hxxps://webshell[.]suite[.]office[.]com/iframe/TokenFactoryIframe?origin=hxxps://outlook[.]office365[.]com&shsid=7720b54e-811e-4120-ae65-d26ac16ca6d5&apiver=oneshell&cshver=1[.]20240208[.]12[.]0&upn=rcolwell1@ewu[.]edu

max time kernel
20s
max time network
25s
platform
ubuntu-20.04_amd64
resource
ubuntu2004-amd64-20240221-en
resource tags

arch:amd64arch:i386image:ubuntu2004-amd64-20240221-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
submitted
05/04/2024, 17:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://webshell.suite.office.com/iframe/TokenFactoryIframe?origin=https://outlook.office365.com&shsid=7720b54e-811e-4120-ae65-d26ac16ca6d5&apiver=oneshell&cshver=1.20240208.12.0&[email protected]
Sample240405-vm1yzsab44

Score

7^/10

spyware stealer

Malware Config

Signatures

Changes its process name 40 IoCs

description	ioc	pid
Changes the process name, possibly in an attempt to hide itself	gmain	1813
Changes the process name, possibly in an attempt to hide itself	gdbus	1817
Changes the process name, possibly in an attempt to hide itself	glean.dispatche	1831
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1846
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1846
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1846
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1996
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1995
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1994
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1995
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1994
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1996
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1993
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1993
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1992
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1992
Changes the process name, possibly in an attempt to hide itself	Timer	1991
Changes the process name, possibly in an attempt to hide itself	Timer	1991
Changes the process name, possibly in an attempt to hide itself	pool-firefox	1997
Changes the process name, possibly in an attempt to hide itself	pool-firefox	1998
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	2001
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	2001
Changes the process name, possibly in an attempt to hide itself	glxtest:disk$0	2002
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	2009
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	2009
Changes the process name, possibly in an attempt to hide itself	Cache2 I/O	2022
Changes the process name, possibly in an attempt to hide itself	Cookie	2023
Changes the process name, possibly in an attempt to hide itself	Cookie	2023
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	2034
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	2034
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #1	2036
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #0	2035
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	2037
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	2037
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	2038
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	2038
Changes the process name, possibly in an attempt to hide itself	StreamTrans #3	2039
Changes the process name, possibly in an attempt to hide itself	StreamTrans #3	2039
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	2040
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	2040

Reads user data of web browsers 13 IoCs

Reads stored browser data which can include saved credentials.

spyware stealer

description	ioc	Process
File opened for reading	/root/.mozilla/firefox/dgez41eg.default-release/prefs.js	firefox
File opened for reading	/root/.mozilla/firefox/dgez41eg.default-release/extensions	firefox
File opened for reading	/root/.mozilla/firefox/dgez41eg.default-release/system-extensions	firefox
File opened for reading	/root/.mozilla/firefox/dgez41eg.default-release/storage.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/dgez41eg.default-release/cookies.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/dgez41eg.default-release/cookies.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/dgez41eg.default-release/extension-preferences.json	Process not Found
File opened for reading	/root/.mozilla/firefox/dgez41eg.default-release/storage.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/dgez41eg.default-release/compatibility.ini	firefox
File opened for reading	/root/.mozilla/firefox/dgez41eg.default-release	Process not Found
File opened for reading	/root/.mozilla/firefox/dgez41eg.default-release/user.js	firefox
File opened for reading	/root/.mozilla/firefox/dgez41eg.default-release/addonStartup.json.lz4	firefox
File opened for reading	/root/.mozilla/firefox/dgez41eg.default-release/extensions.json	Process not Found

Reads CPU attributes 1 TTPs 1 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/present	firefox

Enumerates kernel/hardware configuration 1 TTPs 54 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/security/apparmor/features/dbus/mask	dbus-daemon
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/irq	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/uevent	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/vendor	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/vendor	glxtest
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/vendor	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/irq	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/resource	glxtest
File opened for reading	/sys/devices/system/cpu	glxtest

Reads runtime system information 35 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/self/fd/32	firefox
File opened for reading	/proc/self/fd/53	firefox
File opened for reading	/proc/self/task/1583/stat	Process not Found
File opened for reading	/proc/self/stat	Process not Found
File opened for reading	/proc/1581/cmdline	Process not Found
File opened for reading	/proc/self/fd/43	firefox
File opened for reading	/proc/self/fd/48	firefox
File opened for reading	/proc/self/fd/49	firefox
File opened for reading	/proc/self/fd/52	firefox
File opened for reading	/proc/mounts	dbus-daemon
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	dbus-daemon
File opened for reading	/proc/1492/status	Process not Found
File opened for reading	/proc/filesystems	glxtest
File opened for reading	/proc/self/fd/30	firefox
File opened for reading	/proc/self/fd/40	firefox
File opened for reading	/proc/self/fd/50	firefox
File opened for reading	/proc/self/fd/51	firefox
File opened for reading	/proc/1492/attr/current	Process not Found
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/mountinfo	Process not Found
File opened for reading	/proc/self/fd	Process not Found
File opened for reading	/proc/sys/kernel/cap_last_cap	Process not Found
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/fd/35	firefox
File opened for reading	/proc/self/fd/41	firefox
File opened for reading	/proc/1486/cmdline	Process not Found
File opened for reading	/proc/1518/cmdline	Process not Found
File opened for reading	/proc/self/fd/44	firefox
File opened for reading	/proc/self/fd/47	firefox
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd/42	firefox

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/firefox/.parentlock	firefox

/usr/bin/xdg-open
xdg-open "https://webshell.suite.office.com/iframe/TokenFactoryIframe?origin=https://outlook.office365.com&shsid=7720b54e-811e-4120-ae65-d26ac16ca6d5&apiver=oneshell&cshver=1.20240208.12.0&[email protected]"
1⤵
PID:1483
- /usr/bin/dbus-send
  dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
  2⤵
  PID:1486
- - /usr/bin/dbus-launch
    dbus-launch --autolaunch 4816dd152e8c48ff97e9117d197c13d8 --binary-syntax --close-stderr
    3⤵
    PID:1488
- /usr/bin/grep
  grep " = \\\"xfce4\\\"\$"
  2⤵
  PID:1497
- /usr/bin/xprop
  xprop -root _DT_SAVE_MODE
  2⤵
  PID:1496
- /usr/bin/grep
  grep -i "^xfce_desktop_window"
  2⤵
  PID:1503
- /usr/bin/xprop
  xprop -root
  2⤵
  PID:1501
- /usr/bin/grep
  grep -q "^Enlightenment"
  2⤵
  PID:1508
- /usr/bin/uname
  uname
  2⤵
  PID:1509
- /usr/bin/grep
  grep -q "^file://"
  2⤵
  PID:1511
- /usr/bin/egrep
  egrep -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1513
- /usr/local/sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1513
- /usr/local/bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1513
- /usr/sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1513
- /usr/bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1513
- /usr/bin/xdg-mime
  xdg-mime query default x-scheme-handler/https
  2⤵
  PID:1517
- - /usr/bin/dbus-send
    dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
    3⤵
    PID:1518
  - - /usr/bin/dbus-launch
      dbus-launch --autolaunch 4816dd152e8c48ff97e9117d197c13d8 --binary-syntax --close-stderr
      4⤵
      PID:1519
- - /usr/bin/grep
    grep " = \\\"xfce4\\\"\$"
    3⤵
    PID:1521
- - /usr/bin/xprop
    xprop -root _DT_SAVE_MODE
    3⤵
    PID:1520
- - /usr/bin/grep
    grep -i "^xfce_desktop_window"
    3⤵
    PID:1523
- - /usr/bin/xprop
    xprop -root
    3⤵
    PID:1522
- - /usr/bin/grep
    grep -q "^Enlightenment"
    3⤵
    PID:1525
- - /usr/bin/uname
    uname
    3⤵
    PID:1526
- /usr/bin/which
  which firefox
  2⤵
  PID:1569
- /usr/bin/firefox
  /usr/bin/firefox "https://webshell.suite.office.com/iframe/TokenFactoryIframe?origin=https://outlook.office365.com&shsid=7720b54e-811e-4120-ae65-d26ac16ca6d5&apiver=oneshell&cshver=1.20240208.12.0&[email protected]"
  2⤵
  PID:1581
- - /usr/bin/which
    which /usr/bin/firefox
    3⤵
    PID:1582
- /usr/lib/firefox/firefox
  /usr/lib/firefox/firefox "https://webshell.suite.office.com/iframe/TokenFactoryIframe?origin=https://outlook.office365.com&shsid=7720b54e-811e-4120-ae65-d26ac16ca6d5&apiver=oneshell&cshver=1.20240208.12.0&[email protected]"
  2⤵
  - Reads user data of web browsers
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1581
- - /usr/local/sbin/dbus-launch
    dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
    3⤵
    PID:1814
- - /usr/local/bin/dbus-launch
    dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
    3⤵
    PID:1814
- - /usr/sbin/dbus-launch
    dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
    3⤵
    PID:1814
- - /usr/bin/dbus-launch
    dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
    3⤵
    PID:1814
- - /usr/lib/firefox/glxtest
    /usr/lib/firefox/glxtest -f 13
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:1832

