hxxps://eblast[.]ewu[.]edu/t/y-l-xtdkiut-dkhilywdt-r/

max time kernel
7s
max time network
72s
platform
ubuntu-20.04_amd64
resource
ubuntu2004-amd64-20240221-en
resource tags

arch:amd64arch:i386image:ubuntu2004-amd64-20240221-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
submitted
05/04/2024, 19:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://eblast.ewu.edu/t/y-l-xtdkiut-dkhilywdt-r/

Score

7^/10

antivm spyware stealer

Malware Config

Signatures

Changes its process name 64 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	gmain	1640	Process not Found
Changes the process name, possibly in an attempt to hide itself	gdbus	1643	Process not Found
Changes the process name, possibly in an attempt to hide itself	glean.dispatche	1648	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1650	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1650	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1650	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1794	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1793	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1794	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1793	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1792	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1792	Process not Found
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1791	Process not Found
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1791	Process not Found
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1796	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1789	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1789	Process not Found
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1796	Process not Found
Changes the process name, possibly in an attempt to hide itself	pool-firefox	1799	Process not Found
Changes the process name, possibly in an attempt to hide itself	pool-firefox	1798	Process not Found
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1801	Process not Found
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1801	Process not Found
Changes the process name, possibly in an attempt to hide itself	glxtest:disk$0	1839	Process not Found
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1897	Process not Found
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1897	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cache2 I/O	1957	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cookie	1961	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cookie	1961	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	2040	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	2040	Process not Found
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #1	2045	Process not Found
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #0	2044	Process not Found
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	2046	Process not Found
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	2046	Process not Found
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	2047	Process not Found
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	2047	Process not Found
Changes the process name, possibly in an attempt to hide itself	IndexedDB #1	2048	Process not Found
Changes the process name, possibly in an attempt to hide itself	IndexedDB #1	2048	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC Launch	2051	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC Launch	2051	Process not Found
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	2050	Process not Found
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	2050	Process not Found
Changes the process name, possibly in an attempt to hide itself	Breakpad Server	2049	Process not Found
Changes the process name, possibly in an attempt to hide itself	DOM Worker	2053	Process not Found
Changes the process name, possibly in an attempt to hide itself	DOM Worker	2053	Process not Found
Changes the process name, possibly in an attempt to hide itself	Sandbox Forked	2052	Process not Found
Changes the process name, possibly in an attempt to hide itself	Chroot Helper	2054	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #3	2057	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #3	2057	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	2056	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	2056	Process not Found
Changes the process name, possibly in an attempt to hide itself	MainThread	2052	firefox
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	2060	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	2060	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	2060	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Process	2052	firefox
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	2061	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	2061	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	2062	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	2062	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	2063	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	2063	Process not Found
Changes the process name, possibly in an attempt to hide itself	Worker Launcher	2064	Process not Found
Changes the process name, possibly in an attempt to hide itself	Worker Launcher	2064	Process not Found

Reads user data of web browsers 64 IoCs

Reads stored browser data which can include saved credentials.

spyware stealer

description	ioc	Process
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/key4.db	firefox
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/places.sqlite-journal	firefox
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/pkcs11.txt	firefox
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/cert9.db	firefox
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/sessionstore.js	Process not Found
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/cert9.db	Process not Found
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/places.sqlite-wal	firefox
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/thumbnails	Process not Found
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/cookies.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release	Process not Found
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/cookies.sqlite	firefox
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/key4.db	Process not Found
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/sessionstore-backups/recovery.baklz4	Process not Found
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/content-prefs.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/favicons.sqlite	firefox
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/extensions.json	Process not Found
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/storage/ls-archive.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/addons.json	Process not Found
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/cert_override.txt	firefox
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/storage/default	Process not Found
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/protections.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/compatibility.ini	firefox
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/extensions	firefox
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/storage.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/times.json	Process not Found
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/sessionstore.jsonlz4	Process not Found
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/sessionstore-backups/recovery.jsonlz4	Process not Found
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/cookies.sqlite-journal	firefox
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/permissions.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/extension-settings.json	Process not Found
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/ExperimentStoreData.json	Process not Found
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/places.sqlite	firefox
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/user.js	firefox
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/system-extensions	firefox
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/storage/permanent/chrome	Process not Found
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/shield-preference-experiments.json	Process not Found
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/prefs.js	firefox
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/storage	Process not Found
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/permissions.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/xulstore.json	firefox
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/storage.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/cert9.db-journal	firefox
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/cert9.db-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/extension-preferences.json	Process not Found
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/storage/ls-archive.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/sessionCheckpoints.json	Process not Found
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/sessionstore-backups/recovery.js	Process not Found
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/search.json.mozlz4	Process not Found
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/content-prefs.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/favicons.sqlite-journal	firefox
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/cookies.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/storage/permanent/chrome/idb	Process not Found
File opened for reading	/root/.mozilla/firefox/kxeiguy0.default-release/handlers.json	firefox

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc
File opened for reading	/proc/cpuinfo

Reads CPU attributes 1 TTPs 11 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq	Process not Found
File opened for reading	/sys/devices/system/cpu/present	Process not Found
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/size	Process not Found
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/size	Process not Found

Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/class	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/device	glxtest
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/class	glxtest
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/device	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/uevent	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/resource	glxtest
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/devices/system/cpu	Process not Found
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/device	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_device	glxtest
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/device	glxtest
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/vendor	glxtest
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/irq	glxtest
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/kernel/security/apparmor/features/dbus/mask	dbus-daemon
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/class	glxtest
File opened for reading	/sys/devices/system/cpu	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/irq	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/resource	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/resource	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/vendor	glxtest
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/devices/system/cpu	firefox

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/mounts	dbus-daemon
File opened for reading	/proc/2076/cmdline	Process not Found
File opened for reading	/proc/cmdline	dconf-service
File opened for reading	/proc/2128/cmdline	Process not Found
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/mountinfo	firefox
File opened for reading	/proc/2162/statm	Process not Found
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/2125/cmdline	Process not Found
File opened for reading	/proc/self/fd/41	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/mountinfo	firefox
File opened for reading	/proc/self/stat	Process not Found
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/2162/smaps	Process not Found
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/2208/statm	Process not Found
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/1592/cmdline	Process not Found
File opened for reading	/proc/self/fd/45	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/task/2169/stat	Process not Found
File opened for reading	/proc/1525/cmdline	Process not Found
File opened for reading	/proc/2191/smaps	Process not Found
File opened for reading	/proc/self/fd/39	firefox
File opened for reading	/proc/2104/cmdline	Process not Found
File opened for reading	/proc/self/mountinfo	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/fd/44	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/fd/106	firefox
File opened for reading	/proc/self/task/2245/stat	Process not Found
File opened for reading	/proc/1509/attr/current	Process not Found
File opened for reading	/proc/filesystems	nautilus
File opened for reading	/proc/self/fd/73	firefox
File opened for reading	/proc/self/fd/48	firefox
File opened for reading	/proc/self/fd/51	firefox
File opened for reading	/proc/self/fd/46	firefox
File opened for reading	/proc/self/task/2144/stat	Process not Found
File opened for reading	/proc/self/fd	Process not Found
File opened for reading	/proc/sys/kernel/cap_last_cap	Process not Found
File opened for reading	/proc/1509/status	Process not Found
File opened for reading	/proc/2087/cmdline	Process not Found
File opened for reading	/proc/self/task/2194/stat	Process not Found
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	xdg-desktop-portal-gtk
File opened for reading	/proc/filesystems	gvfsd-fuse
File opened for reading	/proc/2120/cmdline	Process not Found
File opened for reading	/proc/self/fd/30	firefox
File opened for reading	/proc/filesystems	gvfsd
File opened for reading	/proc/self/fd/37	firefox
File opened for reading	/proc/self/fd/49	firefox
File opened for reading	/proc/self/fd/32	firefox
File opened for reading	/proc/self/mountinfo	firefox
File opened for reading	/proc/self/fd/40	firefox
File opened for reading	/proc/1504/cmdline	Process not Found
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/task/2213/stat	Process not Found
File opened for reading	/proc/self/task/1594/stat	Process not Found
File opened for reading	/proc/self/mountinfo	Process not Found
File opened for reading	/proc/self/fd/52	firefox
File opened for reading	/proc/filesystems	dbus-daemon
File opened for reading	/proc/self/cgroup	firefox
File opened for reading	/proc/filesystems	sed

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/firefox/.parentlock	firefox

/usr/bin/xdg-open
xdg-open https://eblast.ewu.edu/t/y-l-xtdkiut-dkhilywdt-r/
1⤵
PID:1503
- /usr/bin/dbus-send
  dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
  2⤵
  PID:1504
- - /usr/bin/dbus-launch
    dbus-launch --autolaunch 4816dd152e8c48ff97e9117d197c13d8 --binary-syntax --close-stderr
    3⤵
    PID:1505
- /usr/bin/grep
  grep " = \\\"xfce4\\\"\$"
  2⤵
  PID:1511
- /usr/bin/xprop
  xprop -root _DT_SAVE_MODE
  2⤵
  PID:1510
- /usr/bin/grep
  grep -i "^xfce_desktop_window"
  2⤵
  PID:1513
- /usr/bin/xprop
  xprop -root
  2⤵
  PID:1512
- /usr/bin/grep
  grep -q "^Enlightenment"
  2⤵
  PID:1515
- /usr/bin/uname
  uname
  2⤵
  PID:1516
- /usr/bin/grep
  grep -q "^file://"
  2⤵
  PID:1518
- /usr/bin/egrep
  egrep -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1520
- /usr/local/sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1520
- /usr/local/bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1520
- /usr/sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1520
- /usr/bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1520
- /usr/bin/xdg-mime
  xdg-mime query default x-scheme-handler/https
  2⤵
  PID:1524
- - /usr/bin/dbus-send
    dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
    3⤵
    PID:1525
  - - /usr/bin/dbus-launch
      dbus-launch --autolaunch 4816dd152e8c48ff97e9117d197c13d8 --binary-syntax --close-stderr
      4⤵
      PID:1527
- - /usr/bin/grep
    grep " = \\\"xfce4\\\"\$"
    3⤵
    PID:1529
- - /usr/bin/xprop
    xprop -root _DT_SAVE_MODE
    3⤵
    PID:1528
- - /usr/bin/grep
    grep -i "^xfce_desktop_window"
    3⤵
    PID:1534
- - /usr/bin/xprop
    xprop -root
    3⤵
    PID:1533
- - /usr/bin/grep
    grep -q "^Enlightenment"
    3⤵
    PID:1536
- - /usr/bin/uname
    uname
    3⤵
    PID:1537
- /usr/bin/which
  which firefox
  2⤵
  PID:1580
- /usr/bin/firefox
  /usr/bin/firefox https://eblast.ewu.edu/t/y-l-xtdkiut-dkhilywdt-r/
  2⤵
  PID:1592
- - /usr/bin/which
    which /usr/bin/firefox
    3⤵
    PID:1593
- /usr/lib/firefox/firefox
  /usr/lib/firefox/firefox https://eblast.ewu.edu/t/y-l-xtdkiut-dkhilywdt-r/
  2⤵
  - Reads user data of web browsers
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1592
- - /usr/local/sbin/dbus-launch
    dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
    3⤵
    PID:1641
- - /usr/local/bin/dbus-launch
    dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
    3⤵
    PID:1641
- - /usr/sbin/dbus-launch
    dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
    3⤵
    PID:1641
- - /usr/bin/dbus-launch
    dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
    3⤵
    PID:1641
- - /usr/lib/firefox/glxtest
    /usr/lib/firefox/glxtest -f 13
    3⤵
    - Enumerates kernel/hardware configuration
    PID:1649
- - /usr/local/sbin/dbus-launch
    dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
    3⤵
    PID:2065
- - /usr/local/bin/dbus-launch
    dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
    3⤵
    PID:2065
- - /usr/sbin/dbus-launch
    dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
    3⤵
    PID:2065
- - /usr/bin/dbus-launch
    dbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr
    3⤵
    PID:2065

/usr/bin/dbus-daemon
/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1507

/usr/bin/sed
sed -n "s/\$^[[:alnum:]+\\.-]*\$:.*\$/\\1/p"
1⤵
- Reads runtime system information
PID:1523

/usr/bin/sed
sed "s/:/ /g"
1⤵
- Reads runtime system information
PID:1540

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1545

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1544

/usr/bin/head
head -n 1
1⤵
PID:1543

/usr/bin/grep
grep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
1⤵
PID:1542

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1549

/usr/bin/head
head -n 1
1⤵
PID:1548

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1550

/usr/bin/grep
grep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
1⤵
PID:1547

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1555

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1554

/usr/bin/head
head -n 1
1⤵
PID:1553

/usr/bin/grep
grep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
1⤵
PID:1552

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1560

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1559

/usr/bin/head
head -n 1
1⤵
PID:1558

/usr/bin/grep
grep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
1⤵
PID:1557

/usr/bin/head
head -n 1
1⤵
PID:1563

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1565

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1564

/usr/bin/grep
grep "x-scheme-handler/https=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache
1⤵
PID:1562

/usr/bin/sed
sed "s/:/ /g"
1⤵
PID:1568

/usr/bin/sed
sed -e "s|-|/|"
1⤵
- Reads runtime system information
PID:1571

/usr/bin/sed
sed -e "s|-|/|"
1⤵
PID:1574

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1579

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1583

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1586

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1591

/usr/bin/lsb_release
/usr/bin/lsb_release -idrc
1⤵
PID:1803

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -parentBuildID 20240108143603 -prefsLen 20252 -prefMapSize 231436 -appDir /usr/lib/firefox/browser "{966d4adb-0314-42e0-bf41-ca505c40957b}" 1592 true socket
1⤵
- Changes its process name
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2052

/usr/libexec/xdg-desktop-portal
/usr/libexec/xdg-desktop-portal
1⤵
PID:2076

/usr/libexec/xdg-document-portal
/usr/libexec/xdg-document-portal
1⤵
PID:2081

/usr/libexec/xdg-permission-store
/usr/libexec/xdg-permission-store
1⤵
PID:2087

/usr/libexec/xdg-desktop-portal-gtk
/usr/libexec/xdg-desktop-portal-gtk
1⤵
- Reads runtime system information
PID:2096

/usr/libexec/gvfsd
/usr/libexec/gvfsd
1⤵
- Reads runtime system information
PID:2104
- /usr/libexec/gvfsd-trash
  /usr/libexec/gvfsd-trash --spawner :1.8 /org/gtk/gvfs/exec_spaw/0
  2⤵
  PID:2128

/usr/libexec/gvfsd-fuse
/usr/libexec/gvfsd-fuse /root/.cache/gvfs -f -o big_writes
1⤵
- Reads runtime system information
PID:2109

/usr/libexec/dconf-service
/usr/libexec/dconf-service
1⤵
- Reads runtime system information
PID:2120

/usr/bin/nautilus
/usr/bin/nautilus --gapplication-service
1⤵
- Reads runtime system information
PID:2125

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 22645 -prefMapSize 231436 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{a05f5b9c-c074-4ca5-a62d-ac4d4f187e60}" 1592 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2138

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 2 -isForBrowser -prefsLen 22313 -prefMapSize 231436 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{af2c025a-5d85-43eb-b3e5-d41b23f4cea6}" 1592 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2162

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 3 -isForBrowser -prefsLen 22662 -prefMapSize 231436 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{117539f2-fa0f-45a1-964b-ecbd7ef2f62e}" 1592 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2191

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 4 -isForBrowser -prefsLen 28662 -prefMapSize 231436 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{6ee01f18-49f6-4176-9b23-24bc280dc9cf}" 1592 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2208

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 5 -isForBrowser -prefsLen 28040 -prefMapSize 231436 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{9fa13695-1796-47fc-b007-907f0495cfb7}" 1592 true tab
1⤵
PID:2242

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/root/.cache/dconf/user

Filesize
2B

MD5
233a918e720c69424cb9d426c418e012

SHA1
aee0f3fd21afd3411aafb35be196fd62c1729eb2

SHA256
58fe086fe8376a7f83e2774a29fb609cde97ea058d84c931194e2b967b79bef3

SHA512
0f7149f233b858903af466029ffe89f602384d85ed14f562598bab210e0e26d935f4195a654087b8b0af3e1d7f2fd5b7a2ffe2e4241f9380870aa8ee2e491001

Download Submit
/root/.cache/dconf/user

Filesize
2B

MD5
4381fcf19c7214def45db3ececcfe54c

SHA1
6bc896c1c613812cb90989f1ee99b46ccc697e8f

SHA256
9f1afa4dc124cba73134e82ff50f17c8f7164257c79fed9a13f5943a6acb8e3d

SHA512
b078e46e8056e15676cbe187dfbd10d129c3962e103c8c8acd3d719664de8396f20644162db08b3c5c938124b8342d60c17ada1f5a7deb932fa61be82d336d9c

Download Submit
/root/.cache/mozilla/firefox/kxeiguy0.default-release/cache2/entries/099EB2BF8827A4F91EAB3E38B14650D0205226F2

Filesize
15KB

MD5
cb89b2b25adfe12e6cd2414e0f068937

SHA1
41ce49e081a5c7ef316a25d1d668a00c335bf852

SHA256
ae24bcd4e888432bb538641242a21c9bd492ca902633898e3b90b2638b6c8afe

SHA512
b0fbd20ae06e312302253536cc2fb67828c8e015a9bce891fc4011cbc5c4f2777b312d35de493322623cb8ef1ecd413931b1d166facb1fd9efdb8b47f7d15300

Download Submit
/root/.cache/mozilla/firefox/kxeiguy0.default-release/cache2/entries/44230749A38B6989F56217B435A03E84CCADE62D

Filesize
26KB

MD5
a9bdb1c7868dce436fae017877a29562

SHA1
b0b3757caf8a7c9d96ed0cd6c9c2c03a1b092a5b

SHA256
c6634dda72d6f5273b98c65f49a6dc3c03db7a8d957d09961ac2173fb9384361

SHA512
4b62b7fed28ca6c41b93e27383b8b8883636813c1665b62e30363e87c75cd8355648b67421b97b797dbc81903791f618e8b1e68522672733638bb869785ed29b

Download Submit
/root/.cache/mozilla/firefox/kxeiguy0.default-release/cache2/entries/4CE7249E22694EFAE6EE9CF14E94F15E45E84E52

Filesize
9KB

MD5
53a1f1f47499243f07b66f28734f24da

SHA1
4c1e760633f23eadea88f36e0ceecfadfb54b35c

SHA256
803d35787a6e5d3714613182dafbb4908fda4aefccbd9ecf7e32e9d2ea404774

SHA512
8f898481f003dbdac4b0a176a4c5d0ac319d30300ddda437cfcde6e2e4be7a0efb20aadddbf02a379a4231c5beb26a59200d2d28fa8c70287865be174d6144d1

Download Submit
/root/.cache/mozilla/firefox/kxeiguy0.default-release/cache2/entries/6D89348819C8881868053197CA0754F36784BF5F

Filesize
10KB

MD5
e3b2fa68b76f62a5b0b502a86ec667a6

SHA1
aa30a4ac8c9d1b2f3fdac4a11f7175242678466a

SHA256
53b09ee4f2abae19b261647228d31817ac4308ee56d453fc74e030cf7824a038

SHA512
8f6d6ec2251d0fce74c488e2a6e5f98b33dc00ff746e9e3afec12ab2e086837300a8f18251a9cf578c07ff00479304cc0bf4d2c754fe846d89848e43875ab624

Download Submit
/root/.cache/mozilla/firefox/kxeiguy0.default-release/cache2/entries/E2E528B98563982D062330165DEA3351001E39C9

Filesize
9KB

MD5
1aa1faf98433c6edf4d6eba92488391d

SHA1
569b1ddccffeb8c070acca88c3a39790dab266ff

SHA256
7fdc30f67f6be6da3c83b64d1d8ab3de589a9712a9b7d80e51da9686c6df2277

SHA512
ed8b186667c1585f1ad6428b9e22d3718197818fe58c737acd82df979d8bddda361ba0f8815f485503db7069a7cd0e7bbb833daca4fccf492c00bf8af3384423

Download Submit
/root/.dbus/session-bus/4816dd152e8c48ff97e9117d197c13d8-0

Filesize
466B

MD5
a051022675ec22a6e03040a5a6f4c32f

SHA1
977c238c51fcf9aeac4cdaec1788d8f52323b205

SHA256
99a058097652dcd131aa34e47acebde9aee2b2f3901170696b55fee5be9fc1fe

SHA512
90ff23b9310905a3175d2344b2f1c67e0f2ce6edbba06b721c092919da9016081314efac7a91a7bfb653787681eed609b349407ea6aeebd13294731e47b6ec73

Download Submit
/root/.mozilla/firefox/Crash Reports/InstallTime20240108143603

Filesize
10B

MD5
3d9e077da0108cf3db1099ddb5209f0a

SHA1
02e66815d9908881d27b8c0dfa5ffd0384b2d6f2

SHA256
5c69dad5f6d97e2b743e3477f2a692d80f403f2b621ed12e651114358f9d0ad6

SHA512
f58d7a1189b26bbbac38bf1f7ac382fa11a6394a2b2bc0405235fb24a93a7bbe766e3312f047cbe09ecb9d1b287a339b8cda3bf0a625a5378abfc5ff0027045d

Download Submit
/root/.mozilla/firefox/installs.ini

Filesize
62B

MD5
46f0408f8f0facd589cd70fa22e65973

SHA1
586ebf40950dbe6938446ab2f292c307f29f7438

SHA256
d92fec3168da1965c0bad15b0c630ccdb99417aea50fa59fdbf119fb88f18d2d

SHA512
c2262319032afcbddc745ed8be39cae2651c2d35bc57f3975fad411a3ca9d2e0c29a485665af5b62c3df4f67ddc967a8aef98dff740dea6dff46b70fd865cb16

Download Submit
/root/.mozilla/firefox/kxeiguy0.default-release/cert9.db

Filesize
224KB

MD5
4161d8f689b6816b2ba53d0e87ffa6b6

SHA1
4f1afe48e21af7a799f0bf16b659bf80713d7f38

SHA256
9b2bc31284eab53e906330bf2bd3b8c690b4f066ba689bc871f19010a633e251

SHA512
cf8953347f0b68c179ab8f4ae15a2875f9c801de89d463c1d13b0b1aa8cac683c7d76aab6cfcb77734a4e7ed7719bce9069bcb93e8a763fb8c6f9c6a5c982770

Download Submit
/root/.mozilla/firefox/kxeiguy0.default-release/cert9.db

Filesize
224KB

MD5
f69d8b78d9bc453a4a36ec7c086654f6

SHA1
9aa62f1c2ca4722b9985a926cbcaac7f05b8af8e

SHA256
0c1e46d01a0376233ff47301e1f9b878a70a5e88e45cfc9b5d78285da1a5a218

SHA512
27ba0e0a240712853fb09d28e25312a969eefbc29a9bcc29e5577c6cf174ac46598df180ab632d3cba03d1cc0584188b9198ef67adc45cafb0883799e7344f77

Download Submit
/root/.mozilla/firefox/kxeiguy0.default-release/compatibility.ini

Filesize
163B

MD5
2d41a6f5736821b90ef44850dd3873fe

SHA1
a47c4bc1431234a5b58e460ede5b571acd38e562

SHA256
b4bf5c8334f6db20ae94105141ae7a721342ddccd94ec65289dc291e76a31814

SHA512
047a1455211e7aa29ef5f32f07c89d8a0c8d86d871bc664e4d8958a2a014dbe32f0613cd9eb66e7307c0e2439f74ca0b829652a52fa48e8c60d64b41f69914eb

Download Submit
/root/.mozilla/firefox/kxeiguy0.default-release/content-prefs.sqlite

Filesize
256KB

MD5
9d00c3716db8b9c9d51508593d757e60

SHA1
c1cb5093db37d62d22f3083c8fe96631006f6e8f

SHA256
b3199c67fff1807fd8fad7f70345b9c28626ce49a2150f688a239fb010e75420

SHA512
12fee206948261c76f728dc0076f722a4d0574b5c7cb9e7441bb072aae29235c30d79d514bbb0ae3382bbdf06d8d4d88289576e238f94e4731244f8134f3adf0

Download Submit
/root/.mozilla/firefox/kxeiguy0.default-release/cookies.sqlite

Filesize
96KB

MD5
26ff39b359947b71a5fadd950fac34f0

SHA1
66e5830e4dca79225f41adc13a077d8e5dd8084b

SHA256
aecbaf3e1df1332d4f14a11480db712eb4aa91581eb4e942c580bf675f592a45

SHA512
7fae7b9ff4362e12f00acdc898f6f679718bdd28dc959684333086de7bacd162338dc266810f9f3f6dfa3dc228291efd6bb325e2e8573ca0e6a699059a145f11

Download Submit
/root/.mozilla/firefox/kxeiguy0.default-release/cookies.sqlite

Filesize
96KB

MD5
102a8b6e82208a1b69224bdca8a5b10f

SHA1
8413dc3772127c4159e6d6b51372990a06b805ee

SHA256
5ebf89b32937916a76a8432832040cf0f6b99c2f006cc42f856712d403ec182c

SHA512
49c5c27c6749a7a73b4b944eea64ceb053a272619e6319bfd433ffbe126c8fbccc110961018165a4c7de781a86cf38d2bd9e52ec71b10bc73c9fd05fe841a46c

Download Submit
/root/.mozilla/firefox/kxeiguy0.default-release/favicons.sqlite

Filesize
224KB

MD5
aff3f84fda6516b87050f171d68531ea

SHA1
6b82d182412601c057bfc591cc6b9a8932c84c73

SHA256
5203714a71df85f81969a193cac50befa4b1e70841b9b2d3ea348d3b99657172

SHA512
aacbaa66d86f8b3f299cead818a0883bb900588da822148b4ac7543a0fa4ee399c14a69534ae55bfd0e7b18630b93f04e0e0174b7d586e0d536c20760b5d65d8

Download Submit
/root/.mozilla/firefox/kxeiguy0.default-release/key4.db

Filesize
288KB

MD5
d8b811aecb2c1cff3b9d936e83c14293

SHA1
63c72f3c54c2061952cb01d252206b3e577de4f7

SHA256
e07729351a95351d9be9fb1908869b6e99ab637900fa626bc8cf0e518a630a9c

SHA512
c5df2655b4c2b8c4e67e75cfbf1c536712d24ba0e6f8cf230321d0723ec28427c22b64c79f2e6d2de759648cecddb11d1866d704a9b0356eb56fd0031fbc44be

Download Submit
/root/.mozilla/firefox/kxeiguy0.default-release/permissions.sqlite

Filesize
96KB

MD5
652770017ccd3217c70066cdb7213d35

SHA1
61bcaddfc3b435b399490896b7d6055269ab6653

SHA256
660ccd2cc3805ef44ddd244134e82179df1708a253571afb5062d1b38939bd9a

SHA512
db4b111d760e1a67d63248a677e8487a2ecc31e89362641bcde5ef1d8bbf893b57ad70922fcebbc961d686520361f5bf0c6b7c217ac1b9164e3d275be2dc9db1

Download Submit
/root/.mozilla/firefox/kxeiguy0.default-release/places.sqlite

Filesize
1.4MB

MD5
ae67c827728a10989adaf10083abe11e

SHA1
ac7b1e77d5f09dde19aae9d1f9de1e8771e7b641

SHA256
88383609549c412b3a7ec0911c5f0a0a651de5454e386dd6a3ac99f518b3ab16

SHA512
0e68c1c71a2d88465b3c1841d36cdf19171a203e04515e29a19584310eb4c15113e8326a6c5deb771285c2b481da4deb3bbc7e4b42c5c4196a5569a5ae5b6ab5

Download Submit
/root/.mozilla/firefox/kxeiguy0.default-release/places.sqlite

Filesize
896KB

MD5
3ad444b26d70aea497cf9f0e88e3280a

SHA1
113b8d250e3ff79b2ceb770c9504cd948da37612

SHA256
6464759ebf6c635389e561b2aa5348af5bddd6104432982ac13baa7750967b6e

SHA512
87f118112043209360c02838b79c3e926c23992b2e51f26c550f57cc4fea8bdf28c14fd3eff78d86f1f21801683a44f7e36aae8e3a21e78f04dc4bd507d9a936

Download Submit
/root/.mozilla/firefox/kxeiguy0.default-release/prefs-1.js

Filesize
1KB

MD5
c21b0169193888d630ec3942553a5435

SHA1
03e7adf0e529a16d7afec68f79537206609d7e52

SHA256
576a624b20e7ccd01ddad633b2e5182ece0f0a81300345f057c486471466fe36

SHA512
9610b98239f79d7bb2634229aae2444dc11076c8a8ad2f9b25ab1315850ba7483d9725adb52ad68f9b0630f60be158abf9c2c2ee7d33a6d891bfb086294f5950

Download Submit
/root/.mozilla/firefox/kxeiguy0.default-release/prefs-1.js

Filesize
2KB

MD5
00ccf5de8307c3c1ee415f35e6217dfb

SHA1
6dc9854aef3529278a027dd2e9712384bfbe4172

SHA256
ea98db4454600c49dadfe8217884c5fb912c89b8227c58c5591d210e923caba9

SHA512
1011f65ece021e908a3a4612629c9e835adf1764a926d7e5a381f7719f76699a3ff584bdedd9945bbeca8f499d50b89113e498a0147022bda581208cd76853c6

Download Submit
/root/.mozilla/firefox/kxeiguy0.default-release/prefs-1.js

Filesize
2KB

MD5
e588b44fd81a70250e41b4f05b481a70

SHA1
d1ebe8e5c86dff22c85828fd9b8089c4a9515554

SHA256
b8da7d24988bf850ef4715a4954d0a6e847d8e4c4a6023d1f3464e8b5ddc7137

SHA512
aa46bf5f0fb1c27d25cc334586c6566b0f964c2ddb1224c4d4c78d9d0fb86d9698a12550bda7f46367f5615364cbd966271060fc767d36e8aa240fe1eaa0a70a

Download Submit
/root/.mozilla/firefox/kxeiguy0.default-release/prefs-1.js

Filesize
2KB

MD5
155d096a9269806384814e25324edf7c

SHA1
6551a8a93ef459d87076e9ef456b7717f165db95

SHA256
2e31ad55b70b4610e986a2e4211ef605002e83717e0c23bf370f9518c477fd56

SHA512
0fe320737569bad28b1345e364d8cabe5654b98ebe9a38467a8ec92b96a914e339925b9377c9afc7b01f91af3fa8780d102df7939ef8799ad25f4506eaccd3fd

Download Submit
/root/.mozilla/firefox/kxeiguy0.default-release/prefs-1.js

Filesize
3KB

MD5
6246e1a78ce201864874d3b32110b51a

SHA1
705cb30cd83a390a3d05aefa9c88b561da8c02d1

SHA256
9e6205e44f935805c77b138b670c50cbb786f7d564eac3cb92e59c50122ce95b

SHA512
99cf30232029a9d5578e9548ccde4f2ea9d0e2388918c7bd5b5fd57a85587064fda5bf670fb6150ef8c099286fc755f1798b2e3bf1863bf468abe3b32aea7c65

Download Submit
/root/.mozilla/firefox/kxeiguy0.default-release/prefs-1.js

Filesize
4KB

MD5
efa2607145b39766d1cbd10fc00b3d8d

SHA1
d533c6b9ccbdae3d77bb340b10376320a4b852b2

SHA256
aeb98683d076a666cebb9538ccdf52c1de5d735a75783d6a1251e543dc28129d

SHA512
a537699952b944fb4b7c591403b254abf541f31f31fa2aca0be86f47eff127c3aca08240d91f50b3c2c96b372d53353178c8d5ec953f7ea12cdce40b333216a4

Download Submit
/root/.mozilla/firefox/kxeiguy0.default-release/prefs.js

Filesize
1KB

MD5
219ccd94ee7d89d3b793aaf7aa2ea6d4

SHA1
141dd493781f267276e41df0428b749396d1486c

SHA256
97cae9f1e7e42ba611c55a0f760429d0b0598ecfc7395e7b742a80fab2cf6b52

SHA512
74143cc653c8f458aceaf9cae96652090a07425d9ba182ae028167fd00732de3f82f40419a0779bd96aca06d33feb5365592563b3f407b239b95ad82ce568fa6

Download Submit
/root/.mozilla/firefox/kxeiguy0.default-release/storage/ls-archive.sqlite

Filesize
96KB

MD5
e1121e3dd3c8a9c384f879bdddcff219

SHA1
625f25a1a5ff8527ab3105636fa7aecb9affd234

SHA256
766b9f50254b4e5526b0cde2911512956262596d8937f8630805d3c70802a066

SHA512
03e1cee2e75b2b609b8344a40995de09de837e940d2012f2fea65d9c70eecbcd3345b66b852f32211b38b06a4370f06f02ca7521e29e7113e2e12a6a7752be31

Download Submit
/root/.mozilla/firefox/kxeiguy0.default-release/storage/ls-archive.sqlite

Filesize
128KB

MD5
0d2b18bbf091633c4fe1ebdd197dfa15

SHA1
c150dc37042d92d30efed6cbc1b536eb66ec1a3e

SHA256
fe63ee867e0f229a0bcc48b771afeec394c362ac6d0c2bd6907c7202097bd228

SHA512
59d202bfaf236bdcfc05a3e148a773d15a3bdff23be26fb2cbfd059fee6c4a516c7a59de0a3bc97df1419c34464e1346354979ddda1062101121522f22d8156d

Download Submit
/root/.mozilla/firefox/kxeiguy0.default-release/storage/permanent/chrome/.metadata-v2-tmp

Filesize
36B

MD5
eaa4c2d63d3cc9af44600df1d6a5ad7e

SHA1
10c4e06c6f77b423d8fa2527d4a63700bbb1e04d

SHA256
14c166f0449174df7bf855b882a583adf9462eb6e7585b628ddf938a54346988

SHA512
e48c4aa11aff1f1be2ea96397ef534bce9016e267df7970e00cc833944e18e0e379cc0c0aaf159e5315a389520b619186c8d850760c169b4b77ff90d99df71c5

Download Submit
/root/.mozilla/firefox/kxeiguy0.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite

Filesize
44KB

MD5
488403dd59d861961dbf2e5317cc6e55

SHA1
bcb13cf819bdc370762237a075f14a9be0728a50

SHA256
8645149962df6c816291521b6cb45e9acf79da6bdc3a727ba00c71eb720de4ef

SHA512
4e60bc58fdc1ffe3662b83fc9af3e0ec5af90eeb25da8e60a70717e3588676e135f6cc5a8d57a37c2cd2ce3a3661e665e2688d00799dd834945d5f0964750805

Download Submit
/root/.mozilla/firefox/kxeiguy0.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite

Filesize
12KB

MD5
2119d2ceb21451909debdf56077c528e

SHA1
1d9b7c4892fec4c7792157a734b929f86907eb16

SHA256
c38ba0bac8502e956099ac967cafa42dda451a31d5896d234193d6abe4fad674

SHA512
56cb6a1aa4a0d7d7d56304b423795a781765191e02f35c49f0991c04b8bf37c9647eb0f9ca26dfbcabd86f3d72f5760026cc2cb4b4343555836bfee65e31b4e4

Download Submit
/root/.mozilla/firefox/kxeiguy0.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite

Filesize
44KB

MD5
f1cd629017b1fe58fc80953ebd4754b6

SHA1
01e02178484458797c2b682325b26b2633fe8466

SHA256
81bf3da297b9ee8270bea383d9479cd7951e35f552361230358e3a35e1f44567

SHA512
afb775074af046014236a312865a1811de3bfb97f8df057541401867140fcc236259ab237712a7d3bc012ff84cf90330e4e122374cd09c194c4c145f575fb95a

Download Submit
/root/.mozilla/firefox/kxeiguy0.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite

Filesize
12KB

MD5
2023d8f123db0a012e5ad3542cce1836

SHA1
0eb73f5803031bfa8de4650084cd4448a0133919

SHA256
21e802f1aadd8665566d460b99aa45a728d2a067d29c56d6412563e199269c34

SHA512
7b8579c4768da8f58666b412cf2350572a5f915f92f3a567a7e044b9f42e4ce3b1046083f95924faf5a100003bf4ab132c9b6fa871277c3d7337665b235086fc

Download Submit
/root/.mozilla/firefox/kxeiguy0.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite

Filesize
44KB

MD5
1ea539584c41fd171d307fb9e740d499

SHA1
de3d1a3d6a0173bcd30c89f148cd732d0ae614eb

SHA256
aaa3461e12a1343eb5803894e1ef6894014b75b26ef264f29ece30b1cea3aa83

SHA512
22b145864127c0f223522016c6ba0a67e06a36aeba135e546f4d77000f436d5060064eb988b7aafdb451e39f70d0afd20313d15507dd531234ac25d60e9d935c

Download Submit
/root/.mozilla/firefox/kxeiguy0.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite

Filesize
12KB

MD5
0ef5814346c21edfa56d4af4a992b1b0

SHA1
dd271aec9e041b4466d62b52add9d658be496d8c

SHA256
20400d7f5ae48927df6bb872ca089f13a318f555205ca98b738e17bc8e427f6e

SHA512
fc1374fbc66dfc742f932a0263efba4a37045b6f328f09768efcad50522a8ecfc29420736eff74a28d378d2ed2a5b571b12627ccf8d272d88fdb0da0968a7c23

Download Submit
/root/.mozilla/firefox/kxeiguy0.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite

Filesize
16KB

MD5
7762c7be28ea4289189d885832377864

SHA1
62451f955c8b9784fc969bdb228480e4074d197b

SHA256
ab4bfc5dd30c0de8a537c76431c023bdbfae9b39c9381a02224ccba37069e2c0

SHA512
1ed5dd9ccf848d202fbd4dea4e07f46ae8022fc872f1c91fcdabdb2fb0040d10225be56de366797b811cde4dfe7cad67be63ca58d67961eb9f92c0136f824938

Download Submit
/root/.mozilla/firefox/kxeiguy0.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
44KB

MD5
225fe36c4bb990de9670b27368d655a2

SHA1
1dc382bec9af9b4bd0308dea1908ab6933834828

SHA256
2185235a458ef8924a1370bb956dd1d65d1f7bbffda08289275e072b65d5d1db

SHA512
11eb31a930a336c13869b0d385df555d7fba32ecea26bf513398dca2a35439643b0896a94c4696ffb439eef18b7f85982155dd12beddef784fe4ed1e86d2d1c2

Download Submit
/root/.mozilla/firefox/kxeiguy0.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
12KB

MD5
5a08a7f4223d6738f431a6882c3b984e

SHA1
e7fc2a38255e17d8d429bcf597570cc65e5fa4bc

SHA256
548a376a04c56ad55a7756c80c309d31cc4c4b0aea5426b1f1c628d02bf9c800

SHA512
875b27cf3e3a3b885039734a66615acd5a708730dc128e7af520ee5b6b9b87a344db7adfd80f7d04e34769378ef76ec1827206be705fad2fc624774338319eb2

Download Submit
/root/.mozilla/firefox/kxeiguy0.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
156KB

MD5
91fc514577bab7e0aed86851bbf3dae7

SHA1
ab898e737c6534a4fde355755a3159bcfa92fdd7

SHA256
4dac9ac9cecdad44bab1f23fe580d51ec93d96bc00be59ef691c7d70b633036f

SHA512
8cd73f2cc13c781ea7392785ddf19115399dbe07664ecdb89a5b4cf90c7cd7f8299264704937e68e2cfd003151f0121ef1ac6a1705571eebed9f258d6811af15

Download Submit
/root/.mozilla/firefox/kxeiguy0.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
116KB

MD5
bbe9e4471c97fb1b270eb793922a00e8

SHA1
a1da47669a2b512be64ba97e8bbd587887d2c24f

SHA256
dedbbbca17668696789b6525ec93fadbb5731e96df326c7d84ce355fe0ca1bac

SHA512
1df28b24c05bd0931c3fab72bf6283d4a4df4253bd28060bf9abaf8fa0b9fd91e7790c28d7972287ac82a1bf04eecd3fab8acdaa26dfd394b3493280c7474f1d

Download Submit
/root/.mozilla/firefox/kxeiguy0.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
240KB

MD5
3b89d5e073f1affafcb4146e40f9bf67

SHA1
10889b436456917c8fa7ae472ef91ca3aabebd60

SHA256
bebc91dafe2d1bc6bc99dd3d6616862fb93662a1109d3324e1754c0f8f44be51

SHA512
e56371af5c46097e1aa6765c02809bc59c49f95bc3bbb7343d465942a46152177f773783c353c750dfaa14ef2b4e7db4c0b81d27b818b2da29d9cf71d0fb2974

Download Submit
/root/.mozilla/firefox/kxeiguy0.default-release/times.json

Filesize
50B

MD5
3d8dd96f37ab0f0270338a0ad6390b8f

SHA1
b27dcd9f87cfe2d6618ea9b038c70aebfa073b84

SHA256
740bf3f2e4bee0e23631f6fe114b19905009e75d2d9dcad19c596a09497208e8

SHA512
252226761e285ff83be8df0a2464b5a62773af565d73139b659d436ddc1f3d98a54b5a7b943ac834897c554f45a4dbbbcc4618a7c52c42b2816d632d0a3b8841

Download Submit
/root/.mozilla/firefox/kxeiguy0.default-release/times.json

Filesize
47B

MD5
af750c0f72240d7fa548d9872eb3c6fb

SHA1
2bfb0cf0f3a5d725186fe2b53defbb834b6bc9cf

SHA256
3d929800d8627443baf45040bd4766e11a96d3a6041d37baa455ef2937aa008f

SHA512
097df3435eb02d57c31265211200322514aff885f2922382b4b4f6ce6d5c9f0e3f7fc5d2a5af8746944d107651bd9841b1e585c76cc4a8dd5c04c3835cecd791

Download Submit
/root/.mozilla/firefox/profiles.ini

Filesize
259B

MD5
9c9ca38f2a59ef1b6ad0a9de79b7aa4a

SHA1
908c5913773838749f764eeab18f46607c23b29a

SHA256
d36beb841e6208e08ebf15aeb420333da584198834ade5940a492c6255b6f193

SHA512
f05ecfd9d1c022b626034de4b1156ec03e117b9832736da851c354e8e9e9fca439056f7f9738008a266cfcdae19555f73a2bd590a9c88a2825b8b4878f54cde5

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads