-release/key4.db

Filesize
224KB

MD5
7d7141a3a76047083ff32c92469b33e5

SHA1
978d39d24c028c5b10250d4556b8aa6d0eaba762

SHA256
ccb329d692a32feec98bf8226d3d2f8d414f4c5f5f1672591e35fe5ea50bef02

SHA512
2bdea07c87dc41c715ec7ea29faa068f70699b9f267cf0485ba6e35546c6109baf1021aaa0911c9b69e9b702a469596745191294648374d4f3ab88867b9a2cd7

Download Submit
/root/.mozilla/firefox/8guja9i9.default-release/prefs-1.js

Filesize
1KB

MD5
de8555a763fdc63fdc6f62483b31ef93

SHA1
55405c8e6576b4a0266eaf4d07d0dfe797caae34

SHA256
0dc45a5f47745c616b3d85a0a795c36d8b37bf8ca2fa609e3fae960bf97e7c06

SHA512
99ff5a43fb4bb7d6d77650fca8c43d1580cdb60b9f5739aa5e66e7af622e851896c28fbcb2c995e498ae4bf4d8afdbf62be3368ee3eca8a2197f9f0d5e35cdec

Download Submit
/root/.mozilla/firefox/8guja9i9.default-release/prefs-1.js

Filesize
1KB

MD5
bfa830402c399ee6e3287b92734963ae

SHA1
ccd99fe53b2f79bcc041eefffc77f8e165035900

SHA256
0f1c1e515ca38776c37e95e76999aee536037ac7f329a4ef85ad7f5dd0545111

SHA512
3b3747b24af465e1635e2f86fc83e6968fbd642d2b97f748b570ead69408f90280383dd631c43588f3ba85c892749aa116f8c7b7cf63b2d037bf0848b1d76405

Download Submit
/root/.mozilla/firefox/8guja9i9.default-release/prefs.js

Filesize
776B

MD5
f01838aae496d55ba4ed42160f07718b

SHA1
04d2fa68f27a41749734ae231f1484fc151ea533

SHA256
809f9d3ce22cbdbc7353644906138fcef8fa94ff6ed270a0d20b9a7ea53bf00e

SHA512
86525fc55cbff2f2d55701652ffc30d475fa3e52193b1637ee031b09b90c6e4e701ede7d48db6ca38b56279012358921c370f0d01cc9780cc817ab3be2b0a5fe

Download Submit
/root/.mozilla/firefox/8guja9i9.default-release/storage/ls-archive.sqlite

Filesize
96KB

MD5
e1121e3dd3c8a9c384f879bdddcff219

SHA1
625f25a1a5ff8527ab3105636fa7aecb9affd234

SHA256
766b9f50254b4e5526b0cde2911512956262596d8937f8630805d3c70802a066

SHA512
03e1cee2e75b2b609b8344a40995de09de837e940d2012f2fea65d9c70eecbcd3345b66b852f32211b38b06a4370f06f02ca7521e29e7113e2e12a6a7752be31

Download Submit
/root/.mozilla/firefox/8guja9i9.default-release/storage/ls-archive.sqlite

Filesize
128KB

MD5
2deebf49355c5a10b8d578962338186a

SHA1
004e9abaf561865e420db2621fab2802b387c5ea

SHA256
3b1d1947cc05cdc7fbdd8b289519e65f1b203326665247ce93b054e3a4abe679

SHA512
73cd9a90d2100ff4b3dcb7abca76f09b97486011f2e1fb3bea1588f8533ed0f8e6768852afe6170f1c2a7f4d260b51e48cdb9bbcc28039aa2561fb8f3a73d48c

Download Submit
/root/.mozilla/firefox/8guja9i9.default-release/storage/permanent/chrome/.metadata-v2-tmp