/usr/bin/dbus-daemon
/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1490

/usr/bin/sed
sed -n "s/\$^[[:alnum:]+\\.-]*\$:.*\$/\\1/p"
1⤵
- Reads runtime system information
PID:1516

/usr/bin/sed
sed "s/:/ /g"
1⤵
- Reads runtime system information
PID:1529

/usr/bin/head
head -n 1
1⤵
PID:1532

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1534

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1533

/usr/bin/grep
grep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
1⤵
PID:1531

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1539

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1538

/usr/bin/head
head -n 1
1⤵
PID:1537

/usr/bin/grep
grep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
1⤵
PID:1536

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1544

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1543

/usr/bin/head
head -n 1
1⤵
PID:1542

/usr/bin/grep
grep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
1⤵
PID:1541

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1549

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1548

/usr/bin/head
head -n 1
1⤵
PID:1547

/usr/bin/grep
grep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
1⤵
PID:1546

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1554

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1553

/usr/bin/head
head -n 1
1⤵
PID:1552

/usr/bin/grep
grep "x-scheme-handler/https=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache
1⤵
PID:1551

/usr/bin/sed
sed "s/:/ /g"
1⤵
- Reads runtime system information
PID:1557

/usr/bin/sed
sed -e "s|-|/|"
1⤵
- Reads runtime system information
PID:1560

/usr/bin/sed
sed -e "s|-|/|"
1⤵
- Reads runtime system information
PID:1563

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1568

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1572

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1575

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1580

/usr/bin/lsb_release
/usr/bin/lsb_release -idrc
1⤵
PID:2000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4816dd152e8c48ff97e9117d197c13d8-0

Path /root/.dbus/session-bus/4816dd152e8c48ff97e9117d197c13d8-0
Size 466B
SHA256 8bed64131696a74a1090bc9a5104a81574a3129eb01debc547117c85fa212840
MD5 ebffd02905d8d79137893c1413ed9a74
SHA1 6c3fd2f350f599b861673c2b05a7dd9ef4a32203
SHA512 21a9875a279a90ada290ed8060966113f89fd3912f1da8748bbab4a84515eb599aae5fc259e5ebae38344322923c7727fd03e88b6dd5adbb84d2de2ec4cc9a8e
MD5 SHA1 SHA512

Submit Download

InstallTime20240108143603

Path /root/.mozilla/firefox/Crash Reports/InstallTime20240108143603
Size 10B
SHA256 b1e4bae49c5510559b2e0044ca27388410f10296f9b34e761cb282ab701bffed
MD5 c6bb63cd0e9efcf8de73529174668269
SHA1 f61172d0c3779d2863c599f076a1f16282fe6b07
SHA512 f9e6c7385b0c8bf086e40d56ed192faf1404f7dd83ea5671936f3ab2157cf05392f5670f5c7f60e78db3f6cfd8e774e662623dd1d12ef31bdba971e46c7e7369
MD5 SHA1 SHA512

Submit Download

compatibility.ini

Path /root/.mozilla/firefox/dgez41eg.default-release/compatibility.ini
Size 163B
SHA256 b4bf5c8334f6db20ae94105141ae7a721342ddccd94ec65289dc291e76a31814
MD5 2d41a6f5736821b90ef44850dd3873fe
SHA1 a47c4bc1431234a5b58e460ede5b571acd38e562
SHA512 047a1455211e7aa29ef5f32f07c89d8a0c8d86d871bc664e4d8958a2a014dbe32f0613cd9eb66e7307c0e2439f74ca0b829652a52fa48e8c60d64b41f69914eb
MD5 SHA1 SHA512

Submit Download

cookies.sqlite

Path /root/.mozilla/firefox/dgez41eg.default-release/cookies.sqlite
Size 32KB
SHA256 c8a9907517b566e9d0c2bbc7568c227f3f0a119cd487eadb08390a5ae440bce5
MD5 026b637578261077a90dc1d37830e6af
SHA1 7097e5d175331b48a876d3a7dc88a2f841013ca2
SHA512 12e5b4e0ce1f6de33da8241760ccc7550cd65a18c4f9ab525bbd66c5fa4998bb4d5e24a22e4285e7030071aaab2a34bdfd10bf22950e42e83db8107b0f63ec5c
SSDEEP 3:lSGBl/l/sl+ltlEAvl:ltBl/lEs1EA
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path /root/.mozilla/firefox/dgez41eg.default-release/prefs-1.js
Size 1KB
SHA256 12fd9dac45cfc4ce8a5cb997c41b6d410118311789552748e43143af889fd654
MD5 c6cff2102aca8dbdeb4a955b2784c4e8
SHA1 b0266b2a8ed85c9442f5c2034bd7c106a11802af
SHA512 023e8e2b5ad7357eb60124be2788b8789db42553ced1d0e70ea7b3b28c5fba8b72813a844ff27e27b8e118a9f7783165cf593c139b7fde32f7aa95dea9a05019
MD5 SHA1 SHA512

Submit Download

prefs.js

Path /root/.mozilla/firefox/dgez41eg.default-release/prefs.js
Size 656B
SHA256 e1ddb5045ec6fe75f49e0d3fe787eceab8ec3d934dd50825a2cc8546ad532e0f
MD5 8a3fb2ff88ed8a97c6528a1559029043
SHA1 77fb453528520bee52bb4369fe541d7b7144f64c
SHA512 06754a0d62cdeaad085cb5b5ff834999c77b64738093e4301c1a9c29042292280b531856355a96c56fb5eb9a3729a09319fee9de4b1c95748a9616d46d695439
MD5 SHA1 SHA512

Submit Download

times.json

Path /root/.mozilla/firefox/dgez41eg.default-release/times.json
Size 47B
SHA256 3ab06ceb7c9287bf4dee8f7cd9c747e23022483a92fb45d897b132321002beae
MD5 9a42c73d4ae6e9dd9587db54d5092c84
SHA1 a90170da5da9e96141b7d21c129301b0d8be2166
SHA512 332600b6c9551753a09f4a4fbc7c5621ccf12e95715f86a762d3db16c19ac48123d1a27590bc77a23aae56167cc063ab4a369d18d1e641b37d3f31e4e41c4edc
MD5 SHA1 SHA512

Submit Download

times.json

Path /root/.mozilla/firefox/hrvxqjxc.default/times.json
Size 47B
SHA256 8eb5885fd038023006fce4aba731f804aa6ed990a480660f735e48d46217d0b0
MD5 e09f589c5e5088e962f955c1076e944c
SHA1 e518f9a4f7d5190b05a8220f2b2c9a59f117f83b
SHA512 2fcab9b29c1a9c1babbc4b6f9833d7aa226e091cdf6545b0aa243e4f279cb53ade4c4fc274bbcc38be1cae4df877aaf83abf3e288136b1393f366b728fa2d9ed
MD5 SHA1 SHA512

Submit Download

installs.ini

Path /root/.mozilla/firefox/installs.ini
Size 62B
SHA256 50dbac3700353cc9d1e8999a46cec634c019c510e94c8359454e47dea21f382c
MD5 be4d3ae4a95eeea4a8401e8dd8eeb30c
SHA1 a5bf4f73606a30e7cc5775ebe5c4347c834cf731
SHA512 5fd392dcbd9fc78afab6c055b37ec4a5d6bfa7bad7759546c87c5d81a985da5014672a6e1ee81ae86f891421b822383194bec1b5f4661052897028cfcbf6f48b
MD5 SHA1 SHA512

Submit Download

profiles.ini

Path /root/.mozilla/firefox/profiles.ini
Size 259B
SHA256 68f8a46fdb37d6e63474bf70526f5ffbc4d9dbb8950bb0e122f626a3d895f239
MD5 6ee698dd268c891f752942e0a993d933
SHA1 fef1a04bdd16406ce0120f5f124c9b4d34db582a
SHA512 765e2a929bd66a382c8eaf9daab7e162a2182b4c43d7700dc2ee5d4c341f113950771c57ba73deb782cfa170abd4f0ed934e74ca2897acc61375b7342a7ceb00
MD5 SHA1 SHA512

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads