hxxps://eblast[.]ewu[.]edu/t/y-l-xtdkiut-dkhilywdt-r/

max time kernel
9s
max time network
38s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240226-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
05/04/2024, 06:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://eblast.ewu.edu/t/y-l-xtdkiut-dkhilywdt-r/

Score

7^/10

antivm spyware stealer

Malware Config

Signatures

Changes its process name 64 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	glean.dispatche	1661	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1662	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1662	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1662	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1665	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1667	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1666	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1667	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1665	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1666	Process not Found
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1664	Process not Found
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1664	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1663	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1663	Process not Found
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1668	Process not Found
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1668	Process not Found
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1670	Process not Found
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1670	Process not Found
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1672	Process not Found
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1672	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cache2 I/O	1673	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cookie	1674	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cookie	1674	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1675	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1675	Process not Found
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #1	1677	Process not Found
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #0	1676	Process not Found
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1678	Process not Found
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1678	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	1679	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	1679	Process not Found
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	1680	Process not Found
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	1680	Process not Found
Changes the process name, possibly in an attempt to hide itself	IndexedDB #1	1691	Process not Found
Changes the process name, possibly in an attempt to hide itself	IndexedDB #1	1691	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC Launch	1694	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC Launch	1694	Process not Found
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	1693	Process not Found
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	1693	Process not Found
Changes the process name, possibly in an attempt to hide itself	Breakpad Server	1692	Process not Found
Changes the process name, possibly in an attempt to hide itself	Sandbox Forked	1695	Process not Found
Changes the process name, possibly in an attempt to hide itself	DOM Worker	1696	Process not Found
Changes the process name, possibly in an attempt to hide itself	DOM Worker	1696	Process not Found
Changes the process name, possibly in an attempt to hide itself	Chroot Helper	1697	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #5	1701	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #5	1701	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #4	1700	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #4	1700	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #3	1699	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #3	1699	Process not Found
Changes the process name, possibly in an attempt to hide itself	MainThread	1695	firefox
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1702	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1702	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1702	Process not Found
Changes the process name, possibly in an attempt to hide itself	FSBroker1695	1703	Process not Found
Changes the process name, possibly in an attempt to hide itself	FSBroker1695	1703	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Process	1695	firefox
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1704	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1704	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1705	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1705	Process not Found
Changes the process name, possibly in an attempt to hide itself	ProfilerChild	1706	Process not Found
Changes the process name, possibly in an attempt to hide itself	ProfilerChild	1706	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1707	Process not Found

Reads user data of web browsers 64 IoCs

Reads stored browser data which can include saved credentials.

spyware stealer

description	ioc	Process
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/places.sqlite	firefox
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/extensions.json	Process not Found
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/cookies.sqlite-journal	firefox
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/times.json	Process not Found
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/cert9.db	Process not Found
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/storage/permanent/chrome	Process not Found
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/key4.db-journal	firefox
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/AlternateServices.txt	Process not Found
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/xulstore.json	firefox
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/favicons.sqlite	firefox
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/favicons.sqlite-journal	firefox
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/cookies.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/system-extensions	firefox
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/permissions.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/key4.db	firefox
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/ClientAuthRememberList.txt	Process not Found
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/compatibility.ini	firefox
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/SiteSecurityServiceState.txt	Process not Found
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/shield-preference-experiments.json	Process not Found
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/storage	Process not Found
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/sessionCheckpoints.json	Process not Found
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/user.js	firefox
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/cookies.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/extension-preferences.json	Process not Found
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/storage/ls-archive.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/sessionstore-backups/previous.jsonlz4	Process not Found
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/ExperimentStoreData.json	Process not Found
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/bookmarkbackups	Process not Found
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/sessionstore.jsonlz4	Process not Found
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/extension-settings.json	Process not Found
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/storage.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/places.sqlite-journal	firefox
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/key4.db	Process not Found
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/addonStartup.json.lz4	firefox
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/sessionstore-backups/recovery.jsonlz4	Process not Found
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/cert_override.txt	firefox
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/cert9.db-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/addons.json	Process not Found
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/favicons.sqlite-wal	firefox
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/protections.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/sessionstore-backups/recovery.bak	Process not Found
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/content-prefs.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/thumbnails	Process not Found
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release	Process not Found
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/storage.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/handlers.json	firefox
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/cert9.db-journal	firefox
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release	firefox
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/sessionstore-backups/recovery.baklz4	Process not Found
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/sessionstore-backups/previous.js	Process not Found
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/cookies.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/cookies.sqlite	firefox
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/storage/ls-archive.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/cert9.db	firefox
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/7i2txps6.default-release/storage/temporary	Process not Found

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc
File opened for reading	/proc/cpuinfo

Reads CPU attributes 1 TTPs 12 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq	Process not Found
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/size	Process not Found
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/size	Process not Found
File opened for reading	/sys/devices/system/cpu/present	Process not Found
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox

Enumerates kernel/hardware configuration 1 TTPs 61 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/vendor	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/kernel/security/apparmor/features/dbus/mask	dbus-daemon
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/class	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/class	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/device	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/class	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/resource	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/resource	Process not Found
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/class	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/uevent	Process not Found
File opened for reading	/sys/devices/system/cpu	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/irq	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/device	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/self/fd/49	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/filesystems	gvfsd
File opened for reading	/proc/self/fd/35	firefox
File opened for reading	/proc/self/task/1796/stat	Process not Found
File opened for reading	/proc/1840/statm	Process not Found
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/fd/48	firefox
File opened for reading	/proc/1840/smaps	Process not Found
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/mounts	dbus-daemon
File opened for reading	/proc/self/fd/38	firefox
File opened for reading	/proc/self/fd/51	firefox
File opened for reading	/proc/self/cgroup	firefox
File opened for reading	/proc/1767/smaps	Process not Found
File opened for reading	/proc/1817/statm	Process not Found
File opened for reading	/proc/self/fd/36	firefox
File opened for reading	/proc/self/fd/43	firefox
File opened for reading	/proc/self/fd/46	firefox
File opened for reading	/proc/filesystems	gvfsd-fuse
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/mountinfo	firefox
File opened for reading	/proc/self/fd/40	firefox
File opened for reading	/proc/1737/cmdline	Process not Found
File opened for reading	/proc/self/fd/74	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/task/1650/stat	Process not Found
File opened for reading	/proc/self/fd/50	firefox
File opened for reading	/proc/self/fd/34	firefox
File opened for reading	/proc/self/fd/47	firefox
File opened for reading	/proc/1742/cmdline	Process not Found
File opened for reading	/proc/self/stat	Process not Found
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/1713/cmdline	Process not Found
File opened for reading	/proc/self/fd/73	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/fd/118	firefox
File opened for reading	/proc/self/mountinfo	Process not Found
File opened for reading	/proc/self/task/1698/stat	Process not Found
File opened for reading	/proc/1789/smaps	Process not Found
File opened for reading	/proc/self/task/1820/stat	Process not Found
File opened for reading	/proc/1817/smaps	Process not Found
File opened for reading	/proc/filesystems	xdg-desktop-portal
File opened for reading	/proc/filesystems	xdg-document-portal
File opened for reading	/proc/self/fd/39	firefox
File opened for reading	/proc/self/fd/6	firefox
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/1718/cmdline	Process not Found
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/fd/93	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/task/1872/stat	Process not Found
File opened for reading	/proc/1582/cmdline	Process not Found
File opened for reading	/proc/self/fd/42	firefox
File opened for reading	/proc/1648/cmdline	Process not Found
File opened for reading	/proc/self/fd/29	firefox
File opened for reading	/proc/self/fd/44	firefox
File opened for reading	/proc/filesystems	xdg-desktop-portal-gtk
File opened for reading	/proc/self/fd/119	firefox
File opened for reading	/proc/self/fd	Process not Found
File opened for reading	/proc/1566/status	Process not Found

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/firefox/.parentlock	firefox

/usr/bin/xdg-open
xdg-open https://eblast.ewu.edu/t/y-l-xtdkiut-dkhilywdt-r/
1⤵
PID:1560
- /usr/bin/dbus-send
  dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
  2⤵
  PID:1561
- - /usr/bin/dbus-launch
    dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
    3⤵
    PID:1562
- /bin/grep
  grep " = \\\"xfce4\\\"\$"
  2⤵
  PID:1568
- /usr/bin/xprop
  xprop -root _DT_SAVE_MODE
  2⤵
  PID:1567
- /bin/grep
  grep -i "^xfce_desktop_window"
  2⤵
  PID:1570
- /usr/bin/xprop
  xprop -root
  2⤵
  PID:1569
- /bin/grep
  grep -q "^Enlightenment"
  2⤵
  PID:1572
- /bin/uname
  uname
  2⤵
  PID:1573
- /bin/grep
  grep -q "^file://"
  2⤵
  PID:1575
- /bin/egrep
  egrep -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1577
- /usr/local/sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1577
- /usr/local/bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1577
- /usr/sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1577
- /usr/bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1577
- /sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1577
- /bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1577
- /usr/bin/xdg-mime
  xdg-mime query default x-scheme-handler/https
  2⤵
  PID:1581
- - /usr/bin/dbus-send
    dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
    3⤵
    PID:1582
  - - /usr/bin/dbus-launch
      dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
      4⤵
      PID:1583
- - /bin/grep
    grep " = \\\"xfce4\\\"\$"
    3⤵
    PID:1585
- - /usr/bin/xprop
    xprop -root _DT_SAVE_MODE
    3⤵
    PID:1584
- - /bin/grep
    grep -i "^xfce_desktop_window"
    3⤵
    PID:1587
- - /usr/bin/xprop
    xprop -root
    3⤵
    PID:1586
- - /bin/grep
    grep -q "^Enlightenment"
    3⤵
    PID:1589
- - /bin/uname
    uname
    3⤵
    PID:1590
- /usr/bin/which
  which firefox
  2⤵
  PID:1636
- /usr/bin/firefox
  /usr/bin/firefox https://eblast.ewu.edu/t/y-l-xtdkiut-dkhilywdt-r/
  2⤵
  PID:1648
- - /usr/bin/which
    which /usr/bin/firefox
    3⤵
    PID:1649
- /usr/lib/firefox/firefox
  /usr/lib/firefox/firefox https://eblast.ewu.edu/t/y-l-xtdkiut-dkhilywdt-r/
  2⤵
  - Reads user data of web browsers
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1648
- - /usr/bin/dbus-launch
    dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
    3⤵
    PID:1660
- - /usr/local/sbin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1710
- - /usr/local/bin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1710
- - /usr/sbin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1710
- - /usr/bin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1710