Filesize
36B

MD5
4044ef5722dc2287b11c5d3479c14287

SHA1
ee11593ab53c634ba4211676358897c5063ca93f

SHA256
fed8f9f764cc824b39b27b3d989cc1f38f4f51cf932f88d0bb6e9431cdd75070

SHA512
eb6a498c8788be7ce9613df74485c96a6ff6b52d1b88bc396e177b347d5b00c3d8ff9ba1d2b2b905d46bf5139f96b1ddd093296eb2c86696bbed48ddf4645200

Download Submit
/root/.mozilla/firefox/8guja9i9.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
4KB

MD5
bcde68669893a50fb9cfb04287548922

SHA1
a24b2381e35c18221d539bd38ea71f5bd2cdafd2

SHA256
ff730b365a266f12339de84e74ba0eb1991e349f83c1056d510ec9f8ffb4a5c1

SHA512
6eeaf26b26e414cbefc67590c61ce0182879426bb5af5e9ef1722f09560027086189cbbc81a9ad168706ba254df4f79c27d4e3d6f011bd8a6f669a22ff9ba122

Download Submit
/root/.mozilla/firefox/8guja9i9.default-release/times.json

Filesize
47B

MD5
cfc2292484be830716f5da1cd9d46e8e

SHA1
688f1b4733dd7a6b115b41fb1c0b98441e6b49b8

SHA256
0acac85bbe8517634931f8ae497b3cad7112f21f3b2a868370c623fff973568b

SHA512
0cbbffbd0498270d46e5904376f567fdb3d275c72a3fb6625592f6bd4d51e581a1d14577dc39d3633119e1638cc3003a4c2affac5fcb04f3dc1ba960e28f149c

Download Submit
/root/.mozilla/firefox/Crash Reports/InstallTime20240108143603

Filesize
10B

MD5
6f9fa873370206c77d6ffd198a636c15

SHA1
564540901a2558cc9af93d9be637c0b340715952

SHA256
a314ddca61be8e158e6e6f030cd1c11757b481def28d64c5828abe7ceee5f361

SHA512
f25cb361587a865f510c0f5d7f2a4b4ae6314f60808b8424d18c120fa1bcc2f4ebb63212a88a3169cd6ab37bc6fa84949e6cdd076fc8962b3d8690f3b886b5f4

Download Submit
/root/.mozilla/firefox/bimlcfhx.default/times.json

Filesize
47B

MD5
7ebb7c7d24b751b6d6aaeadb7f8b07a9

SHA1
e730e926252684e3a318fea4c449162bb1a9e3e8

SHA256
e12a9558979907aa7589ee257bfa1c390020920e48dee4ef3532bdaa51dee8d7

SHA512
faf517b55123cf5d7cce0dad34d11698628cd42ef670a6ffd9d72af3d1cad329424297aef5103944f94335f0a1d5c8f955d74eff19be9e8c4f0f8765a823d79d

Download Submit
/root/.mozilla/firefox/installs.ini

Filesize
62B

MD5
cc697be8e9f5cbda18addd4d85a7bd99

SHA1
9c83dbadcd495a46222ec1bbc64771c9a2cd3019

SHA256
8a12829092bb47a43b6a84399feb9310e1cbf42459292336713075d889f63acb

SHA512
3f3281f25ebcac7512ffd3ec4120506423327ac35d6300662f68a65ac824949f695dc528fd112120b3c1d5a0be4e9f17652cfe41b469c889210c0de8649cad43

Download Submit
/root/.mozilla/firefox/profiles.ini

Filesize
259B

MD5
615b7fd597d5b4a9c145e23dd8ea88f1

SHA1
bc3686ffa4050065dff118fb0ce20dad7d01396a

SHA256
ae9660104bc02acf6e935a9410164468fe329804f0cf99fd50197402d572fade

SHA512
1881615d00bd427fcbcb45ec1fe49e8105e0f9eb66cfcbe9a83b9fdc71dd5f64630dd6acc19809390ce488e1280365c7eb364e8a8047cb2fa09824e061ad1a2c

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads