Overview
overview
8Static
static
8URLScan
urlscan
1https://785e4b9e.01c...
windows10-2004-x64
1https://785e4b9e.01c...
android-9-x86
1https://785e4b9e.01c...
android-10-x64
7https://785e4b9e.01c...
android-11-x64
1https://785e4b9e.01c...
ubuntu-18.04-amd64
7https://785e4b9e.01c...
debian-9-armhf
https://785e4b9e.01c...
debian-9-mips
https://785e4b9e.01c...
debian-9-mipsel
Analysis
- max time kernel
9s - max time network
348s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20240226-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
03/04/2024, 14:03
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://785e4b9e.01ce619805ecbd2a7488d402.workers.dev?qrc=YW5uZXNAbXVsbGluc2NoZWVzZS5iaXo=
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
600 seconds
Behavioral task
behavioral2
Sample
https://785e4b9e.01ce619805ecbd2a7488d402.workers.dev?qrc=YW5uZXNAbXVsbGluc2NoZWVzZS5iaXo=
Resource
android-x86-arm-20240221-en
android-9-x86
0 signatures
600 seconds
Behavioral task
behavioral3
Sample
https://785e4b9e.01ce619805ecbd2a7488d402.workers.dev?qrc=YW5uZXNAbXVsbGluc2NoZWVzZS5iaXo=
Resource
android-x64-20240221-en
android-10-x64
1 signatures
600 seconds
Behavioral task
behavioral4
Sample
https://785e4b9e.01ce619805ecbd2a7488d402.workers.dev?qrc=YW5uZXNAbXVsbGluc2NoZWVzZS5iaXo=
Resource
android-x64-arm64-20240221-en
android-11-x64
0 signatures
600 seconds
Behavioral task
behavioral5
Sample
https://785e4b9e.01ce619805ecbd2a7488d402.workers.dev?qrc=YW5uZXNAbXVsbGluc2NoZWVzZS5iaXo=
Resource
ubuntu1804-amd64-20240226-en
ubuntu-18.04-amd64
7 signatures
600 seconds
Behavioral task
behavioral6
Sample
https://785e4b9e.01ce619805ecbd2a7488d402.workers.dev?qrc=YW5uZXNAbXVsbGluc2NoZWVzZS5iaXo=
Resource
debian9-armhf-20240226-en
debian-9-armhf
0 signatures
600 seconds
Behavioral task
behavioral7
Sample
https://785e4b9e.01ce619805ecbd2a7488d402.workers.dev?qrc=YW5uZXNAbXVsbGluc2NoZWVzZS5iaXo=
Resource
debian9-mipsbe-20240226-en
debian-9-mips
0 signatures
600 seconds
Behavioral task
behavioral8
Sample
https://785e4b9e.01ce619805ecbd2a7488d402.workers.dev?qrc=YW5uZXNAbXVsbGluc2NoZWVzZS5iaXo=
Resource
debian9-mipsel-20240226-en
debian-9-mipsel
0 signatures
600 seconds
General
Malware Config
Signatures
- Changes its process name 64 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself glean.dispatche 1663 Process not Found Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 1664 Process not Found Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 1664 Process not Found Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 1664 Process not Found Changes the process name, possibly in an attempt to hide itself Timer 1668 Process not Found Changes the process name, possibly in an attempt to hide itself Socket Thread 1670 Process not Found Changes the process name, possibly in an attempt to hide itself Netlink Monitor 1669 Process not Found Changes the process name, possibly in an attempt to hide itself Timer 1668 Process not Found Changes the process name, possibly in an attempt to hide itself Socket Thread 1670 Process not Found Changes the process name, possibly in an attempt to hide itself Netlink Monitor 1669 Process not Found Changes the process name, possibly in an attempt to hide itself IPDL Background 1671 Process not Found Changes the process name, possibly in an attempt to hide itself Backgro~Pool #1 1672 Process not Found Changes the process name, possibly in an attempt to hide itself IPDL Background 1671 Process not Found Changes the process name, possibly in an attempt to hide itself Backgro~Pool #1 1672 Process not Found Changes the process name, possibly in an attempt to hide itself HTML5 Parser 1673 Process not Found Changes the process name, possibly in an attempt to hide itself HTML5 Parser 1673 Process not Found Changes the process name, possibly in an attempt to hide itself JS Watchdog 1675 Process not Found Changes the process name, possibly in an attempt to hide itself JS Watchdog 1675 Process not Found Changes the process name, possibly in an attempt to hide itself BGReadURLs 1677 Process not Found Changes the process name, possibly in an attempt to hide itself BGReadURLs 1677 Process not Found Changes the process name, possibly in an attempt to hide itself Cache2 I/O 1678 Process not Found Changes the process name, possibly in an attempt to hide itself Cookie 1679 Process not Found Changes the process name, possibly in an attempt to hide itself Cookie 1679 Process not Found Changes the process name, possibly in an attempt to hide itself StreamTrans #1 1680 Process not Found Changes the process name, possibly in an attempt to hide itself StreamTrans #1 1680 Process not Found Changes the process name, possibly in an attempt to hide itself TaskCon~ller #1 1682 Process not Found Changes the process name, possibly in an attempt to hide itself TaskCon~ller #0 1681 Process not Found Changes the process name, possibly in an attempt to hide itself BgIOThr~Pool #1 1683 Process not Found Changes the process name, possibly in an attempt to hide itself BgIOThr~Pool #1 1683 Process not Found Changes the process name, possibly in an attempt to hide itself StreamTrans #2 1684 Process not Found Changes the process name, possibly in an attempt to hide itself StreamTrans #2 1684 Process not Found Changes the process name, possibly in an attempt to hide itself QuotaManager IO 1685 Process not Found Changes the process name, possibly in an attempt to hide itself QuotaManager IO 1685 Process not Found Changes the process name, possibly in an attempt to hide itself IndexedDB #1 1686 Process not Found Changes the process name, possibly in an attempt to hide itself IndexedDB #1 1686 Process not Found Changes the process name, possibly in an attempt to hide itself IPC Launch 1689 Process not Found Changes the process name, possibly in an attempt to hide itself IPC Launch 1689 Process not Found Changes the process name, possibly in an attempt to hide itself SandboxReporter 1688 Process not Found Changes the process name, possibly in an attempt to hide itself SandboxReporter 1688 Process not Found Changes the process name, possibly in an attempt to hide itself Breakpad Server 1687 Process not Found Changes the process name, possibly in an attempt to hide itself Sandbox Forked 1690 Process not Found Changes the process name, possibly in an attempt to hide itself DOM Worker 1691 Process not Found Changes the process name, possibly in an attempt to hide itself DOM Worker 1691 Process not Found Changes the process name, possibly in an attempt to hide itself Chroot Helper 1692 Process not Found Changes the process name, possibly in an attempt to hide itself MainThread 1690 firefox Changes the process name, possibly in an attempt to hide itself IPC I/O Child 1694 Process not Found Changes the process name, possibly in an attempt to hide itself IPC I/O Child 1694 Process not Found Changes the process name, possibly in an attempt to hide itself IPC I/O Child 1694 Process not Found Changes the process name, possibly in an attempt to hide itself Socket Process 1690 firefox Changes the process name, possibly in an attempt to hide itself FSBroker1690 1697 Process not Found Changes the process name, possibly in an attempt to hide itself FSBroker1690 1697 Process not Found Changes the process name, possibly in an attempt to hide itself Socket Thread 1696 Process not Found Changes the process name, possibly in an attempt to hide itself Socket Thread 1696 Process not Found Changes the process name, possibly in an attempt to hide itself Backgro~Pool #1 1695 Process not Found Changes the process name, possibly in an attempt to hide itself Backgro~Pool #1 1695 Process not Found Changes the process name, possibly in an attempt to hide itself Timer 1699 Process not Found Changes the process name, possibly in an attempt to hide itself Timer 1699 Process not Found Changes the process name, possibly in an attempt to hide itself ProfilerChild 1698 Process not Found Changes the process name, possibly in an attempt to hide itself ProfilerChild 1698 Process not Found Changes the process name, possibly in an attempt to hide itself Worker Launcher 1700 Process not Found Changes the process name, possibly in an attempt to hide itself Worker Launcher 1700 Process not Found Changes the process name, possibly in an attempt to hide itself gmain 1701 Process not Found Changes the process name, possibly in an attempt to hide itself gdbus 1703 Process not Found Changes the process name, possibly in an attempt to hide itself gmain 1706 Process not Found - Reads user data of web browsers 63 IoCs
Reads stored browser data which can include saved credentials.
description ioc Process File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/AlternateServices.txt Process not Found File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/sessionstore-backups/previous.jsonlz4 Process not Found File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/cookies.sqlite Process not Found File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/storage.sqlite-journal Process not Found File opened for reading /root/.mozilla/firefox/cbjaajux.default-release firefox File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/cert9.db-journal firefox File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/sessionstore.js Process not Found File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/sessionstore-backups/recovery.js Process not Found File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/user.js firefox File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/cookies.sqlite-journal Process not Found File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/storage/ls-archive.sqlite Process not Found File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/shield-preference-experiments.json Process not Found File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite-journal Process not Found File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/extensions.json Process not Found File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/storage/ls-archive.sqlite-journal Process not Found File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/pkcs11.txt firefox File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/system-extensions firefox File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/key4.db firefox File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite-journal Process not Found File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/cert9.db Process not Found File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/storage/permanent/chrome Process not Found File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite-journal Process not Found File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/permissions.sqlite-journal Process not Found File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/xulstore.json firefox File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/extension-preferences.json Process not Found File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/storage/permanent/chrome/idb Process not Found File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/key4.db-journal firefox File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite-wal Process not Found File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/compatibility.ini firefox File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/sessionstore-backups/recovery.bak Process not Found File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/sessionstore-backups/previous.js Process not Found File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/storage Process not Found File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/permissions.sqlite Process not Found File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite-wal Process not Found File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/key4.db Process not Found File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/prefs.js firefox File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/addonStartup.json.lz4 firefox File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/cookies.sqlite-journal firefox File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/addons.json Process not Found File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/search.json.mozlz4 Process not Found File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/extensions firefox File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/cookies.sqlite firefox File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/sessionstore.jsonlz4 Process not Found File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite Process not Found File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite Process not Found File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite-wal Process not Found File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/storage.sqlite Process not Found File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite Process not Found File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/sessionstore-backups/recovery.jsonlz4 Process not Found File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite-journal Process not Found File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite-wal Process not Found File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/times.json Process not Found File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/sessionstore-backups/recovery.baklz4 Process not Found File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/content-prefs.sqlite Process not Found File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/sessionCheckpoints.json Process not Found File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/handlers.json firefox File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/cert9.db firefox File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/ClientAuthRememberList.txt Process not Found File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite Process not Found File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/cert9.db-journal Process not Found File opened for reading /root/.mozilla/firefox/cbjaajux.default-release Process not Found File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/cert_override.txt firefox File opened for reading /root/.mozilla/firefox/cbjaajux.default-release/SiteSecurityServiceState.txt Process not Found - Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc File opened for reading /proc/cpuinfo - Reads CPU attributes 1 TTPs 11 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/present firefox File opened for reading /sys/devices/system/cpu/present firefox File opened for reading /sys/devices/system/cpu/present firefox File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/size Process not Found File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/size Process not Found File opened for reading /sys/devices/system/cpu/present Process not Found File opened for reading /sys/devices/system/cpu/present firefox File opened for reading /sys/devices/system/cpu/online Process not Found File opened for reading /sys/devices/system/cpu/present firefox File opened for reading /sys/devices/system/cpu/present firefox File opened for reading /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq Process not Found - Enumerates kernel/hardware configuration 1 TTPs 60 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/bus/pci/devices Process not Found File opened for reading /sys/bus/pci/devices/0000:00:01.0/resource Process not Found File opened for reading /sys/bus/pci/devices/0000:00:03.0/vendor Process not Found File opened for reading /sys/bus/pci/devices/0000:00:06.0/class Process not Found File opened for reading /sys/devices/pci0000:00/0000:00:02.0/subsystem_device Process not Found File opened for reading /sys/devices/system/cpu firefox File opened for reading /sys/devices/system/cpu firefox File opened for reading /sys/bus/pci/devices/0000:00:01.3/device Process not Found File opened for reading /sys/bus/pci/devices/0000:00:01.1/resource Process not Found File opened for reading /sys/bus/pci/devices/0000:00:04.0/class Process not Found File opened for reading /sys/bus/pci/devices/0000:00:02.0/resource Process not Found File opened for reading /sys/bus/pci/devices/0000:00:04.0/irq Process not Found File opened for reading /sys/bus/pci/devices/0000:00:01.3/resource Process not Found File opened for reading /sys/bus/pci/devices/0000:00:06.0/device Process not Found File opened for reading /sys/bus/pci/devices/0000:00:01.3/class Process not Found File opened for reading /sys/bus/pci/devices/0000:00:03.0/irq Process not Found File opened for reading /sys/bus/pci/devices/0000:00:01.1/irq Process not Found File opened for reading /sys/bus/pci/devices/0000:00:05.0/device Process not Found File opened for reading /sys/devices/pci0000:00/0000:00:02.0/device Process not Found File opened for reading /sys/bus/pci/devices/0000:00:01.0/class Process not Found File opened for reading /sys/bus/pci/devices/0000:00:00.0/resource Process not Found File opened for reading /sys/bus/pci/devices/0000:00:01.1/vendor Process not Found File opened for reading /sys/bus/pci/devices/0000:00:01.1/device Process not Found File opened for reading /sys/bus/pci/devices/0000:00:01.1/class Process not Found File opened for reading /sys/bus/pci/devices/0000:00:04.0/resource Process not Found File opened for reading /sys/bus/pci/devices/0000:00:01.3/irq Process not Found File opened for reading /sys/kernel/security/apparmor/features/dbus/mask dbus-daemon File opened for reading /sys/bus/pci/devices/0000:00:01.3/vendor Process not Found File opened for reading /sys/devices/system/cpu firefox File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us firefox File opened for reading /sys/bus/pci/devices/0000:00:06.0/irq Process not Found File opened for reading /sys/bus/pci/devices/0000:00:02.0/irq Process not Found File opened for reading /sys/bus/pci/devices/0000:00:02.0/device Process not Found File opened for reading /sys/devices/pci0000:00/0000:00:02.0/vendor Process not Found File opened for reading /sys/devices/pci0000:00/0000:00:02.0/subsystem_vendor Process not Found File opened for reading /sys/devices/system/cpu Process not Found File opened for reading /sys/devices/system/cpu firefox File opened for reading /sys/devices/system/cpu firefox File opened for reading /sys/bus/pci/devices/0000:00:04.0/vendor Process not Found File opened for reading /sys/bus/pci/devices/0000:00:00.0/vendor Process not Found File opened for reading /sys/bus/pci/devices/0000:00:00.0/device Process not Found File opened for reading /sys/bus/pci/devices/0000:00:03.0/device Process not Found File opened for reading /sys/bus/pci/devices/0000:00:03.0/resource Process not Found File opened for reading /sys/bus/pci/devices/0000:00:00.0/irq Process not Found File opened for reading /sys/bus/pci/devices/0000:00:03.0/class Process not Found File opened for reading /sys/bus/pci/devices/0000:00:06.0/vendor Process not Found File opened for reading /sys/devices/system/cpu firefox File opened for reading /sys/bus/pci/devices/0000:00:01.0/irq Process not Found File opened for reading /sys/bus/pci/devices/0000:00:00.0/class Process not Found File opened for reading /sys/bus/pci/devices/0000:00:05.0/vendor Process not Found File opened for reading /sys/devices/pci0000:00/0000:00:02.0/uevent Process not Found File opened for reading /sys/bus/pci/devices/0000:00:01.0/device Process not Found File opened for reading /sys/bus/pci/devices/0000:00:04.0/device Process not Found File opened for reading /sys/bus/pci/devices/0000:00:06.0/resource Process not Found File opened for reading /sys/bus/pci/devices/0000:00:05.0/resource Process not Found File opened for reading /sys/bus/pci/devices/0000:00:05.0/class Process not Found File opened for reading /sys/bus/pci/devices/0000:00:01.0/vendor Process not Found File opened for reading /sys/bus/pci/devices/0000:00:02.0/vendor Process not Found File opened for reading /sys/bus/pci/devices/0000:00:02.0/class Process not Found File opened for reading /sys/bus/pci/devices/0000:00:05.0/irq Process not Found - Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/filesystems firefox File opened for reading /proc/1781/smaps Process not Found File opened for reading /proc/self/maps firefox File opened for reading /proc/self/fd/40 firefox File opened for reading /proc/self/fd/43 firefox File opened for reading /proc/filesystems xdg-permission-store File opened for reading /proc/filesystems xdg-desktop-portal-gtk File opened for reading /proc/self/fd/50 firefox File opened for reading /proc/filesystems firefox File opened for reading /proc/1564/cmdline Process not Found File opened for reading /proc/self/cgroup firefox File opened for reading /proc/filesystems sed File opened for reading /proc/filesystems firefox File opened for reading /proc/1705/cmdline Process not Found File opened for reading /proc/filesystems xdg-document-portal File opened for reading /proc/self/fd/78 firefox File opened for reading /proc/self/task/1653/stat Process not Found File opened for reading /proc/self/fd/44 firefox File opened for reading /proc/1758/smaps Process not Found File opened for reading /proc/self/task/1788/stat Process not Found File opened for reading /proc/mounts dbus-daemon File opened for reading /proc/1585/cmdline Process not Found File opened for reading /proc/1651/cmdline Process not Found File opened for reading /proc/self/fd/41 firefox File opened for reading /proc/filesystems gvfsd-fuse File opened for reading /proc/filesystems sed File opened for reading /proc/self/fd/31 firefox File opened for reading /proc/filesystems gvfsd File opened for reading /proc/self/fd/6 firefox File opened for reading /proc/1569/status Process not Found File opened for reading /proc/1725/cmdline Process not Found File opened for reading /proc/self/task/1812/stat Process not Found File opened for reading /proc/self/maps firefox File opened for reading /proc/filesystems firefox File opened for reading /proc/self/fd/96 firefox File opened for reading /proc/filesystems sed File opened for reading /proc/filesystems firefox File opened for reading /proc/self/fd/39 firefox File opened for reading /proc/self/fd/51 firefox File opened for reading /proc/self/task/1764/stat Process not Found File opened for reading /proc/1781/statm Process not Found File opened for reading /proc/self/task/1831/stat Process not Found File opened for reading /proc/1569/attr/current Process not Found File opened for reading /proc/self/fd/29 firefox File opened for reading /proc/self/fd/47 firefox File opened for reading /proc/1710/cmdline Process not Found File opened for reading /proc/self/maps firefox File opened for reading /proc/filesystems sed File opened for reading /proc/self/fd/48 firefox File opened for reading /proc/self/maps firefox File opened for reading /proc/1714/cmdline Process not Found File opened for reading /proc/self/fd/75 firefox File opened for reading /proc/self/fd/34 firefox File opened for reading /proc/self/fd/42 firefox File opened for reading /proc/self/fd/49 firefox File opened for reading /proc/self/task/1693/stat Process not Found File opened for reading /proc/filesystems xdg-desktop-portal File opened for reading /proc/filesystems firefox File opened for reading /proc/self/fd Process not Found File opened for reading /proc/filesystems dbus-daemon File opened for reading /proc/sys/kernel/cap_last_cap Process not Found File opened for reading /proc/self/mountinfo Process not Found File opened for reading /proc/1729/cmdline Process not Found File opened for reading /proc/self/maps firefox - Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/firefox/.parentlock firefox
Processes
-
/usr/bin/xdg-openxdg-open "https://785e4b9e.01ce619805ecbd2a7488d402.workers.dev?qrc=YW5uZXNAbXVsbGluc2NoZWVzZS5iaXo="1⤵PID:1563
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager2⤵PID:1564
-
/usr/bin/dbus-launchdbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr3⤵PID:1565
-
-
-
/bin/grepgrep " = \\\"xfce4\\\"\$"2⤵PID:1571
-
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE2⤵PID:1570
-
-
/bin/grepgrep -i "^xfce_desktop_window"2⤵PID:1573
-
-
/usr/bin/xpropxprop -root2⤵PID:1572
-
-
/bin/grepgrep -q "^Enlightenment"2⤵PID:1575
-
-
/bin/unameuname2⤵PID:1576
-
-
/bin/grepgrep -q "^file://"2⤵PID:1578
-
-
/bin/egrepegrep -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1580
-
-
/usr/local/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1580
-
-
/usr/local/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1580
-
-
/usr/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1580
-
-
/usr/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1580
-
-
/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1580
-
-
/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1580
-
-
/usr/bin/xdg-mimexdg-mime query default x-scheme-handler/https2⤵PID:1584
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager3⤵PID:1585
-
/usr/bin/dbus-launchdbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr4⤵PID:1586
-
-
-
/bin/grepgrep " = \\\"xfce4\\\"\$"3⤵PID:1588
-
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE3⤵PID:1587
-
-
/bin/grepgrep -i "^xfce_desktop_window"3⤵PID:1590
-
-
/usr/bin/xpropxprop -root3⤵PID:1589
-
-
/bin/grepgrep -q "^Enlightenment"3⤵PID:1592
-
-
/bin/unameuname3⤵PID:1593
-
-
-
/usr/bin/whichwhich firefox2⤵PID:1639
-
-
/usr/bin/firefox/usr/bin/firefox "https://785e4b9e.01ce619805ecbd2a7488d402.workers.dev?qrc=YW5uZXNAbXVsbGluc2NoZWVzZS5iaXo="2⤵PID:1651
-
/usr/bin/whichwhich /usr/bin/firefox3⤵PID:1652
-
-
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox "https://785e4b9e.01ce619805ecbd2a7488d402.workers.dev?qrc=YW5uZXNAbXVsbGluc2NoZWVzZS5iaXo="2⤵
- Reads user data of web browsers
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
PID:1651 -
/usr/bin/dbus-launchdbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr3⤵PID:1662
-
-
/usr/local/sbin/dbus-launchdbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr3⤵PID:1702
-
-
/usr/local/bin/dbus-launchdbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr3⤵PID:1702
-
-
/usr/sbin/dbus-launchdbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr3⤵PID:1702
-
-
/usr/bin/dbus-launchdbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr3⤵PID:1702
-
-
-
/usr/bin/dbus-daemon/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1567
-
/bin/sedsed -n "s/\\(^[[:alnum:]+\\.-]*\\):.*\$/\\1/p"1⤵
- Reads runtime system information
PID:1583
-
/bin/sedsed "s/:/ /g"1⤵
- Reads runtime system information
PID:1596
-
/usr/bin/cutcut -d ";" -f 11⤵PID:1604
-
/usr/bin/cutcut -d "=" -f 21⤵PID:1603
-
/usr/bin/headhead -n 11⤵PID:1602
-
/bin/grepgrep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache1⤵PID:1601
-
/usr/bin/cutcut -d ";" -f 11⤵PID:1609
-
/usr/bin/cutcut -d "=" -f 21⤵PID:1608
-
/usr/bin/headhead -n 11⤵PID:1607
-
/bin/grepgrep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache1⤵PID:1606
-
/usr/bin/cutcut -d ";" -f 11⤵PID:1614
-
/usr/bin/cutcut -d "=" -f 21⤵PID:1613
-
/usr/bin/headhead -n 11⤵PID:1612
-
/bin/grepgrep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache1⤵PID:1611
-
/usr/bin/cutcut -d ";" -f 11⤵PID:1619
-
/usr/bin/cutcut -d "=" -f 21⤵PID:1618
-
/usr/bin/headhead -n 11⤵PID:1617
-
/bin/grepgrep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache1⤵PID:1616
-
/usr/bin/cutcut -d ";" -f 11⤵PID:1624
-
/usr/bin/cutcut -d "=" -f 21⤵PID:1623
-
/usr/bin/headhead -n 11⤵PID:1622
-
/bin/grepgrep "x-scheme-handler/https=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache1⤵PID:1621
-
/bin/sedsed "s/:/ /g"1⤵
- Reads runtime system information
PID:1627
-
/bin/sedsed -e "s|-|/|"1⤵PID:1630
-
/bin/sedsed -e "s|-|/|"1⤵
- Reads runtime system information
PID:1633
-
/usr/bin/cutcut "-d=" -f 2-1⤵PID:1638
-
/usr/bin/cutcut "-d=" -f 2-1⤵PID:1642
-
/usr/bin/cutcut "-d=" -f 2-1⤵PID:1645
-
/usr/bin/cutcut "-d=" -f 2-1⤵PID:1650
-
/usr/bin/lsb_release/usr/bin/lsb_release -idrc1⤵PID:1676
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -parentBuildID 20230522134052 -prefsLen 19257 -prefMapSize 230809 -appDir /usr/lib/firefox/browser "{3b2bb336-47a9-4a75-a9dc-46f28b25a26c}" 1651 true socket1⤵
- Changes its process name
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1690
-
/usr/libexec/xdg-desktop-portal/usr/libexec/xdg-desktop-portal1⤵
- Reads runtime system information
PID:1705
-
/usr/libexec/xdg-document-portal/usr/libexec/xdg-document-portal1⤵
- Reads runtime system information
PID:1710
-
/usr/libexec/xdg-permission-store/usr/libexec/xdg-permission-store1⤵
- Reads runtime system information
PID:1714
-
/usr/libexec/xdg-desktop-portal-gtk/usr/libexec/xdg-desktop-portal-gtk1⤵
- Reads runtime system information
PID:1725
-
/usr/lib/gvfs/gvfsd/usr/lib/gvfs/gvfsd1⤵
- Reads runtime system information
PID:1729
-
/usr/lib/gvfs/gvfsd-fuse/usr/lib/gvfs/gvfsd-fuse /root/.gvfs -f -o big_writes1⤵
- Reads runtime system information
PID:1734
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 21684 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{0dd08803-2b4d-465b-bc99-ea0bfa241e20}" 1651 true tab1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1758
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 2 -isForBrowser -prefsLen 21352 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{668ed51a-f4ff-41f9-be4e-9a98a3475920}" 1651 true tab1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1781
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 3 -isForBrowser -prefsLen 21824 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{41b85ca5-4c2d-4447-9602-437f5a16a40e}" 1651 true tab1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1809
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 4 -isForBrowser -prefsLen 27881 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{5f6be885-d3ab-40c0-a30c-1d51ed6808bc}" 1651 true tab1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1827
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /root/.cache/dconf/user
- Size 2B
- SHA256 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
- MD5 c4103f122d27677c9db144cae1394a66
- SHA1 1489f923c4dca729178b3e3233458550d8dddf29
- SHA512 5ea71dc6d0b4f57bf39aadd07c208c35f06cd2bac5fde210397f70de11d439c62ec1cdf3183758865fd387fcea0bada2f6c37a4a17851dd1d78fefe6f204ee54
- MD5 SHA1 SHA512
- Path /root/.cache/mozilla/firefox/cbjaajux.default-release/cache2/entries/3D1E19D09F398691ABF62061591970855193B42F
- Size 13KB
- SHA256 a5ec75147f4f857eac7bc4dd6dc1e0fbff7633a3d8956668e96b9c75b9b77a0b
- MD5 6a1dc5725014dd975420ad51f6940d22
- SHA1 89b28a6c4b01b5df15afbd73e6f6a630d3cf2704
- SHA512 a855179f3d24d990875edadb18f6701ec4634df838b29b81248f660c1066531852ef8796710f1a6d2f05b161777ff7dbaf7f90dcf760f883c43ce84f1b620f9b
- SSDEEP 384:TR+iAUHUZZuFhI6edRutphgg4KA89nYQ09nYQE:TR+NwUZZYhDedRuXhgg4u
- MD5 SHA1 SHA512 SSDEEP
- Path /root/.dbus/session-bus/11c67417355f45d397f6be11f62e85a6-0
- Size 466B
- SHA256 586f2c96e3b8b13117a33011c6daf3c4936bde2581f4eff3d2e573cb0062c0c5
- MD5 0f1f19e5e69c54a5db5111cf1891cfe0
- SHA1 940dcdaa9f8268d0a8e23307b24610406b2ae1d1
- SHA512 60f4bc4858638251d6e97f04876e6db7a36f6776e11dbd228cf598b35c5d1623a56b0c21f85cb80e455565c88f8656f0443d350d56c93a4687292f649269a1e6
- MD5 SHA1 SHA512
- Path /root/.mozilla/firefox/Crash Reports/InstallTime20230522134052
- Size 10B
- SHA256 2afd59977dcd6e9fa1b029330ae3bae5c672c75bf13f10da185936ac0a5efbcc
- MD5 9933d3d32a38a865f4aefe70694d7b93
- SHA1 afe3ba4511a434ee0b0208e4212de3aeba5230d2
- SHA512 11efa5582883f2eacffa2bd59d6659b7ccfa4689c06162c1a416e98caf078a7e954dc19ea80829545a07af9f082a8eb5d3f49fc9d829ebb547e54f3674810772
- MD5 SHA1 SHA512
- Path /root/.mozilla/firefox/cbjaajux.default-release/cert9.db
- Size 224KB
- SHA256 b83cd91f0ec16d7571aa5cd137ab2a06a2e9effd3b0a86d659af0c23dec0f084
- MD5 394b1cd5bb266742d191bd2cce1cb448
- SHA1 a5c26531efb1d9a315c1a491fca1d0679b5013ee
- SHA512 f1af932da9baa3d3e6a83076c4170723e546696a28f33eb992bcce6a52fab1e6312e458d40bfaec533f427483956fa5f85cb1e227153ae5305c4d93cb803fbbf
- SSDEEP 192:4iOFva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23v0QTSu8U:S1zkVmvQhyn+Zoz67wN8U
- MD5 SHA1 SHA512 SSDEEP
- Path /root/.mozilla/firefox/cbjaajux.default-release/compatibility.ini
- Size 163B
- SHA256 d5bfb07561606a19aa96557ea109b175050dc0eb805cbef9c813503587d77900
- MD5 fe452b7294d5928a9a5863b89ee0a6bd
- SHA1 a5d4c245071fa96476ba48b4725bdae7f1b7940f
- SHA512 dc37d8507f08849e3382d2dbafd4a64555dbd57a288c95131e9aefb366630f1585811a9e1456b861bb9d2b816ed88b18ffb7580cd92b41bb9b0227ce1363843e
- MD5 SHA1 SHA512
- Path /root/.mozilla/firefox/cbjaajux.default-release/cookies.sqlite
- Size 96KB
- SHA256 c53c15fcfac2bb57fdc88d23f932fc244dbaf4020f0f6eaecf0f77a37c21f8c5
- MD5 9535f5fe817accc769c2c1d3354db39f
- SHA1 6af62cf08717cf3bfa84eb1a7b311acf522ce560
- SHA512 dc9c2c32eb42dda0a7a711e143aea58c603c1e9d885c3677e9fe86f525e1b0b32a46e240756263e56510b07e764ba69f2de13b90ec18210678242e10cfe17837
- SSDEEP 12:DBl/JAxJfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DLJAPff32mNVpP965Ra8KN0MG/lO
- MD5 SHA1 SHA512 SSDEEP
- Path /root/.mozilla/firefox/cbjaajux.default-release/cookies.sqlite
- Size 96KB
- SHA256 3a8ce2b07e3e8678a13aa58ef5b942c4dccd8f9c84511bdeb8847ef270797e27
- MD5 5caa766855d5613a999f71b7812d6451
- SHA1 ad0d9a52a0d5cc7f11858301dbe47377ed99ee37
- SHA512 17bb0f4c87ec178910795b25ce85e74cf599190c769592472c3e872f42930c93f28faf0ff3e448816a9abcc8af0459852bed52bee08cfe25d068879c6dfd8eba
- SSDEEP 12:DQAaJfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQA+ff32mNVpP965Ra8KN0MG/lO
- MD5 SHA1 SHA512 SSDEEP
- Path /root/.mozilla/firefox/cbjaajux.default-release/key4.db
- Size 288KB
- SHA256 00ddd10b580eb1945375edae08f0fcbcc6d5bcbdc8627ea35358022f8a42a7b6
- MD5 e35f62784f4308fda78f535629f25c16
- SHA1 dc93cacf6e7603d647c082ed826dae0452ef590c
- SHA512 5421b4208ceac12b43e1fa1bfb211457d7a5628ec3a4f5f4b4a69d3bf98868e371e294f8b0b56dd02f5062bed3b14582c02f83c3493f8bf4336797b2c22cfc68
- SSDEEP 192:3va0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vt:31zkVmvQhyn+Zoz67c
- MD5 SHA1 SHA512 SSDEEP
- Path /root/.mozilla/firefox/cbjaajux.default-release/permissions.sqlite
- Size 96KB
- SHA256 d88bf367aaf79efbb2e8fbdb1dc5bde1c1c3a53e0f4d8188027a63ec55d5f5f0
- MD5 232fbc22dd03a8ec41edde02bdbea61c
- SHA1 6ab4b39bca95418c52f7f861fd39e5fddb9cc7b6
- SHA512 055f1595f4a327347671db53cec8d89a310109d3f871c567e3d5b654b956fc0369d12437f7dc6d9327b973008f1327ee0dfdb5504f1b3cbe00da29941b1e5892
- SSDEEP 12:DBl/ELWla0mwPxRymgObsCVR45wcYR4fmnsCVR4Y:DLEL5sh7Owd4+v
- MD5 SHA1 SHA512 SSDEEP
- Path /root/.mozilla/firefox/cbjaajux.default-release/prefs-1.js
- Size 1KB
- SHA256 89098a78c9a993d52c0c984e73b310aa214aac0553cf1c635ddc72e89c606ea3
- MD5 6ab77fc42e186a3bb56f225defbfa174
- SHA1 70608f05e40bcac293882671152bfc5ab83cc91b
- SHA512 a697cae6131d60e264c7c9f725669d2e18ab11dc0ce6d83bdd1b5883360605da9086203c14e5226021adb7426bc3afe8cc2feebab95712e45ffcab51dc82bc9d
- MD5 SHA1 SHA512
- Path /root/.mozilla/firefox/cbjaajux.default-release/prefs-1.js
- Size 1KB
- SHA256 4f48b5cf6ea221aa6e6d7eb0b60bbfaeed7e968e4846e3050bc105c0f3e29017
- MD5 7d6a978713ad1dfc6fe3c59da8897635
- SHA1 bac559c6d97c5f53db4bfa31c6b479457a7e9823
- SHA512 7df79ea3d8cf5c3bf446334d2eef5a1bb6c95de2a3e85195cfeaaba5ef75355bf5dd3eda050e78e5727cb6eefeb23e59aeb896cbc83b52b22fea65b882561a6c
- MD5 SHA1 SHA512
- Path /root/.mozilla/firefox/cbjaajux.default-release/prefs-1.js
- Size 2KB
- SHA256 b3fb7e16cf683588ac868ffef450effc3639c85feff40f6c0cb0955fe16a3e7e
- MD5 e6118e3a2d334b5b6073794ef8fcd9a3
- SHA1 4f18b74552845714717b8b5a49f28f28a041ad10
- SHA512 2af1664bf1cdc9a93d5da2f7318022a96dd0db8c4faba676f24e00515f6155de3eec3e1c2dd8ac0334ccddd262405ebce6f7946404c2a2616afe82b1908df1cb
- MD5 SHA1 SHA512
- Path /root/.mozilla/firefox/cbjaajux.default-release/prefs-1.js
- Size 2KB
- SHA256 8432eb135116113c41929989fc330407c7b7139f7ccc731ce00bf305e833ff74
- MD5 e6862ee20e56b9fdcc9dbdc130c005fe
- SHA1 1969b3c97fdf316b468eecbd81927428d3221c07
- SHA512 7d9056483ca25b0ff2aa003ef4a5eb000b867b3f9422d8f343b72b40eaf6f155ccdf91002eeecff9afa1eb3ba88fe69fb6d27de4aa1affe8d9ae8ed81cf4e5c9
- MD5 SHA1 SHA512
- Path /root/.mozilla/firefox/cbjaajux.default-release/prefs-1.js
- Size 3KB
- SHA256 b96b7e5a44ddb5e027ad50431b3ae31655bc44dab0bda753bf0b2ac0cb3f107d
- MD5 c4e689a1dc91097e8c61c9e7ab3b622e
- SHA1 1b5d8852bc919c6f7bdc5906814540184b2e0626
- SHA512 81b87cbaa1e2c6464e1ca3529363f0269e4ad6cb1b10644a3df3550b05a4b7c14359949ea62118b481ab9433556225b01d7ae16a97787262136c512cfb84d068
- MD5 SHA1 SHA512
- Path /root/.mozilla/firefox/cbjaajux.default-release/prefs-1.js
- Size 4KB
- SHA256 cb7d1ce42bb3fb1dc62a1cde60b0770d748a3ac03bd4033cbf44cac067c532b9
- MD5 c854f69b046de0e06d1af2b3829d6b55
- SHA1 f18d2b40786ce91b748632697d30fd9005f42e50
- SHA512 5b42c3422da0759feebd6e5fc1d43643eb4178df4cc09f1a7d3cdf4305a03a72aee3d5ab10155c5b666812a8bba943bbb02c2ba2d643543847c0b4dacfa1fb88
- SSDEEP 96:oSgqjqgEq9IzGz+dzhFyheLKTqZdcfp84AS:3uw9Cpyh3q7Sp85S
- MD5 SHA1 SHA512 SSDEEP
- Path /root/.mozilla/firefox/cbjaajux.default-release/prefs.js
- Size 919B
- SHA256 7e9c699fa7bed0e4830425cda2767d8cd02b27cbed9ef459f84f8c22a7f5acca
- MD5 b9d0cf143e29146e1794442bfcdd11e3
- SHA1 a9e1ae5e6db51ceb03e560ac790add8e94e1c2a1
- SHA512 f0d97f6b259bcb6ad004f44416f1f1f3d5e315fb8170aab092b2bfb2bd5739664baaaa92f7045dd7947073f71c7cf0d6051d95bd2ef8dc5298bed5646874a268
- MD5 SHA1 SHA512
- Path /root/.mozilla/firefox/cbjaajux.default-release/storage/ls-archive.sqlite
- Size 96KB
- SHA256 0d4cb11f6364c46a75f9eaddfca5c660b90dfd515df3afcd5e0baeca28a0f1ab
- MD5 e0c613bfd69956a19ce2dc5e925aa223
- SHA1 14accb230edcd6cb76967cdc6d4e5686db96b5df
- SHA512 01643c0131a392be92b3f281d7f633c1f502bff19090b0d716f1ac66aefecc3fcf92f393bef66b03089c9b9c6d8aaeb711b6a4f29d5a6729dd188c838f2272d1
- SSDEEP 12:DBl/iu6aE7Rzhm9GiD0c4NCcVUo58cz16D:DLiu6aEV0wiD0/nZ82
- MD5 SHA1 SHA512 SSDEEP
- Path /root/.mozilla/firefox/cbjaajux.default-release/storage/ls-archive.sqlite
- Size 128KB
- SHA256 7b0050f1bfaab85c8f9067ae7d7369056ff752c0c852ef1462a96c22169004d4
- MD5 178d71e5529d637ac62f7e75fdd75896
- SHA1 339f2b949cc4c207b66aea11137448ba28d36dcb
- SHA512 ec0e0105fcfbbae356dd55efbcf92975f35bbe5cb93fcabf4c08443e871957635d14830b27c4e1ddefbbaff8f9b7ec3590bf417a9442e1d7ee3607d14d56f664
- SSDEEP 12:DBl/iu6aE7Rzhm9GiD0c4NCcVUo58cz16DTE:DLiu6aEV0wiD0/nZ82aE
- MD5 SHA1 SHA512 SSDEEP
- Path /root/.mozilla/firefox/cbjaajux.default-release/storage/permanent/chrome/.metadata-v2-tmp
- Size 42B
- SHA256 0a2c052faf111c4d5411aa4b86653a19755425b5619db6be29b7e3acf35302c9
- MD5 89193f23a8ea99561f9e65108f61228b
- SHA1 5fbe22f77d3293ff68e265e6e807584efe2d4b4e
- SHA512 270281cc8de1a9a0c886ea177d232c3734d1632e9f15ef1f232774aefa3fa172523787c3687fbf0224fec0926ea0aa2036a148581f72caabf58495d3feb123d3
- MD5 SHA1 SHA512
- Path /root/.mozilla/firefox/cbjaajux.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite
- Size 44KB
- SHA256 e5b0d02c18ae36c4a220f41fd97c66060c17aaafcbb324a57ccdc2707c44c4ec
- MD5 a8dd7ebaad5528b23f82ccb1534cea18
- SHA1 600daceacfb5cf9df0b66ba7dce4516b2ac4df70
- SHA512 67f867a8e2b37fb6bececd5ebc570ca594ea329142badd63d1281d5e735f515a5e329abc6eb9a9d3465aab0a08541b4888018d859964f160a52345ab93532bff
- SSDEEP 48:TdOA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyE:p16S6CKnqlizbxV+2xVeU7X2B0
- MD5 SHA1 SHA512 SSDEEP
- Path /root/.mozilla/firefox/cbjaajux.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite
- Size 12KB
- SHA256 d6409111c7903216abd4bbe117da2eb3cf2e39b146ea9929c72b758972687ceb
- MD5 a7d93a633bc0a2551a0201f5372d018a
- SHA1 c223907513efffed99284365cfa3fe7bf9b0ea2a
- SHA512 51c21cc6d3a51e1f50ba0956f967070e5efb207344d73ef5ea83ff1e334be634ac3c66da1627b8f48a3eb948ceaffdeca519faa3f2a11d86b1f9f0773717da4d
- SSDEEP 3:eqpwpxNWIimuGAIaJJblYtn:eSSYGcJbmn
- MD5 SHA1 SHA512 SSDEEP
- Path /root/.mozilla/firefox/cbjaajux.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite
- Size 44KB
- SHA256 7a462086a26978809c719e57a7ea6a25568767fb7532014e8531fda94b660e0a
- MD5 7352c8848e88edc39b7fb5e663888187
- SHA1 8c3dffe25cc56c7aec1b782292d6fceed81e6304
- SHA512 f2a0dbbab5c2c1702b03bce15a47739481f523e127d1372b40534db9a20b2bc99fb53710ee0e5d44176188817cac704cf4f98cdf087e7e89d244281fcfc3b280
- SSDEEP 48:TdOA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyE+ZkB:p16S6CKnqlizbxV+2xVeU7X2B0+ZK
- MD5 SHA1 SHA512 SSDEEP
- Path /root/.mozilla/firefox/cbjaajux.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite
- Size 12KB
- SHA256 bbb3af5039524966ebee1d3301c40b5fd9b0e1923412ed247d8c7af8997258c6
- MD5 f3e3a01a48fea5274c3c0c876be2463b
- SHA1 623e00a6cb2eff24045d34a757d5d5cc29fff1f2
- SHA512 8263f3ce093ace9840e3b301a64b59c0b9c7cc98d13ce937395e7e75e27fc445d2cd885602d9a2e4b0928d4bbce8b3eff7e2508faca15f65fa47b507efcd4647
- SSDEEP 3:eq8rtwmk3Qc2EBl/:e5o3QcnBd
- MD5 SHA1 SHA512 SSDEEP
- Path /root/.mozilla/firefox/cbjaajux.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite
- Size 44KB
- SHA256 1bd2000cd972e80cefaec6e982ba261d224a818f367de0fdf8c51fa5a05d7ab5
- MD5 759544297aaa61f5fef8ee42d0ae4393
- SHA1 fc2d66f6e60409e3e8d38623ce5f817fc7f571e0
- SHA512 8aaa2ce66f10d46f7c9200af841ac7bd9f5b55c30308a14f0deda44ac62581c45daae45154487c0073a0d5847d5926cbb4072ca64a702ac6b834ad0bb482804f
- SSDEEP 48:TdOA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyE:p16S6CKnqlizbxV+2xVeU7X2B0
- MD5 SHA1 SHA512 SSDEEP
- Path /root/.mozilla/firefox/cbjaajux.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite
- Size 12KB
- SHA256 a1005d2c0f5a732fed7ceeb169e67db9a0a1e25f031349804005538b6152c1c2
- MD5 e12bc0d2a3359cccfe5a89e7d4a5eebb
- SHA1 24ba9e990c19c9f9e5ce3d0cd5f285d5b7f18f68
- SHA512 a470a5b795e995b4607e58aa4e59e51de7147a34fdef715a8dbc8e5633745a7c505506c956a7a51a1e5cf78bafcb22167b631e8b5c845603a5e5da0a69a6832b
- SSDEEP 3:eqM/tllYAWfJBGwHymllln:eDllMfmm/l
- MD5 SHA1 SHA512 SSDEEP
- Path /root/.mozilla/firefox/cbjaajux.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite
- Size 44KB
- SHA256 da640f8b665841b520d2262a21cc3f82aeaa881cf81a1ddae27ef501d66544e4
- MD5 07a412e08825220262ad2890757ff779
- SHA1 f46c127dbc070ded87a6078b3c1c761955f96de8
- SHA512 0134c783bf3293848e479b478ac57a1e0f4202cddfb8b57bc6275aada7345f398cf8a627e9b1c34fd618192c2f0c9737b1da487daf33f9c557ebc1377105582b
- SSDEEP 48:TdOA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyE:p16S6CKnqlizbxV+2xVeU7X2B0
- MD5 SHA1 SHA512 SSDEEP
- Path /root/.mozilla/firefox/cbjaajux.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite
- Size 12KB
- SHA256 68b2b8009a69f335c7fa9f7fa8df2988f0e004b266f7594b44b33920fcb6a084
- MD5 924bd8d85904c2d6be88d11f3139f85e
- SHA1 1a7b0aee26fd5335875ff6c19139277ac29b033d
- SHA512 3dda96f00b2d5bb9bf76fd385c9975f94a10cbb3985ea83554c9b6cdbcb0ca9458e675ad720c2ab579e13d828017657e7ba608d6ad52af1bcacf99e515e36004
- SSDEEP 3:eq9w9A8RXW0maDAD/:eG2YjaDQ
- MD5 SHA1 SHA512 SSDEEP
- Path /root/.mozilla/firefox/cbjaajux.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite
- Size 164KB
- SHA256 4e06bb7d285181c51607caff6a05836c4b053b1fd2c421e0a37d573984682cd5
- MD5 b70e9721c9d5bc529aa652895c415c15
- SHA1 f47d32e761fc016fba1af29ec6fd83c0ee2a0d4f
- SHA512 966db986b65f092da9d101e4a6e38693b11c95ead9cd7b9cff7789e1b976edf3f6c6df0a918ca0f17c12143ff31d8b64438609ce055a7969b3287577d4e5ea04
- SSDEEP 768:p6S6CrAWxusb0ozPDUX0PKO3syNJxjQvzN/1gNV/0dZDLWZ09OI64vl14sfLeMqL:p6S6Upb/PDrQondNVAXWg62qsSMq6bfg
- MD5 SHA1 SHA512 SSDEEP
- Path /root/.mozilla/firefox/cbjaajux.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite
- Size 148KB
- SHA256 5cc6fa137a1f3a7d0b615b178877f12c460b22f95702eb7534d5732ee6599561
- MD5 dd3f6ba37c670af5953593535e435d04
- SHA1 ecfe4e650a050bce77e8ff7468de04c1b8acc9a4
- SHA512 86e0482543faae6fb279ca71e1e6d6461d32317e74baebb3973e0fde9800107faeb9c2347be6cf8a47556ae43c8e6c224a595e952f621e40ad2c5eba920df2b3
- SSDEEP 192:RMopKAyab0xSAj7gCXV8YaSRAvhNGkEXof90:RMNAyaYj7laSRehwkeb
- MD5 SHA1 SHA512 SSDEEP
- Path /root/.mozilla/firefox/cbjaajux.default-release/times.json
- Size 50B
- SHA256 4d36508101e472204a6612b8d876ed6e73cfb92e1416cb357a3a953fcdfc3765
- MD5 c6ed257b2a841e1b4c6bfe8a9ee62812
- SHA1 e70fdab3192a164c8e3bed2116abc6d56e31ba2e
- SHA512 7d6e17c4dd8353ca5cab56673a92755601cffe4d0d58b78e2eaa05161f6fe14f94e643b2bd9dd901fa256f29ab94967ca9247b5ce64a3544315daf6d45f2a945
- MD5 SHA1 SHA512
- Path /root/.mozilla/firefox/cbjaajux.default-release/times.json
- Size 47B
- SHA256 ad1573bd979620d523ab74eea63011a3ddfe021ff02149ecd09333f929633f5d
- MD5 0a43349f815a657381629b8d7eb3b5e0
- SHA1 1cc51830d7f27a2962cc98392b953bfe60aebe1e
- SHA512 6bbaa0e4a3cc4dab1b70fa3f015a22e3b8bd2306883abf592933a78595db6d07c683d4aef0c0458b5d444392e5ddc3c465ebba0592bf5ec10dd22ca510d6a13b
- MD5 SHA1 SHA512
- Path /root/.mozilla/firefox/installs.ini
- Size 62B
- SHA256 c1eb2166dca31eb3f62828639ade9d2f950dc220d2e3658ba6493911c46f279c
- MD5 d4dff3879b24d8153e68834fe5a3fa80
- SHA1 5d3847b0ce15137a29f8d355002f2d81dbf9354f
- SHA512 139de417b65bf905e47dc6dd0c78de0ca6ed2c64b1440c7d8e7d566f1a8790e235cfa5b98ce272289e9b7931cdd458669286d3adb48ad610d9cac4e6122127b5
- MD5 SHA1 SHA512
- Path /root/.mozilla/firefox/profiles.ini
- Size 259B
- SHA256 6f11db61fe4e3256ed68a4b3b7eb44ad20a52cced84780699c7f2ba003aaf7b6
- MD5 da456d6f8ef4c14246ad74b681ad41a9
- SHA1 f2ed75939b54dca69e99b491b029a92763c408bd
- SHA512 c2399d746f5a15697857117169fbd37e9f235cc6474b4b1f75ebb20064d1ba722b425322e4e9347824a1ab458c78f5df45dbb39b573ef678e9714cef9c1e5e1a
- MD5 SHA1 SHA512
- Path /root/.mozilla/firefox/yakakxg3.default/times.json
- Size 47B
- SHA256 22302df9c611ececc15b533c11cae77d8a08f7bf5454206da97f497f5a8ed429
- MD5 9c29e7f792677d89678f147d4eed8e40
- SHA1 86f2599634e8fc9fb14ed4950fb219630f8d11d3
- SHA512 335a13cbfc441fc0d94d77b6403889626c63df41e0d14d423f3f586f33462137dc3a238600fa38ad418740bb5adbbbc1725cf3f56551b41a8ae966a5493de386
- MD5 SHA1 SHA512