/usr/bin/dbus-daemon
/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1564

/bin/sed
sed -n "s/\$^[[:alnum:]+\\.-]*\$:.*\$/\\1/p"
1⤵
PID:1580

/bin/sed
sed "s/:/ /g"
1⤵
- Reads runtime system information
PID:1593

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1598

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1597

/usr/bin/head
head -n 1
1⤵
PID:1596

/bin/grep
grep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
1⤵
PID:1595

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1603

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1602

/usr/bin/head
head -n 1
1⤵
PID:1601

/bin/grep
grep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
1⤵
PID:1600

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1611

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1610

/usr/bin/head
head -n 1
1⤵
PID:1609

/bin/grep
grep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
1⤵
PID:1608

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1616

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1615

/usr/bin/head
head -n 1
1⤵
PID:1614

/bin/grep
grep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
1⤵
PID:1613

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1621

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1620

/usr/bin/head
head -n 1
1⤵
PID:1619

/bin/grep
grep "x-scheme-handler/https=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache
1⤵
PID:1618

/bin/sed
sed "s/:/ /g"
1⤵
PID:1624

/bin/sed
sed -e "s|-|/|"
1⤵
- Reads runtime system information
PID:1627

/bin/sed
sed -e "s|-|/|"
1⤵
PID:1630

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1635

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1639

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1642

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1647

/usr/bin/lsb_release
/usr/bin/lsb_release -idrc
1⤵
PID:1671

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -parentBuildID 20230522134052 -prefsLen 19257 -prefMapSize 230809 -appDir /usr/lib/firefox/browser "{47d4ae08-c877-45a4-b3ce-0b69b9eee66e}" 1648 true socket
1⤵
- Changes its process name
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1695

/usr/libexec/xdg-desktop-portal
/usr/libexec/xdg-desktop-portal
1⤵
- Reads runtime system information
PID:1713

/usr/libexec/xdg-document-portal
/usr/libexec/xdg-document-portal
1⤵
- Reads runtime system information
PID:1718

/usr/libexec/xdg-permission-store
/usr/libexec/xdg-permission-store
1⤵
PID:1722

/usr/libexec/xdg-desktop-portal-gtk
/usr/libexec/xdg-desktop-portal-gtk
1⤵
- Reads runtime system information
PID:1733

/usr/lib/gvfs/gvfsd
/usr/lib/gvfs/gvfsd
1⤵
- Reads runtime system information
PID:1737

/usr/lib/gvfs/gvfsd-fuse
/usr/lib/gvfs/gvfsd-fuse /root/.gvfs -f -o big_writes
1⤵
- Reads runtime system information
PID:1742

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 21742 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{4439ee27-740b-47da-a4b1-4489dae3686e}" 1648 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1767

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 2 -isForBrowser -prefsLen 21410 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{cefef940-01aa-442f-81db-9e6ec8ebf264}" 1648 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1789

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 3 -isForBrowser -prefsLen 21824 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{3279f34c-e921-4b32-8f0b-2c54fbf82d75}" 1648 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1817

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 4 -isForBrowser -prefsLen 27881 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{8d0f1157-1e5c-4493-a1e3-caeb1faef1af}" 1648 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1840

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 5 -isForBrowser -prefsLen 27106 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{de13888a-4da8-4dcd-8333-f0b28d03c1ed}" 1648 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1869

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/root/.cache/dconf/user

Filesize
2B

MD5
441077cc9e57554dd476bdfb8b8b8102

SHA1
3f29546453678b855931c174a97d6c0894b8f546

SHA256
b413f47d13ee2fe6c845b2ee141af81de858df4ec549a58b7970bb96645bc8d2

SHA512
80536c6170dd8626dc081af148d39ec2fd5d090cc578a76647e7903fd34bd02e4333ece57b0e24ff116f43429b6ff541834bd40ef0c8d3563acef5ed0fd254b8

Download Submit
/root/.cache/mozilla/firefox/7i2txps6.default-release/cache2/entries/099EB2BF8827A4F91EAB3E38B14650D0205226F2

Filesize
15KB

MD5
b63b02bf788db2d26923a3edd5ac7b8c

SHA1
804aa18ea2fff81a3c69e125226c8f7ae9aef734

SHA256
2ca2aca4e84a2a78b18195ee5067df29759ed817e68ce6b11358e636b19f1704

SHA512
56a5f1c2b9fb1c3f8d6af3941dbac4c96f968663ae32a7e8e636bbb9bcc4f1ee531166a45ea48cefaa8912d38ffbe19a381dcda4cc00833b131650d9bac70ff8

Download Submit
/root/.cache/mozilla/firefox/7i2txps6.default-release/cache2/entries/3D1E19D09F398691ABF62061591970855193B42F

Filesize
13KB

MD5
a0b4047f06f8d327e650f9cbd3c04873

SHA1
401ed7a9dc7a08a42a4005faba142f20aa6659ec

SHA256
3238b85a660dc863b1e4f5c03c06f94643c241489e86ab450b50b1768b26c192

SHA512
bda7044c31ab6952968c03507b4f5f79629648537b7420f645ab3231ebc540cde21a944ff2b90c2322f2e07497b053852fd522d4aa815280d3130bcb9a757b35

Download Submit
/root/.cache/mozilla/firefox/7i2txps6.default-release/cache2/entries/44230749A38B6989F56217B435A03E84CCADE62D

Filesize
26KB

MD5
9caad6bbc9b5aa2972021eb7d248dd19

SHA1
51bc3938f836c743d2377a020dca7d6709566158

SHA256
e2176aae29caea389d43ead3d14310e349dc461e9a41de8c738fc5b8752e447f

SHA512
ed8c9886ed03c5ee95da229e5028b3ebe8bbb6b3351a585ab072a4519e20341fb097e16837ea4763600786f5589e704513d57b9840245e11be5df1b3734c8cef

Download Submit
/root/.cache/mozilla/firefox/7i2txps6.default-release/cache2/entries/6D89348819C8881868053197CA0754F36784BF5F

Filesize
10KB

MD5
403dc336b72eb6cc867feb24050393ab

SHA1
b1230bf73ee275052072b04af650372cea051464

SHA256
b3bd4f371393a8c536f4f89a2a9967f7c722f0e4e27501a974d6cbe4d10fb58b

SHA512
6b06b0d67f39c4b03687a2693e4dc21ea815ecc5ef589fd83031a7e53f2072f5a25d9009dbc67634099c9a3f95aaebff974b09ab90ac07201c763a771adc1995

Download Submit
/root/.cache/mozilla/firefox/7i2txps6.default-release/cache2/entries/8BA364FE853D9B4D9813559C904F74BFD320F781

Filesize
9KB

MD5
353d5b8090a50f7ef68d6abc68baf840

SHA1
861915a2b1d239d484ac57f01272a6b431e5c459

SHA256
fd619fca58cfe197dc386de8a8d303116d6d4b27aebc3062872151bb7196cfc5

SHA512
bea2ad6d64fe03e324e5a262873b3b3a44d82f1fbf558158b77e08261604dd216222ab523ada250680c3d480962f3139c74c27c8f035e7bbf251f8bb4e3b18f2

Download Submit
/root/.dbus/session-bus/11c67417355f45d397f6be11f62e85a6-0

Filesize
466B

MD5
49008fdd55924075172d5f709771a334

SHA1
75b6d74a164f0d1e32cde31d4394577f6bc46652

SHA256
a1c983b2d96725130dd74aab9b4820348d8a2d8c451fb8dafb63882325038445

SHA512
edb376db72e4f38805ca0cae68496a98000254ad7704df7e7e1eba83ef15bfd88937c3368b4369447cf9ee695e727a5d782f69db943ab2394514df2d69b58a52

Download Submit
/root/.mozilla/firefox/7i2txps6.default-release/cert9.db

Filesize
224KB

MD5
303f615b4c0521ee85b705f3d53d5ac9

SHA1
6c42319ee5abc80aadd2258f526166454965b211

SHA256
0f04be2d4931b914cb0925b2203faa85ce4651c694dff4b0b47d1678c026afcf

SHA512
f5a3733bbe78044f71159d7f4a1e561e3428e5b4a38b5a2703aacee02e938e9dff6325b6323da1228443960515d34a0938fdf40275817d64c142cceee1223874

Download Submit
/root/.mozilla/firefox/7i2txps6.default-release/cert9.db

Filesize
224KB

MD5
93a672d7acd0568e6f58144022dac06c

SHA1
57a103cdc194364f7b8cd1b8b1b088a822540784

SHA256
1ddbbd3d1af45e07f840be2f3c90574ad6fc75f68d02eb5ffdc3ac2977029018

SHA512
0abd6c6f98c0df1f8c78df34e79bdc6324841085d8f7e9aa0ebef60bf45810e99eaba30d50987ff5e00d5943425b6574e978eefd644f9b8a58a79afc78642025

Download Submit
/root/.mozilla/firefox/7i2txps6.default-release/cert9.db

Filesize
224KB

MD5
c1fc7245f2ed5e13fc34e6c296dee209

SHA1
747cb3c96619bb0b650753729100a6943fd20a7b

SHA256
edff23b77a22b462b3213bb5ce457bf7d316aafc67c7016877f1aee924ba85f4

SHA512
81263533754f69e58a0511cea9247f89395e1162a0f852ca5e05e4c0b40657e85ccf3be3b900af203e7d523ca2e014229774b594852593c101f9ee86bb20f85b

Download Submit
/root/.mozilla/firefox/7i2txps6.default-release/compatibility.ini

Filesize
163B

MD5
fe452b7294d5928a9a5863b89ee0a6bd

SHA1
a5d4c245071fa96476ba48b4725bdae7f1b7940f

SHA256
d5bfb07561606a19aa96557ea109b175050dc0eb805cbef9c813503587d77900

SHA512
dc37d8507f08849e3382d2dbafd4a64555dbd57a288c95131e9aefb366630f1585811a9e1456b861bb9d2b816ed88b18ffb7580cd92b41bb9b0227ce1363843e

Download Submit
/root/.mozilla/firefox/7i2txps6.default-release/content-prefs.sqlite

Filesize
224KB

MD5
1fc2e7b7fe2c5be305dfa9a2bbb60771

SHA1
4967389dea050001cb1af3ec799edb7805c3abb8

SHA256
1953edcac737d1ad3de6fbf69671163882fdc0be5bd21d00378d8d8c753c757a

SHA512
fba536378ab9b5f04d92f1029b92d255c7da445a29e2527647bc16e57d02c179de1e78a2de11db1b00cc54c24d3715980c84c0cde103f47c6150f2e7bb8f93d5

Download Submit
/root/.mozilla/firefox/7i2txps6.default-release/cookies.sqlite

Filesize
96KB

MD5
9535f5fe817accc769c2c1d3354db39f

SHA1
6af62cf08717cf3bfa84eb1a7b311acf522ce560

SHA256
c53c15fcfac2bb57fdc88d23f932fc244dbaf4020f0f6eaecf0f77a37c21f8c5

SHA512
dc9c2c32eb42dda0a7a711e143aea58c603c1e9d885c3677e9fe86f525e1b0b32a46e240756263e56510b07e764ba69f2de13b90ec18210678242e10cfe17837

Download Submit
/root/.mozilla/firefox/7i2txps6.default-release/cookies.sqlite

Filesize
96KB

MD5
5caa766855d5613a999f71b7812d6451

SHA1
ad0d9a52a0d5cc7f11858301dbe47377ed99ee37

SHA256
3a8ce2b07e3e8678a13aa58ef5b942c4dccd8f9c84511bdeb8847ef270797e27

SHA512
17bb0f4c87ec178910795b25ce85e74cf599190c769592472c3e872f42930c93f28faf0ff3e448816a9abcc8af0459852bed52bee08cfe25d068879c6dfd8eba

Download Submit
/root/.mozilla/firefox/7i2txps6.default-release/favicons.sqlite

Filesize
224KB

MD5
3c0a1ec298284608bfa51081ea539be3

SHA1
e51b58f6fe89d45fd8a1d935b51da172d5f6f32e

SHA256
34c4fe7ab2d3e44f193b489ebe84c17d67b336546af9ef231897ec09d7ff16f2

SHA512
8550f530377f7a98c46a6989bec2c43ed644274509a5b987e8e0d034bf867b3315dcc75a2c851a5ac43a45b40bf51c789d828a9a69c02157b3e900467341a28f

Download Submit
/root/.mozilla/firefox/7i2txps6.default-release/key4.db

Filesize
288KB

MD5
6fc6992ea65bfe1bda8eec4de762c7da

SHA1
ef815e1358c19f7415401037442d60b9e90c1e61

SHA256
903c2a66bb176a8380940750e5a0e3127ca4efdf00f8135eccde318708e5fcb9

SHA512
3270e7e69838b131bbd3db751b6d08b2b8e1c6c7ab6a1c423f673b1a285fab92188eef191a7934bab8703fa02fc4f43e86106a5516ec4cb74ae36b3f365d22e8

Download Submit
/root/.mozilla/firefox/7i2txps6.default-release/permissions.sqlite

Filesize
96KB

MD5
232fbc22dd03a8ec41edde02bdbea61c

SHA1
6ab4b39bca95418c52f7f861fd39e5fddb9cc7b6

SHA256
d88bf367aaf79efbb2e8fbdb1dc5bde1c1c3a53e0f4d8188027a63ec55d5f5f0

SHA512
055f1595f4a327347671db53cec8d89a310109d3f871c567e3d5b654b956fc0369d12437f7dc6d9327b973008f1327ee0dfdb5504f1b3cbe00da29941b1e5892

Download Submit
/root/.mozilla/firefox/7i2txps6.default-release/places.sqlite

Filesize
1.3MB

MD5
2dd42b6848328956c837459e19c4d15a

SHA1
5d546f641499aa1ef50352e0aba85b2fd533028f

SHA256
d0d7923b4add0e22d71c4c9d523274aeaeb0594d2ef4cb191b47f9033afe09c2

SHA512
10f9fc7881830f4c0fdd0ff6abc6c534b606be13e592f8658828360ce844ba67fd22f50bbc7c759bf89f517eec03612602e3f87078df5de02073f2e53b2929a8

Download Submit
/root/.mozilla/firefox/7i2txps6.default-release/prefs-1.js

Filesize
1KB

MD5
c64b3aac431d4b2431f0aa0d3aa9c39f

SHA1
c931872afeac0c211a8f223fce494f881235470f

SHA256
85545111423995c7e9bb48f89b6be8b04c4da77cb471b11df2ced7f55db02d3b

SHA512
8ad09b8dc2824b70a8756eec9ed28af99b256445a1cd2ce54644354b62ebe3611b12d953c0d6234b4f7a72a0558bb643dfa01fc5ab9bf4880c6c1b705dac3a97

Download Submit
/root/.mozilla/firefox/7i2txps6.default-release/prefs-1.js

Filesize
1KB

MD5
956c48c37d5b2eabbe3c5fa9ae2a8bb4

SHA1
5eff66df35cc54b7a82907ccf4db5c89d2acbb25

SHA256
2823499eee542b7ed721dde430f87c9b7151c98d4e2464cb380e0ec9cc14098e

SHA512
d38b47d0a0d9d2460379ee047db13741191f7ee03265a82188b400289d4f93f55054ef2bee52e9f793477b1cf7fb51c3884742981ba42c57f0488fe1ad584231

Download Submit
/root/.mozilla/firefox/7i2txps6.default-release/prefs-1.js

Filesize
2KB

MD5
bb31777b31559b2858ac27c69dc0caa0

SHA1
2bd2feafea7ae25eefdd560f2d346fd1f4e8eedf

SHA256
8c0865b513a97b8cdb6cb2a07ebe6a96d8ed4be1578c654ed56a968d772bd806

SHA512
effec93701b48c911c23d4b7fffd1280c06cbde96939856434e25174da7658f5ea27d43bf69aa0f727de5334d4b48b31464aa32dd266f61d08af801a76c527d2

Download Submit
/root/.mozilla/firefox/7i2txps6.default-release/prefs-1.js

Filesize
2KB

MD5
a0fe356cc79e4cda288c2e7a7a74f6aa

SHA1
6c11e2ad7d3482f145f239d683947dc8b68c62e4

SHA256
dbc6997d41f0761d4c4b85a30718905aabff059916440daa164d1c0563d3168d

SHA512
93202c2de3fda93e3f60bedd6ac38d44ddce69c5796d27247fd714be88b9d71a629755f6bdc1d3afd4de065788dd29c54f596e369a4a6b1d24387620e85bf06c

