hxxps://u[.]to/VyKIIA

Analysis

max time kernel
14s
max time network
21s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240226-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
27-03-2024 21:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://u.to/VyKIIA

Score

7^/10

antivm spyware stealer

Malware Config

Signatures

Changes its process name 33 IoCs

Processes:

description	ioc	pid
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1688
Changes the process name, possibly in an attempt to hide itself	glean.dispatche	1687
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1688
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1688
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1692
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1693
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1692
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1693
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1691
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1691
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1690
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1690
Changes the process name, possibly in an attempt to hide itself	Timer	1689
Changes the process name, possibly in an attempt to hide itself	Timer	1689
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1694
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1694
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1696
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1696
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1698
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1698
Changes the process name, possibly in an attempt to hide itself	Cache2 I/O	1699
Changes the process name, possibly in an attempt to hide itself	Cookie	1700
Changes the process name, possibly in an attempt to hide itself	Cookie	1700
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1701
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1701
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #1	1703
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #0	1702
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1704
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1704
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	1705
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	1705
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	1706
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	1706

Reads user data of web browsers 13 IoCs

Reads stored browser data which can include saved credentials.

spyware stealer

Processes:

firefox

description	ioc	process
File opened for reading	/root/.mozilla/firefox/i86yi6ah.default-release/compatibility.ini	firefox
File opened for reading	/root/.mozilla/firefox/i86yi6ah.default-release/prefs.js	firefox
File opened for reading	/root/.mozilla/firefox/i86yi6ah.default-release/user.js	firefox
File opened for reading	/root/.mozilla/firefox/i86yi6ah.default-release/system-extensions	firefox
File opened for reading	/root/.mozilla/firefox/i86yi6ah.default-release/storage.sqlite
File opened for reading	/root/.mozilla/firefox/i86yi6ah.default-release
File opened for reading	/root/.mozilla/firefox/i86yi6ah.default-release/cookies.sqlite-journal
File opened for reading	/root/.mozilla/firefox/i86yi6ah.default-release/extensions	firefox
File opened for reading	/root/.mozilla/firefox/i86yi6ah.default-release/extensions.json
File opened for reading	/root/.mozilla/firefox/i86yi6ah.default-release/extension-preferences.json
File opened for reading	/root/.mozilla/firefox/i86yi6ah.default-release/addonStartup.json.lz4	firefox
File opened for reading	/root/.mozilla/firefox/i86yi6ah.default-release/cookies.sqlite
File opened for reading	/root/.mozilla/firefox/i86yi6ah.default-release/storage.sqlite-journal

Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
antivm

Virtualization/Sandbox Evasion
T1497

Processes:

description ioc

File opened for reading /proc/cpuinfo
Reads CPU attributes 1 TTPs 2 IoCs

System Information Discovery
T1082

Processes:

firefox

description ioc

File opened for reading /sys/devices/system/cpu/online
File opened for reading /sys/devices/system/cpu/present firefox

description	ioc
File opened for reading	/proc/cpuinfo

description	ioc
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/present	firefox

Enumerates kernel/hardware configuration 1 TTPs 53 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

Processes:

firefoxdbus-daemon

description	ioc
File opened for reading	/sys/bus/pci/devices
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/resource
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/class
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/resource
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/device
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/resource
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/resource
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/resource
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/device
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/vendor
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/class
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/vendor
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/device
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/vendor
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/class
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/irq
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/irq
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/irq
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/irq
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/resource
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/device
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/device
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/resource
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/vendor
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/device
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/resource
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/device
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_vendor
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/class
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/uevent
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_device
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/device
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/class
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/irq
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/class
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/device
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/vendor
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/device
File opened for reading	/sys/kernel/security/apparmor/features/dbus/mask	dbus-daemon
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/irq
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/vendor
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/class
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/vendor
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/class
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/irq
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/class
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/resource
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/irq
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/irq
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/vendor
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/vendor
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/vendor

Reads runtime system information 34 IoCs

Reads data from /proc virtual filesystem.

Processes:

firefoxdbus-daemonsedsedsedsedsed

description	ioc
File opened for reading	/proc/1618/cmdline
File opened for reading	/proc/self/stat
File opened for reading	/proc/self/fd/45	firefox
File opened for reading	/proc/filesystems	dbus-daemon
File opened for reading	/proc/sys/kernel/cap_last_cap
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd/47	firefox
File opened for reading	/proc/self/fd/31	firefox
File opened for reading	/proc/1593/status
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/1681/cmdline
File opened for reading	/proc/self/fd/46	firefox
File opened for reading	/proc/self/fd/43	firefox
File opened for reading	/proc/self/fd/50	firefox
File opened for reading	/proc/self/fd
File opened for reading	/proc/1593/attr/current
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd/40	firefox
File opened for reading	/proc/self/fd/42	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/fd/34	firefox
File opened for reading	/proc/self/fd/29	firefox
File opened for reading	/proc/self/fd/44	firefox
File opened for reading	/proc/self/fd/48	firefox
File opened for reading	/proc/self/mountinfo
File opened for reading	/proc/self/fd/39	firefox
File opened for reading	/proc/self/fd/49	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/fd/51	firefox
File opened for reading	/proc/mounts	dbus-daemon
File opened for reading	/proc/1582/cmdline
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/task/1683/stat

Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.

Processes:

firefox

description ioc process

File opened for modification /tmp/firefox/.parentlock firefox

description	ioc	process
File opened for modification	/tmp/firefox/.parentlock	firefox

/usr/bin/xdg-open
xdg-open https://u.to/VyKIIA
1⤵
PID:1581

/usr/bin/dbus-send
dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
2⤵
PID:1582

/usr/bin/dbus-launch
dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
3⤵
PID:1583

/bin/grep
grep " = \\\"xfce4\\\"\$"
2⤵
PID:1595

/usr/bin/xprop
xprop -root _DT_SAVE_MODE
2⤵
PID:1594

/bin/grep
grep -i "^xfce_desktop_window"
2⤵
PID:1606

/usr/bin/xprop
xprop -root
2⤵
PID:1605

/bin/grep
grep -q "^Enlightenment"
2⤵
PID:1608

/bin/uname
uname
2⤵
PID:1609

/bin/grep
grep -q "^file://"
2⤵
PID:1611

/bin/egrep
egrep -q "^[[:alpha:]+\\.\\-]+:"
2⤵
PID:1613

/usr/local/sbin/grep
grep -E -q "^[[:alpha:]+\\.\\-]+:"
2⤵
PID:1613

/usr/local/bin/grep
grep -E -q "^[[:alpha:]+\\.\\-]+:"
2⤵
PID:1613

/usr/sbin/grep
grep -E -q "^[[:alpha:]+\\.\\-]+:"
2⤵
PID:1613

/usr/bin/grep
grep -E -q "^[[:alpha:]+\\.\\-]+:"
2⤵
PID:1613

/sbin/grep
grep -E -q "^[[:alpha:]+\\.\\-]+:"
2⤵
PID:1613

/bin/grep
grep -E -q "^[[:alpha:]+\\.\\-]+:"
2⤵
PID:1613

/usr/bin/xdg-mime
xdg-mime query default x-scheme-handler/https
2⤵
PID:1617

/usr/bin/dbus-send
dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
3⤵
PID:1618

/usr/bin/dbus-launch
dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
4⤵
PID:1619

/bin/grep
grep " = \\\"xfce4\\\"\$"
3⤵
PID:1621

/usr/bin/xprop
xprop -root _DT_SAVE_MODE
3⤵
PID:1620

/bin/grep
grep -i "^xfce_desktop_window"
3⤵
PID:1623

/usr/bin/xprop
xprop -root
3⤵
PID:1622

/bin/grep
grep -q "^Enlightenment"
3⤵
PID:1625

/bin/uname
uname
3⤵
PID:1626

/usr/bin/which
which firefox
2⤵
PID:1669

/usr/bin/firefox
/usr/bin/firefox https://u.to/VyKIIA
2⤵
PID:1681

/usr/bin/which
which /usr/bin/firefox
3⤵
PID:1682

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox https://u.to/VyKIIA
2⤵
- Reads user data of web browsers
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
PID:1681

/usr/bin/dbus-launch
dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
3⤵
PID:1686

/usr/bin/dbus-daemon
/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1591

/bin/sed
sed -n "s/\$^[[:alnum:]+\\.-]*\$:.*\$/\\1/p"
1⤵
- Reads runtime system information
PID:1616

/bin/sed
sed "s/:/ /g"
1⤵
- Reads runtime system information
PID:1629

/usr/bin/head
head -n 1
1⤵
PID:1632

/bin/grep
grep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
1⤵
PID:1631

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1634

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1633

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1639

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1638

/usr/bin/head
head -n 1
1⤵
PID:1637

/bin/grep
grep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
1⤵
PID:1636

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1644

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1643

/usr/bin/head
head -n 1
1⤵
PID:1642

/bin/grep
grep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
1⤵
PID:1641

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1649

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1648

/usr/bin/head
head -n 1
1⤵
PID:1647

/bin/grep
grep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
1⤵
PID:1646

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1654

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1653

/usr/bin/head
head -n 1
1⤵
PID:1652

/bin/grep
grep "x-scheme-handler/https=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache
1⤵
PID:1651

/bin/sed
sed "s/:/ /g"
1⤵
- Reads runtime system information
PID:1657

/bin/sed
sed -e "s|-|/|"
1⤵
- Reads runtime system information
PID:1660

/bin/sed
sed -e "s|-|/|"
1⤵
- Reads runtime system information
PID:1663

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1668

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1672

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1675

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1680

/usr/bin/lsb_release
/usr/bin/lsb_release -idrc
1⤵
PID:1697

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

/root/.dbus/session-bus/11c67417355f45d397f6be11f62e85a6-0
Filesize
466B

MD5
e839d8ad9bb954e910485aa8ad3097f6

SHA1
ea06a58cf5c8e747f44a59356bb10b87b5ccbd73

SHA256
1d58368a29013c151b5bc654b52909215ec066d5a08dbaea0f1cc19ee7401c07

SHA512
e5bd79393cbb13ca8bbedb0574183d54002e503e4d660553f40e1c0ef763b32db34833d63b7be560faec37fa4838abb95f99285451091e237b67fc5d008a3d34

Download Submit
/root/.mozilla/firefox/Crash Reports/InstallTime20230522134052
Filesize
10B

MD5
f808cd1e8d01dce728696e7c745b4999

SHA1
062fd9a0db005a0a328de5d32dd9904b5254c8c7

SHA256
f0e94f3db1dbb450cbf3d52c70338850785107efbfe18fb098a2217a7071ad30

SHA512
eab4dee398710bb36a516fb28ce85db43fa29b65f0696ee905f572d721a208e94937e93976e6f6412681a0b11e8711d205aebf77c05cc09295fb79c5b4ecb682

Download Submit
/root/.mozilla/firefox/crr963qm.default/times.json
Filesize
47B

MD5
b898cd470d87c677b68fde7abef7c167

SHA1
c0d9e222c8787e120e3f7b93bbf5ca97ce2dcc3d

SHA256
00e48d0a9ba765174b84db853ba8b8cefc0bcac58fa800689fcb1fdbd1e56983

SHA512
560fd939d5fdbcd64a192c49e6473c426c8750943a71e3a472893f6651fd14d9c6dc410927ce0d6066a3ab030abdef637408f50af5db83b9176f2f724a96f544

Download Submit
/root/.mozilla/firefox/i86yi6ah.default-release/compatibility.ini
Filesize
163B

MD5
fe452b7294d5928a9a5863b89ee0a6bd

SHA1
a5d4c245071fa96476ba48b4725bdae7f1b7940f

SHA256
d5bfb07561606a19aa96557ea109b175050dc0eb805cbef9c813503587d77900

SHA512
dc37d8507f08849e3382d2dbafd4a64555dbd57a288c95131e9aefb366630f1585811a9e1456b861bb9d2b816ed88b18ffb7580cd92b41bb9b0227ce1363843e

Download Submit
/root/.mozilla/firefox/i86yi6ah.default-release/cookies.sqlite
Filesize
32KB

MD5
a7bcea1c0a0dfb9d44a9726ba016edff

SHA1
8dbdf3083273d3ba6aa3c7111321014383c6e823

SHA256
0bf18382bae9b86c437f97017d3649075c13780273bb080dfe15f2a9be7a99e6

SHA512
78316fef8ef1f1c1544717bef5344de0b896549f9c479b2318cf117cee078348fd4546e9e82e3a3ab4c65776cf0a116301440489ed75b475140c844eec84b765

Download Submit
/root/.mozilla/firefox/i86yi6ah.default-release/prefs-1.js
Filesize
1KB

MD5
8e192d7d46b3c924d5f1bdc5905be484

SHA1
eca2ad96ea26509897ee362549666f368c3c0ee5

SHA256
6a23dbf7768bc87cad9273473800a75a91d137b1fa787a2f447e3efcd392dc66

SHA512
02837b3ca9af8d108858a7e1696ea9e52209cd604489f7e92630f021d14c85d71b53f9b665130be3df7b286bc5ad824424e632e789649f936cfd1f7de57a6d54

Download Submit
/root/.mozilla/firefox/i86yi6ah.default-release/prefs.js
Filesize
776B

MD5
059da7b07b690b4a3532e7ea06ed267b

SHA1
72114f3f77bc3476f26fa93b8718b56f3e7bafe4

SHA256
c0d29d53598d20cb95ca4f4c34b8b8de25350d339fa6b64b43b4cc16b20d21b7

SHA512
88fe4e9da59a4d783f82a941fcfdcf3b134cf5ae76e85ea105e6ac73165efd7e8706decbb75a475e58ae791a2844f00338b57d847d4b835efb0b9c2f4e3fb572

Download Submit
/root/.mozilla/firefox/i86yi6ah.default-release/times.json
Filesize
47B

MD5
82cf9b5dc3d55190665a7ad5a953ed70

SHA1
5f601cdb3752893dc3f4c8d710e18d8799f0e6c2

SHA256
08e1336b816d4556de2a4e937236a7415ea7f5e895a528f224525e9dbb740aa3

SHA512
c4289e6323530216b0bce63a88d204b3a42a6f8c8e17cfd9101785e0aee23dd19b995cbd84943a242a91edccfebe4387c779d1b82f845de65f73d9bd8e0b6bcc

Download Submit
/root/.mozilla/firefox/installs.ini
Filesize
62B

MD5
18e50c32d2379ccf27c2164678c6ae95

SHA1
c7acd7e03abbd8a815d4bcbe71645eb4568212e4

SHA256
59fbbb8a987255b964789b2b515118e726f1c6a24d34578d929467762438d071

SHA512
8d5a7ee93672e30db1b2c80af3a1ee304a8697dc01d073592fff1cd14a60442313c7c16415782a4b1c4804b39c5416f87c88838fbcf6eba240cefb45098cae7e

Download Submit
/root/.mozilla/firefox/profiles.ini
Filesize
259B

MD5
6e29ef05907d259545a2bab9daf2b185

SHA1
cd178e629e8fb916681cf160fcc7cf9ddab7a02b

SHA256
06179dfc0256f925fb70ecf18d18ef3263e9e26b34bee900b03adb16d9437ddf

SHA512
f442f63b8cba16923dc87d7eeacd2b5f7f62a1d48e2901e889e1e695e1537379e3c4f98ab13a8d83da34b6141ff46bfc98622c447a6b09d3018c1dbb17b49784

Download Submit