Download Submit
/root/.mozilla/firefox/7i2txps6.default-release/prefs-1.js

Filesize
3KB

MD5
1361bf3f56f182ef042a6580912cd5c5

SHA1
8ce36f31d30cbf594d2a45a0c6c9aeae992c13d9

SHA256
83484dbef5d7aea7bdb84d58ce06a13e919048c8019eec5d2c969ce04a3b30e3

SHA512
7e5d9818e325636d9b6901765eee7e350bb156186a41a2e387a0197bbbf9630f3538815578d61c9c5809c5dfa958b83a4a43798fa84437faa21fd55439e9f2d6

Download Submit
/root/.mozilla/firefox/7i2txps6.default-release/prefs-1.js

Filesize
4KB

MD5
aeb7c292e287838ffca5be44a04d4993

SHA1
c459d4215cfde91d630ff3b6b437cfee1cfd5675

SHA256
e7be52961576cf3ab850f534a036f4cb910fdd2a7ab00d7d71bc3bf0c25ddf11

SHA512
28cd10e522e29b9d5d7cfe52b37fa92c388bdb6628034230272a4d520352fb95bce952ef294b0a8d835291d6adfe8fe8e30de0732d422a5c8ada58642a2f67d3

Download Submit
/root/.mozilla/firefox/7i2txps6.default-release/prefs-1.js

Filesize
4KB

MD5
540e59950f38a19a57fa1560f22b5443

SHA1
01e0a8788153c1148bb405558dbfbec66865b4e6

SHA256
8dd6c817236aacc0c453c916ed9f6351f04e5f28aa90a3e8a39223e164abc733

SHA512
5bd25b2b323756be72740178ccdb7888110a3664bc2b216ba40a063b0c1224888be520da79729955cb84960239a1f2e7ad66f73489a40d7f0d67bb414f9de2da

Download Submit
/root/.mozilla/firefox/7i2txps6.default-release/prefs-1.js

Filesize
4KB

MD5
c25df7d514fed864df16cee4a8669367

SHA1
a91cb165c76c37fc31b54434502a234fb7c52890

SHA256
bee770c4cbbf9e25795ed4b0b13aa4bf7aa81318e1b5b9f6b5b97fd5c3b79b90

SHA512
9565a8291729de7b4ccada36314d857f4d699bb6c16f72c29778d02499e8279ea0fb51d4ce537e00313579a0e48b1becfd7ac0a78c29e63911bdd5d79e0ad797

Download Submit
/root/.mozilla/firefox/7i2txps6.default-release/prefs-1.js

Filesize
4KB

MD5
bed17f1cb44da1b08b3146ada252dec9

SHA1
79ebaa37dac5a572b9493dd67c31b3310f83be73

SHA256
0f8d02c2fcd0e21b7dbb5c6684101a8f4a1bc6ac9e33610f46ea02716beaa7da

SHA512
2880392940b811e160987918c8a2a11c337c4460efc466ff2c9c82c22846a1791dbc68e1adda08bcbcb11d8b68e87ba2f47c5a730e0507d17bfab60752449992

Download Submit
/root/.mozilla/firefox/7i2txps6.default-release/prefs.js

Filesize
919B

MD5
3e503f2ad73b31a4e35c1f1eac192248

SHA1
20ea058b9178578e5a7a28a1d1368481c2f1d884

SHA256
5a17d7be88e8f03cf4b0f514dbb70754bc82c671887ac75a992217428d2d5c32

SHA512
eb5df218f38f1fd008c207e6dc6d2e47d8de9e98bcd86acc1fdc1073fc5dab79ede1624cf2ee3ec393338c2ac17a6c2d521e46c22edaf24c5c141a2e4ced811a

Download Submit
/root/.mozilla/firefox/7i2txps6.default-release/storage/ls-archive.sqlite

Filesize
96KB

MD5
e0c613bfd69956a19ce2dc5e925aa223

SHA1
14accb230edcd6cb76967cdc6d4e5686db96b5df

SHA256
0d4cb11f6364c46a75f9eaddfca5c660b90dfd515df3afcd5e0baeca28a0f1ab

SHA512
01643c0131a392be92b3f281d7f633c1f502bff19090b0d716f1ac66aefecc3fcf92f393bef66b03089c9b9c6d8aaeb711b6a4f29d5a6729dd188c838f2272d1

Download Submit
/root/.mozilla/firefox/7i2txps6.default-release/storage/ls-archive.sqlite

Filesize
128KB

MD5
178d71e5529d637ac62f7e75fdd75896

SHA1
339f2b949cc4c207b66aea11137448ba28d36dcb

SHA256
7b0050f1bfaab85c8f9067ae7d7369056ff752c0c852ef1462a96c22169004d4

SHA512
ec0e0105fcfbbae356dd55efbcf92975f35bbe5cb93fcabf4c08443e871957635d14830b27c4e1ddefbbaff8f9b7ec3590bf417a9442e1d7ee3607d14d56f664

Download Submit
/root/.mozilla/firefox/7i2txps6.default-release/storage/permanent/chrome/.metadata-v2-tmp

Filesize
42B

MD5
4b4507074049e629c5323bbc88c14c32

SHA1
bd440d79cac2e648d63fa3e1e60cd51c243d8b4f

SHA256
9de749bba51badf393e9cb9e3b31e8c8d6c5c85697466643edb05712d8c59964

SHA512
0f975d229248a2602471d6af2d59518acc7bab7e14bd7a48aed3ac76ad1a396eacc548beca6eb263d1b156bbf985eda881859404d1c22ef04e8c2ac591d43817

Download Submit
/root/.mozilla/firefox/7i2txps6.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite

Filesize
44KB

MD5
a8dd7ebaad5528b23f82ccb1534cea18

SHA1
600daceacfb5cf9df0b66ba7dce4516b2ac4df70

SHA256
e5b0d02c18ae36c4a220f41fd97c66060c17aaafcbb324a57ccdc2707c44c4ec

SHA512
67f867a8e2b37fb6bececd5ebc570ca594ea329142badd63d1281d5e735f515a5e329abc6eb9a9d3465aab0a08541b4888018d859964f160a52345ab93532bff

Download Submit
/root/.mozilla/firefox/7i2txps6.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite

Filesize
12KB

MD5
c4c9b23ad01c96e6d95754400a5e22b4

SHA1
cf9a239a1f58e7d7c2a59b48da7c33c61551d57d

SHA256
50e6dd780243f0dd548d66406f17575d3cac4533414654cf96ca64fcec3c0866

SHA512
8731bc112bfd48fb4c934308f26e3814611d4a0482ed26ac37df5511f74eb1f727e4a8c6a284dab76baa77875f8db85e557940f4cd4caee2bbc5049b233992c1

Download Submit
/root/.mozilla/firefox/7i2txps6.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite

Filesize
44KB

MD5
7352c8848e88edc39b7fb5e663888187

SHA1
8c3dffe25cc56c7aec1b782292d6fceed81e6304

SHA256
7a462086a26978809c719e57a7ea6a25568767fb7532014e8531fda94b660e0a

SHA512
f2a0dbbab5c2c1702b03bce15a47739481f523e127d1372b40534db9a20b2bc99fb53710ee0e5d44176188817cac704cf4f98cdf087e7e89d244281fcfc3b280

Download Submit
/root/.mozilla/firefox/7i2txps6.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite

Filesize
12KB

MD5
d03864319ef97c2c70d20d62419d0929

SHA1
76c72d1ba432d9b42d03f0167177ae5f1c65337c

SHA256
bcdd94aae71535bfa3cf60dcb5f7de6b0986a9513889ac1b15605788c1f2c25b

SHA512
3321d509f37d51a31cffced49a32807f3230b83ab101627582298cb71ac639ebd4ff4b617186cc183aec3a37a905a4990fcfc96907145df0e136204f7248ab90

Download Submit
/root/.mozilla/firefox/7i2txps6.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite

Filesize
44KB

MD5
759544297aaa61f5fef8ee42d0ae4393

SHA1
fc2d66f6e60409e3e8d38623ce5f817fc7f571e0

SHA256
1bd2000cd972e80cefaec6e982ba261d224a818f367de0fdf8c51fa5a05d7ab5

SHA512
8aaa2ce66f10d46f7c9200af841ac7bd9f5b55c30308a14f0deda44ac62581c45daae45154487c0073a0d5847d5926cbb4072ca64a702ac6b834ad0bb482804f

Download Submit
/root/.mozilla/firefox/7i2txps6.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite

Filesize
12KB

MD5
6b8dd8fd9593c87eb6d7ccb231714b78

SHA1
f7dd826a5d06f40c9c5afa0394047552d6a2cac5

SHA256
332a1c8a24925dbc9eba602faa3610c5fdcc77aa544d7c672e54617a4b83d3f4

SHA512
4be8872415db31a1c255cdf7ab2e4a3837ca61511040baaba186cc643d46e8f48300d7946a7f0afd7d0ee6052dafb229d1c407ed335ad523b8f36df2504c4a71

Download Submit
/root/.mozilla/firefox/7i2txps6.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite

Filesize
16KB

MD5
2e485078fa9fcfb73b57d848a00b4a71

SHA1
40ada790e1b60c8aab8596947d7738dbd707c0ad

SHA256
fcce207943cac6a711f463875d7e3f8287c6dba4fa8dfe15090b9eb383768e18

SHA512
d0f3ead22c03175bc08d203c38624580f3d14445b233628b289df30b59ab035a8db7c6bb2bc448d0a1929cf0265788cc07b5873e049ec8814fc0f3fe1bdbd5b4

Download Submit
/root/.mozilla/firefox/7i2txps6.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
44KB

MD5
07a412e08825220262ad2890757ff779

SHA1
f46c127dbc070ded87a6078b3c1c761955f96de8

SHA256
da640f8b665841b520d2262a21cc3f82aeaa881cf81a1ddae27ef501d66544e4

SHA512
0134c783bf3293848e479b478ac57a1e0f4202cddfb8b57bc6275aada7345f398cf8a627e9b1c34fd618192c2f0c9737b1da487daf33f9c557ebc1377105582b

Download Submit
/root/.mozilla/firefox/7i2txps6.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
12KB

MD5
701ef0610cf31112aa4a70e087b499ce

SHA1
32829e16944c91f4f0cc11619b61e15abf004196

SHA256
43170e8c4bcd025cc69f9bd466cc810f19ac8e93bb4fe7011a92bf576464905a

SHA512
6a9638f7231e31cce9ee03b803ea8b304dd59910e493d7be84ac72e46db4861970d76de8ed07b0524df80d5b219d433fd82ca3d6d330d70a2089d66f6e1319ec

Download Submit
/root/.mozilla/firefox/7i2txps6.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
164KB

MD5
bdb93b166ceb32a4ed9a0b128492ff3a

SHA1
bc1dd66182d9a95e46447060bf6364f0f27965b7

SHA256
94a8c8cce9eb6bb51aedafac7208af7fd6c56913cf3361728d3d9aa3a996dd7e

SHA512
4ba1e583c81b6a35e290355361dd2fa376398082cfaf90179f34071bee934f16cdee7e7b886399fefb7dea4d1d946c17b4ddd74664cb2cd9eae55b7acf69022a

Download Submit
/root/.mozilla/firefox/7i2txps6.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
148KB

MD5
dd3f6ba37c670af5953593535e435d04

SHA1
ecfe4e650a050bce77e8ff7468de04c1b8acc9a4

SHA256
5cc6fa137a1f3a7d0b615b178877f12c460b22f95702eb7534d5732ee6599561

SHA512
86e0482543faae6fb279ca71e1e6d6461d32317e74baebb3973e0fde9800107faeb9c2347be6cf8a47556ae43c8e6c224a595e952f621e40ad2c5eba920df2b3

Download Submit
/root/.mozilla/firefox/7i2txps6.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
260KB

MD5
2561aeba199bf3f19fcdf1cda8b3f8e8

SHA1
55b9f38dcf9b942d7cd77062abc0f6be482c85b9

SHA256
c9aace789c73b8b2247ef571607f3dc81e29f803cd2b398d8233b8b384f7d27c

SHA512
7145535b3e85ba1a580a8008fc002fd3ab7796893e3cb14a0f41a0f3dfda2c0ccbd6ea245d77662b12484844e82abce90c3f75ecb09f2548dcc9a6b904894d80

Download Submit
/root/.mozilla/firefox/7i2txps6.default-release/times.json

Filesize
50B

MD5
b651870aa14a36f97c31b5fa222e06de

SHA1
2a931a8f2cda4ffb35167e56b04cfbf2c4aed2c5

SHA256
6e21f378cde18c6d5b7fd04ae772fe6112fe9c65881e860925ba2db76986bb1a

SHA512
0160e06f1840b3a147b40c1d1391e0e744dc71dfe1d7cdcc0bcc8afe60922a5831a800f0ab1553adcadfe52534b5fc021e1414f5ca7bdc0f2e1626c773ceb83b

Download Submit
/root/.mozilla/firefox/7i2txps6.default-release/times.json

Filesize
47B

MD5
683d86ffbd3f29d5454c46f86381860d

SHA1
b1f554b4914afbbdbf4b3a7d7d4898aa86e8dd42

SHA256
c5dcadebfe3bd56e19ace18db951453ff0ddcfa828b72ec61fb1946795e17475

SHA512
2e4b343e6e79057e3936bc5c1c342ff6ebfebca6753b1922454e6c360e93a489df9de2671d15cad235742e6212723c97ebdf42b233e13ee30281ffb38c12aa06

Download Submit
/root/.mozilla/firefox/7o1m9alk.default/times.json

Filesize
47B

MD5
383dca2297fda95fa326d04cdd3bf91f

SHA1
5d33c2f9ec169fd915fa962ffcbf290c4916e27e

SHA256
ca2b8111a21210381455d6eb153fa80255b3c01987e49d06dbea500ad3bae189

SHA512
8cdc2e1d5a776c1cb7cf9f37f3bb5607e50e88a6e2dcc5d90aacf7199746c55213e0290287517a2e8cbfda266140c699f8d8141b466ba5d0b4c1178d3c16217d

Download Submit
/root/.mozilla/firefox/Crash Reports/InstallTime20230522134052

Filesize
10B

MD5
5fdb8f41d220a4f86894d83c94867994

SHA1
3fafa7bf75b71585efa217c014d3672e19a7c968

SHA256
d816ffdddd8bc2a92979ae23cbf9772b02b321899b551e253bcbeb9dab007f6e

SHA512
5ebdac683d4c8cb2786c3cd6a46062e4adc6e26042e1fc8c0fa6bb4bbbe72fb2434e178edbb152b2009bb86dbf17692c6f2e3846f1a68d0e60a3cb02a0a18090

Download Submit
/root/.mozilla/firefox/installs.ini

Filesize
62B

MD5
38eea4c16daabe3f3e2b23c36f7004df

SHA1
8de6fe309e93118f7f84f7901eafde5f2de2dff1

SHA256
f192ce59846df9beef1b6395264cf0408a050a0dcfab499f461b2409edb32b19

SHA512
8a2e43d79d9c4b1594a432e7df47c12ec6de330bc28c253cc8b8d714f7d6027b79e48c62d659e90d7846fc70d5c5339a31a0dd902467800a0b6ec15ce0019066

Download Submit
/root/.mozilla/firefox/profiles.ini

Filesize
259B

MD5
e0d2b00e81665b156de17602aa33a592

SHA1
e36194ea13ff69a1d6c2a5ace5a61fdfa3faf14c

SHA256
d441bb6f43a716161ffd710a0410223a725220449f91d1c337347f6519f5f996

SHA512
68830a19dc13d80450ae566baa416dbab25f56ac336ea3af272064664f3ad9b4e23a74b5d0a27a44616006528adbb32caee59227513b8ea6978310b35b462f6a

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads