hxxp://8[.]8[.]8[.]0

Analysis

max time kernel
9s
max time network
73s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240226-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
06-04-2024 14:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://8.8.8.0

Score

7^/10

antivm spyware stealer

Malware Config

Signatures

Changes its process name 64 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	glean.dispatche	1682	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1683	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1683	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1683	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1688	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1686	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1687	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1688	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1687	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1686	Process not Found
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1685	Process not Found
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1685	Process not Found
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1689	Process not Found
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1689	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1684	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1684	Process not Found
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1691	Process not Found
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1691	Process not Found
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1693	Process not Found
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1693	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cache2 I/O	1694	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cookie	1695	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cookie	1695	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1696	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1696	Process not Found
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #1	1698	Process not Found
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #0	1697	Process not Found
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1699	Process not Found
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1699	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	1707	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	1707	Process not Found
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	1708	Process not Found
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	1708	Process not Found
Changes the process name, possibly in an attempt to hide itself	IndexedDB #1	1709	Process not Found
Changes the process name, possibly in an attempt to hide itself	IndexedDB #1	1709	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC Launch	1712	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC Launch	1712	Process not Found
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	1711	Process not Found
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	1711	Process not Found
Changes the process name, possibly in an attempt to hide itself	Breakpad Server	1710	Process not Found
Changes the process name, possibly in an attempt to hide itself	Sandbox Forked	1713	Process not Found
Changes the process name, possibly in an attempt to hide itself	DOM Worker	1714	Process not Found
Changes the process name, possibly in an attempt to hide itself	DOM Worker	1714	Process not Found
Changes the process name, possibly in an attempt to hide itself	Chroot Helper	1715	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #5	1718	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #4	1717	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #5	1718	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #4	1717	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #3	1716	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #3	1716	Process not Found
Changes the process name, possibly in an attempt to hide itself	MainThread	1713	firefox
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1720	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1720	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1720	Process not Found
Changes the process name, possibly in an attempt to hide itself	FSBroker1713	1721	Process not Found
Changes the process name, possibly in an attempt to hide itself	FSBroker1713	1721	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Process	1713	firefox
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1722	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1722	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1723	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1723	Process not Found
Changes the process name, possibly in an attempt to hide itself	ProfilerChild	1724	Process not Found
Changes the process name, possibly in an attempt to hide itself	ProfilerChild	1724	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1725	Process not Found

Reads user data of web browsers 64 IoCs

Reads stored browser data which can include saved credentials.

spyware stealer

description	ioc	Process
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/key4.db	Process not Found
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/permissions.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/xulstore.json	firefox
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/handlers.json	firefox
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/sessionstore-backups/recovery.baklz4	Process not Found
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/search.json.mozlz4	Process not Found
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/content-prefs.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/cookies.sqlite-journal	firefox
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/times.json	Process not Found
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/storage.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/sessionstore.jsonlz4	Process not Found
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/addons.json	Process not Found
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/cookies.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/storage.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/extensions	firefox
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/extensions.json	Process not Found
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/sessionstore.js	Process not Found
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/sessionstore-backups/recovery.js	Process not Found
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/prefs.js	firefox
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/addonStartup.json.lz4	firefox
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/shield-preference-experiments.json	Process not Found
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/ExperimentStoreData.json	Process not Found
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/cert9.db	firefox
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/cert_override.txt	firefox
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/cert9.db-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/storage	Process not Found
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/storage/permanent/chrome/idb	Process not Found
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/sessionstore-backups/recovery.bak	Process not Found
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/extension-preferences.json	Process not Found
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/pkcs11.txt	firefox
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/sessionstore-backups/previous.js	Process not Found
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/user.js	firefox
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/cookies.sqlite	firefox
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/ClientAuthRememberList.txt	Process not Found
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/SiteSecurityServiceState.txt	Process not Found
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/extension-settings.json	Process not Found
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/compatibility.ini	firefox
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/cookies.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/key4.db	firefox
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/permissions.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/cert9.db-journal	firefox
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/storage/permanent/chrome	Process not Found
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/sessionCheckpoints.json	Process not Found
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/sessionstore-backups/recovery.jsonlz4	Process not Found
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release	Process not Found
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/storage/ls-archive.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/cert9.db	Process not Found
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/storage/ls-archive.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/key4.db-journal	firefox
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release	firefox
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/sessionstore-backups/previous.jsonlz4	Process not Found
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/content-prefs.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/AlternateServices.txt	Process not Found
File opened for reading	/root/.mozilla/firefox/nfdr5lai.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite-journal	Process not Found

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc
File opened for reading	/proc/cpuinfo

Reads CPU attributes 1 TTPs 11 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq	Process not Found
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/size	Process not Found
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/size	Process not Found
File opened for reading	/sys/devices/system/cpu/present	Process not Found
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox

Enumerates kernel/hardware configuration 1 TTPs 60 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/class	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_vendor	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/device	Process not Found
File opened for reading	/sys/devices/system/cpu	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/irq	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/kernel/security/apparmor/features/dbus/mask	dbus-daemon
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/class	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/resource	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/uevent	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/irq	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_device	Process not Found
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/vendor	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/device	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/device	Process not Found

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/self/fd/45	firefox
File opened for reading	/proc/self/fd/50	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/1736/cmdline	Process not Found
File opened for reading	/proc/self/cgroup	firefox
File opened for reading	/proc/self/mountinfo	Process not Found
File opened for reading	/proc/self/fd/41	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/1751/cmdline	Process not Found
File opened for reading	/proc/1805/statm	Process not Found
File opened for reading	/proc/self/fd/98	firefox
File opened for reading	/proc/self/task/1837/stat	Process not Found
File opened for reading	/proc/sys/kernel/cap_last_cap	Process not Found
File opened for reading	/proc/1579/cmdline	Process not Found
File opened for reading	/proc/self/stat	Process not Found
File opened for reading	/proc/self/fd/49	firefox
File opened for reading	/proc/filesystems	xdg-document-portal
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/task/1678/stat	Process not Found
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/fd/31	firefox
File opened for reading	/proc/self/fd/43	firefox
File opened for reading	/proc/1760/cmdline	Process not Found
File opened for reading	/proc/self/fd/76	firefox
File opened for reading	/proc/self/fd	Process not Found
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/task/1854/stat	Process not Found
File opened for reading	/proc/self/fd/33	firefox
File opened for reading	/proc/1805/smaps	Process not Found
File opened for reading	/proc/filesystems	gvfsd
File opened for reading	/proc/filesystems	gvfsd-fuse
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/fd/42	firefox
File opened for reading	/proc/self/fd/46	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/1589/attr/current	Process not Found
File opened for reading	/proc/1755/cmdline	Process not Found
File opened for reading	/proc/self/mountinfo	firefox
File opened for reading	/proc/self/fd/47	firefox
File opened for reading	/proc/self/fd/51	firefox
File opened for reading	/proc/1731/cmdline	Process not Found
File opened for reading	/proc/filesystems	xdg-permission-store
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/fd/40	firefox
File opened for reading	/proc/self/fd/48	firefox
File opened for reading	/proc/self/task/1719/stat	Process not Found
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/1676/cmdline	Process not Found
File opened for reading	/proc/self/fd/38	firefox
File opened for reading	/proc/self/task/1813/stat	Process not Found
File opened for reading	/proc/self/fd/6	firefox
File opened for reading	/proc/self/task/1789/stat	Process not Found
File opened for reading	/proc/1613/cmdline	Process not Found
File opened for reading	/proc/self/fd/29	firefox
File opened for reading	/proc/filesystems	xdg-desktop-portal
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/filesystems	dbus-daemon
File opened for reading	/proc/mounts	dbus-daemon
File opened for reading	/proc/filesystems	xdg-desktop-portal-gtk
File opened for reading	/proc/1783/smaps	Process not Found

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/firefox/.parentlock	firefox

/usr/bin/xdg-open
xdg-open http://8.8.8.0
1⤵
PID:1578
- /usr/bin/dbus-send
  dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
  2⤵
  PID:1579
- - /usr/bin/dbus-launch
    dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
    3⤵
    PID:1580
- /bin/grep
  grep " = \\\"xfce4\\\"\$"
  2⤵
  PID:1591
- /usr/bin/xprop
  xprop -root _DT_SAVE_MODE
  2⤵
  PID:1590
- /bin/grep
  grep -i "^xfce_desktop_window"
  2⤵
  PID:1598
- /usr/bin/xprop
  xprop -root
  2⤵
  PID:1597
- /bin/grep
  grep -q "^Enlightenment"
  2⤵
  PID:1600
- /bin/uname
  uname
  2⤵
  PID:1601
- /bin/grep
  grep -q "^file://"
  2⤵
  PID:1603
- /bin/egrep
  egrep -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1605
- /usr/local/sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1605
- /usr/local/bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1605
- /usr/sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1605
- /usr/bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1605
- /sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1605
- /bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1605
- /usr/bin/xdg-mime
  xdg-mime query default x-scheme-handler/http
  2⤵
  PID:1610
- - /usr/bin/dbus-send
    dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
    3⤵
    PID:1613
  - - /usr/bin/dbus-launch
      dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
      4⤵
      PID:1614
- - /bin/grep
    grep " = \\\"xfce4\\\"\$"
    3⤵
    PID:1616
- - /usr/bin/xprop
    xprop -root _DT_SAVE_MODE
    3⤵
    PID:1615
- - /bin/grep
    grep -i "^xfce_desktop_window"
    3⤵
    PID:1618
- - /usr/bin/xprop
    xprop -root
    3⤵
    PID:1617
- - /bin/grep
    grep -q "^Enlightenment"
    3⤵
    PID:1620
- - /bin/uname
    uname
    3⤵
    PID:1621
- /usr/bin/which
  which firefox
  2⤵
  PID:1664
- /usr/bin/firefox
  /usr/bin/firefox http://8.8.8.0
  2⤵
  PID:1676
- - /usr/bin/which
    which /usr/bin/firefox
    3⤵
    PID:1677
- /usr/lib/firefox/firefox
  /usr/lib/firefox/firefox http://8.8.8.0
  2⤵
  - Reads user data of web browsers
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1676
- - /usr/bin/dbus-launch
    dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
    3⤵
    PID:1681
- - /usr/local/sbin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1728
- - /usr/local/bin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1728
- - /usr/sbin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1728
- - /usr/bin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1728

/usr/bin/dbus-daemon
/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1584

/bin/sed
sed -n "s/\$^[[:alnum:]+\\.-]*\$:.*\$/\\1/p"
1⤵
- Reads runtime system information
PID:1608

/bin/sed
sed "s/:/ /g"
1⤵
- Reads runtime system information
PID:1624

/usr/bin/head
head -n 1
1⤵
PID:1627

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1629

/bin/grep
grep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
1⤵
PID:1626

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1628

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1634

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1633

/usr/bin/head
head -n 1
1⤵
PID:1632

/bin/grep
grep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
1⤵
PID:1631

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1639

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1638

/usr/bin/head
head -n 1
1⤵
PID:1637

/bin/grep
grep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
1⤵
PID:1636

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1644

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1643

/usr/bin/head
head -n 1
1⤵
PID:1642

/bin/grep
grep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
1⤵
PID:1641

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1649

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1648

/usr/bin/head
head -n 1
1⤵
PID:1647

/bin/grep
grep "x-scheme-handler/http=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache
1⤵
PID:1646

/bin/sed
sed "s/:/ /g"
1⤵
- Reads runtime system information
PID:1652

/bin/sed
sed -e "s|-|/|"
1⤵
PID:1655

/bin/sed
sed -e "s|-|/|"
1⤵
- Reads runtime system information
PID:1658

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1663

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1667

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1670

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1675

/usr/bin/lsb_release
/usr/bin/lsb_release -idrc
1⤵
PID:1692

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -parentBuildID 20230522134052 -prefsLen 19257 -prefMapSize 230809 -appDir /usr/lib/firefox/browser "{897e1d6c-8799-4d5d-a7fe-5568a377161a}" 1676 true socket
1⤵
- Changes its process name
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1713

/usr/libexec/xdg-desktop-portal
/usr/libexec/xdg-desktop-portal
1⤵
- Reads runtime system information
PID:1731

/usr/libexec/xdg-document-portal
/usr/libexec/xdg-document-portal
1⤵
- Reads runtime system information
PID:1736

/usr/libexec/xdg-permission-store
/usr/libexec/xdg-permission-store
1⤵
- Reads runtime system information
PID:1740

/usr/libexec/xdg-desktop-portal-gtk
/usr/libexec/xdg-desktop-portal-gtk
1⤵
- Reads runtime system information
PID:1751

/usr/lib/gvfs/gvfsd
/usr/lib/gvfs/gvfsd
1⤵
- Reads runtime system information
PID:1755

/usr/lib/gvfs/gvfsd-fuse
/usr/lib/gvfs/gvfsd-fuse /root/.gvfs -f -o big_writes
1⤵
- Reads runtime system information
PID:1760

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 21750 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{29525e60-763b-426e-bfbb-315eb0bee6ee}" 1676 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
PID:1783

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 2 -isForBrowser -prefsLen 21418 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{20d60393-0ebb-42a2-b5a4-238104262d40}" 1676 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1805

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 3 -isForBrowser -prefsLen 21767 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{d13e5c6b-0135-447e-9c2b-0b100c0673ad}" 1676 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1834

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 4 -isForBrowser -prefsLen 27881 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{f2bf74bd-9d06-4863-bc33-5e8c424000ed}" 1676 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1851

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/root/.cache/dconf/user

Filesize
2B

MD5
06896ee466398fc9c6903758007e6151

SHA1
8809e9d340e5d8ad4f9856e7a6e11966f17be8ce

SHA256
c493f6f146685f76b44f0c77ca88120cb8bc89f534fe69b6828827b974e68849

SHA512
f469da04732b22afe1d597c505f906c327ae175f990ac842a6f158eab8221e27e05a325294e13f9d40dfe546df9cdc1699e030639ff363e0881e9ca2944b1745

Download Submit
/root/.cache/mozilla/firefox/nfdr5lai.default-release/cache2/entries/039090029E64BC91E87E77199A6A6BE11FC39B6F

Filesize
142B

MD5
4663a76c2d4acf6db83d9be5f160b137

SHA1
fd4385d9ec2c98bcca638e33f235fd49f0db54ba

SHA256
c6751e11e07870f0ddc826e7b9be508524532bfa97cb6f4345989833004935d6

SHA512
25d97700aaa67bd8de1e2079bbb253f1f2578cd48993a62f443ae583a0c68bc661e16e40a297238e0e41ba3122910e376d9ab915d0261ddaa08ce18e9589f244

Download Submit
/root/.cache/mozilla/firefox/nfdr5lai.default-release/cache2/entries/0EDDF8C091E2FED62E44BEDDDC1723F5BF38FE4F

Filesize
102B

MD5
3c488816e78343c807890f2850821b49

SHA1
967339397665e2a3e2c75a0a5815caf5a54b2a18

SHA256
4543fcab9311fb9a6d66976b798f0b752eb7e4ddc25aa7dead70489fad4346e5

SHA512
555152eda77378910976b6582c27b0b2a511f2ac73b2793e7c30469d4cc74aee702c33fcaf5b5ed1601a4ce53cd7c23b372ecee8cbb17a1e7b77821b8d6db592

Download Submit
/root/.cache/mozilla/firefox/nfdr5lai.default-release/cache2/entries/38B88502343764DB3460152AF4E137C3E43EDE3F

Filesize
93B

MD5
62b94e300bb03ec3f673bf0c7dbe6715

SHA1
9b803abea18d7f06ba0a5f833741c4c1eae2d87b

SHA256
b109a4f7b48903d0a62a8b49cb8ff3dc0bb4994a48c17af003b7cd56954c9ee7

SHA512
15aed3dc24c771243a764f02798990c4766b25ccb25f8c1f4fabaf52a45f124bda0bca5736d691644dac5dd2698e0ab92357bd4e5d63f19d9189f9d9ed26ce74

Download Submit
/root/.cache/mozilla/firefox/nfdr5lai.default-release/cache2/entries/3D1E19D09F398691ABF62061591970855193B42F

Filesize
13KB

MD5
5f3a225dd0d82aa7d70a3b650013f59a

SHA1
78fe593d54a115e38ca73387cbf3d2ad3f650a54

SHA256
a10e8f75035133a87a6a2802dda304d8377bc9ca00ad5486742392dd40289738

SHA512
914bbdcc8a1155643f3c5892309f901786242e08fb4844f45db1fc3899b848eb29afdc665b7026a2f07e94ccd7db421343075d94808f5e55d3f83a65509d63a8

Download Submit
/root/.cache/mozilla/firefox/nfdr5lai.default-release/cache2/entries/3D1E19D09F398691ABF62061591970855193B42F

Filesize
13KB

MD5
03c5acbe447417619f42335305d17590

SHA1
bd5d4dd2b052068f2dd5ca10dcbadac323fa84e2

SHA256
3291da5b64d1fb0057c9af598a1f465613a75ca366cdaeb182f9d43b573540af

SHA512
0f8158bcd6994e9b56a739d1c08d10cc21b134734936e100349df97e9363e5cdb74acae446608fd178efe9af98a35d2153f962e0285a5467036348b6237c5abf

Download Submit
/root/.cache/mozilla/firefox/nfdr5lai.default-release/cache2/entries/59617987D52185F8066DDEC54ED24AB1F17DAD57

Filesize
112B

MD5
9349a5095ef97b0ef90d358f9283ca79

SHA1
4df678c5e7ec03b47b38d1901a7d20eaecce0c21

SHA256
0b9cc83a63ffdb739466c206d3101ac35ed2b4d2e1fb9c28db2b185cbdff7419

SHA512
a52e421a0fcd2cd1f94fe5a5df7ea5d636f1072863cfb903a2767db13354d4783f9d85a3f3e5684f5baf6d34887b6401dc6bc2dbb7f1ed71e8b9ac2f6b36eef3

Download Submit
/root/.cache/mozilla/firefox/nfdr5lai.default-release/cache2/entries/EE1AAB872F378C4FA66FBCD193AF217BF20A4E27

Filesize
115B

MD5
5962841e225ae32441f997e24d10751b

SHA1
35530caa29647a7dfe508c1717f67ef35f435fad

SHA256
cfbaa98398ca9b19e2c9facee98a221e0d5d3c34130ad568895cc3272883b5a1

SHA512
3383457bb162eea5841e82af95986938dd90572fc1d3df9f26a2c3cc0d29e1b448426387ea843201b3e0c1f6bd66b89b520a43b1b0725daf9af632ef97acbc71

Download Submit
/root/.dbus/session-bus/11c67417355f45d397f6be11f62e85a6-0

Filesize
466B

MD5
1ac71b26cce9d598f2a1b056034768b6

SHA1
d3ef8538bed96aa148faa38c2bf16a3dde32812a

SHA256
34f3671da7335ba4717bbb6a1c0837271d0571d1555e0d194219c95a4cc00f2a

SHA512
dc8960df57abb5ec41a7ee1613e8d31a9aeff1431529dc966d48d039274e0a024995055cdeaccb411ca6e1b6bee378b5066b12c9f825c9bec47fdcfdbdf75cf8

Download Submit
/root/.mozilla/firefox/49ch4vsa.default/times.json

Filesize
47B

MD5
24e5e3500441c60dfeb8e078ccae136b

SHA1
4ee892545ebf5ff916d689b4d53647bd91637116

SHA256
5ee6a8f2dd9f98258fc19b7d63829a3abd5507e812f090c8b2847314206a9c62

SHA512
c1166b13d1d0a00b692268e351ece85a1e08786e9b95d844d40f31537c4f653e37ee6294711deb07adc80db5ef9a414fb3d259938707f236f40e4d25bea0ed33

Download Submit
/root/.mozilla/firefox/Crash Reports/InstallTime20230522134052

Filesize
10B

MD5
ac64113334ca9f5a9bd9e9ecebe1b732

SHA1
65d126e0ffe1bdd449ae2221608856fae0f1527f

SHA256
c29e79c8ec4cd45a15fbd7cfc53620c925bc76f0167125aeed7542ffa42875d9

SHA512
cac0dcd6511de33831a7cdb172cf529aadd0af331fcac64b499225377cedf6873cf3b4fcc0101f1c280b370aaf8c9a8389f68f276942b138b5f2eba739c78aed

Download Submit
/root/.mozilla/firefox/installs.ini

Filesize
62B

MD5
51d1e36f7cd06f907b1fca0323327ac7

SHA1
33345451b642f3b06cfa5c53912d684808e87438

SHA256
6f55b04926c1d55eb5d9e4252ea505c303a12747a7146a493f254f02f4e09349

SHA512
2f99b365904af84e0c198a8e01d6b570fd4a7065eae79272c2a653a427b371126ae2112ac7ea0845b263c4fc091d00daa14c6e1832e103dc0717e54a0e16bbe6

Download Submit
/root/.mozilla/firefox/nfdr5lai.default-release/cert9.db

Filesize
224KB

MD5
137aad152a8d0573e5d8a0d5465140e5

SHA1
e8d1514001b949d62ad0863ba3d26428ce885e17

SHA256
96b81e3ca8858d2a6e3757601ed2eedb4ae1ea34de688fb0a8abb5fc511d48d9

SHA512
1c4febaf405ccb98a002c0ab00c8a151aab8f8383488a799efddae8237ae42c493f4de2780fe97cd5b84f03cde2ec1d416799ff5db9f2b187c1dcc91e9dbaf10

Download Submit
/root/.mozilla/firefox/nfdr5lai.default-release/cert9.db

Filesize
224KB

MD5
1e7414c76888d6974241d3e28fd2e717

SHA1
2e3ec39a59995152bdeac60349f45059bfba4404

SHA256
c1d217ff99848703dea7d04d41a8e739d22b0d4d909b5dba1db3dc9ad31b2472

SHA512
b117767e57b7e19eeff1bf5b642d0d98380c699f18e09f0ef0107abb22c021254a871f245327abdf9d40b427c43462934434f2d01cea5ec5a86abc9129a756a0

Download Submit
/root/.mozilla/firefox/nfdr5lai.default-release/compatibility.ini

Filesize
163B

MD5
fe452b7294d5928a9a5863b89ee0a6bd

SHA1
a5d4c245071fa96476ba48b4725bdae7f1b7940f

SHA256
d5bfb07561606a19aa96557ea109b175050dc0eb805cbef9c813503587d77900

SHA512
dc37d8507f08849e3382d2dbafd4a64555dbd57a288c95131e9aefb366630f1585811a9e1456b861bb9d2b816ed88b18ffb7580cd92b41bb9b0227ce1363843e

Download Submit
/root/.mozilla/firefox/nfdr5lai.default-release/cookies.sqlite

Filesize
96KB

MD5
9535f5fe817accc769c2c1d3354db39f

SHA1
6af62cf08717cf3bfa84eb1a7b311acf522ce560

SHA256
c53c15fcfac2bb57fdc88d23f932fc244dbaf4020f0f6eaecf0f77a37c21f8c5

SHA512
dc9c2c32eb42dda0a7a711e143aea58c603c1e9d885c3677e9fe86f525e1b0b32a46e240756263e56510b07e764ba69f2de13b90ec18210678242e10cfe17837

Download Submit
/root/.mozilla/firefox/nfdr5lai.default-release/cookies.sqlite

Filesize
96KB

MD5
5caa766855d5613a999f71b7812d6451

SHA1
ad0d9a52a0d5cc7f11858301dbe47377ed99ee37

SHA256
3a8ce2b07e3e8678a13aa58ef5b942c4dccd8f9c84511bdeb8847ef270797e27

SHA512
17bb0f4c87ec178910795b25ce85e74cf599190c769592472c3e872f42930c93f28faf0ff3e448816a9abcc8af0459852bed52bee08cfe25d068879c6dfd8eba

Download Submit
/root/.mozilla/firefox/nfdr5lai.default-release/key4.db

Filesize
288KB

MD5
479ebb10a2c7d31e6cf135240de4a842

SHA1
77a284deecc43909bc14cfd51e98608f53f6a7d4

SHA256
bb2d70b67946126e51a6342e0037d179e78aa76b83bc75abcec74bfdb843610e

SHA512
ae03d9e2b58b141362a25ef40c43874e779e29422c44d3912c020caf29b6a4d12b16d5ef6fff6ae9923592d982e8502db1bfd09ede2ee38dbf875e8ecbf9d1db

Download Submit
/root/.mozilla/firefox/nfdr5lai.default-release/permissions.sqlite

Filesize
96KB

MD5
232fbc22dd03a8ec41edde02bdbea61c

SHA1
6ab4b39bca95418c52f7f861fd39e5fddb9cc7b6

SHA256
d88bf367aaf79efbb2e8fbdb1dc5bde1c1c3a53e0f4d8188027a63ec55d5f5f0

SHA512
055f1595f4a327347671db53cec8d89a310109d3f871c567e3d5b654b956fc0369d12437f7dc6d9327b973008f1327ee0dfdb5504f1b3cbe00da29941b1e5892

Download Submit
/root/.mozilla/firefox/nfdr5lai.default-release/prefs-1.js

Filesize
1KB

MD5
55406b628cf53bb4386434e5eb7b6479

SHA1
e54d992ad88392aa6448d9274815c4f3383de9f1

SHA256
dc33f93cc7d99dca709a783592a945ad1cc01a7b222c1a88f98adc035a9fa693

SHA512
046b407d8cf63b85dc22d6e1184c7cb662823533e90beaf5a242f98e8deca223c3e60cd1c6b0d359b698b2d2eaa1649b7c839ef6115feb54897573f65b1a6be1

Download Submit
/root/.mozilla/firefox/nfdr5lai.default-release/prefs-1.js

Filesize
1KB

MD5
079bda7091d5b2ade49a7e83c5bf2928

SHA1
eee57c3ba2886b9e5d922e74b5e67665853c9f50

SHA256
b79a806f419fa1ed9403b3dc1d8f65cf7b1a86fa306788750613fa5bc9e297a1

SHA512
2b4be912a67634b4f82e84f8b7fb7559f7c0a3715cd7a027c04b725982aa99f99199eacc72be7dc8a19425031e856bfda8ddc8676bbe29d2169621023a68feb3

Download Submit
/root/.mozilla/firefox/nfdr5lai.default-release/prefs-1.js

Filesize
2KB

MD5
d081c20505c1f0c71be176a0b1f60469

SHA1
0848e9dcdd0ac806fe40e05896fd6f597a696567

SHA256
149d39cc86a4011b8328e7cd9fdc11afeca084be7ff5a48135a1bdf6c515d3bd

SHA512
78a1bbdcb704dbea17f25c434ba8c0c1dec30de0c3bd675939c3d384b2408713910535a245631d340f7dd0ab6de60d2e0e443394f1ea2b61b12d4042450e1e4e

Download Submit
/root/.mozilla/firefox/nfdr5lai.default-release/prefs-1.js

Filesize
2KB

MD5
4ba5b5bc1aeb7db4d9e4200735db5b6a

SHA1
f4ae77a9b17f4672a34b5f269a6130f0da80dc60

SHA256
6c32492741f3f6558f2e69ec8dd8bc3641a5838f4a746579e038b717c3efd92a

SHA512
5ae24851811c0fe5219746ea2a7dfb8d280a8c793ceeae79002ff8712bdaafc8bec423ca9927436afb5edd54e57a27c9113c2e80862be363f207e01449fa5ad8

Download Submit
/root/.mozilla/firefox/nfdr5lai.default-release/prefs-1.js

Filesize
3KB

MD5
db85af2e8679397a32f712371920ee9f

SHA1
50c8cb73d77e9eead345b71e7e57dbea08c7d9e6

SHA256
c7419d35d0ed22d0cddad3d95c8f9918787c9c231a08089db55dc34b46a82186

SHA512
f68ee2fe431528f3abc2aabdbc3009277c6822263b65c7fe0a80839ce5ca40814d3cce1d5cba6402cf913d7f3e70062e3fe1c39c442c1497b1d9f8613a15f7bd

Download Submit
/root/.mozilla/firefox/nfdr5lai.default-release/prefs-1.js

Filesize
4KB

MD5
2246c12d0ee02cdc518e3186957e5bb0

SHA1
43602c03e8b7ff7c931a6920e81642248f43b9df

SHA256
21beaa0c51b15fb194a833700e7f495de5128db26852cd92e4f6bd1ba58d99b7

SHA512
49eea9038ece49e7337f838af888804e216dc449e98746bcd8ec80b50adbdbe3b7ca842a28fb91c319741056c1be6f32c792a8f19484194a308102b860f416c5

Download Submit
/root/.mozilla/firefox/nfdr5lai.default-release/prefs-1.js

Filesize
4KB

MD5
845c35f8a014c47b56b4d0e934753fa4

SHA1
045b00fa957f0f2e8ede6cba289727aa17899f64

SHA256
55237193db13363ce9286934c13014d56896808b73dd1520dcb651ff9163b004

SHA512
0cead57d2488188cd63f73cfaffc4a1ec57b153825ae842a45f7c9522751ebae72fda1463c72cb3d99f4ebe8bc7c47cc460b58a7be1cf4872d1a3d6a66799255

Download Submit
/root/.mozilla/firefox/nfdr5lai.default-release/prefs.js

Filesize
850B

MD5
63d246dfa08b4861a5aadc420d3dc62d

SHA1
bdc63a12e9cca92cfa2c65b5324b62a983cee319

SHA256
648f081e7add7217a0772efbc3fe6cbe31cb937f2aea8c786fbdb0ee0028564d

SHA512
2bcf17bd467e003d22877d6194d6620ff4dc9b6453ba09ec6142cfca9c61063462df40629eca1cc367d8c8c9df8197236efd13aba08e4ed7b6ccc52f402c5cd5

Download Submit
/root/.mozilla/firefox/nfdr5lai.default-release/storage/ls-archive.sqlite

Filesize
96KB

MD5
e0c613bfd69956a19ce2dc5e925aa223

SHA1
14accb230edcd6cb76967cdc6d4e5686db96b5df

SHA256
0d4cb11f6364c46a75f9eaddfca5c660b90dfd515df3afcd5e0baeca28a0f1ab

SHA512
01643c0131a392be92b3f281d7f633c1f502bff19090b0d716f1ac66aefecc3fcf92f393bef66b03089c9b9c6d8aaeb711b6a4f29d5a6729dd188c838f2272d1

Download Submit
/root/.mozilla/firefox/nfdr5lai.default-release/storage/ls-archive.sqlite

Filesize
128KB

MD5
178d71e5529d637ac62f7e75fdd75896

SHA1
339f2b949cc4c207b66aea11137448ba28d36dcb

SHA256
7b0050f1bfaab85c8f9067ae7d7369056ff752c0c852ef1462a96c22169004d4

SHA512
ec0e0105fcfbbae356dd55efbcf92975f35bbe5cb93fcabf4c08443e871957635d14830b27c4e1ddefbbaff8f9b7ec3590bf417a9442e1d7ee3607d14d56f664

Download Submit
/root/.mozilla/firefox/nfdr5lai.default-release/storage/permanent/chrome/.metadata-v2-tmp

Filesize
42B

MD5
0990bfcb832be0aab2de1461c80fbc40

SHA1
21e966936b642d89e677a4be5b19600bc9d29875

SHA256
22f3a355bea42ee8e333e3e4c8da0930a2c31670174ae7c94a102373b4b530e0

SHA512
943560f0874d5a63fe31de51cd1d80d80930ee779b72f83d6004546143b9775d3e21cc1436b848dfd91bd4db2e388e70a0227bf8f591efb244e29e09be101235

Download Submit
/root/.mozilla/firefox/nfdr5lai.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite

Filesize
44KB

MD5
a8dd7ebaad5528b23f82ccb1534cea18

SHA1
600daceacfb5cf9df0b66ba7dce4516b2ac4df70

SHA256
e5b0d02c18ae36c4a220f41fd97c66060c17aaafcbb324a57ccdc2707c44c4ec

SHA512
67f867a8e2b37fb6bececd5ebc570ca594ea329142badd63d1281d5e735f515a5e329abc6eb9a9d3465aab0a08541b4888018d859964f160a52345ab93532bff

Download Submit
/root/.mozilla/firefox/nfdr5lai.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite

Filesize
12KB

MD5
4a500f2e5ff64fe232d6e71de3bea71c

SHA1
fce9e34e2c041c3e05835f0e8375db0203d540cd

SHA256
88804b53fd701ca7bd99003e1151454fa11d98577e39352505268e2ae2156637

SHA512
95f73715c14f3b72e9274659492778a02bfba91bc29f862583a7b6fe0dc871a35910cf35536a2550c0824c8560a98f70db5888c603070731771499cedc1fdf82

Download Submit
/root/.mozilla/firefox/nfdr5lai.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite

Filesize
44KB

MD5
7352c8848e88edc39b7fb5e663888187

SHA1
8c3dffe25cc56c7aec1b782292d6fceed81e6304

SHA256
7a462086a26978809c719e57a7ea6a25568767fb7532014e8531fda94b660e0a

SHA512
f2a0dbbab5c2c1702b03bce15a47739481f523e127d1372b40534db9a20b2bc99fb53710ee0e5d44176188817cac704cf4f98cdf087e7e89d244281fcfc3b280

Download Submit
/root/.mozilla/firefox/nfdr5lai.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite

Filesize
12KB

MD5
a2367b80ce229ad4c6e748d9e62d7242

SHA1
14ed69d6d78f013828ec986e7434612bd432927e

SHA256
3fc0e58d7a0832b0ee5f04744aabf176db9cf8d440990f167ef1ebbc3e549d44

SHA512
06817589602e78555dbb90f7c67773da614354dcbd447fb64707dd3c2eccff75e64d064c885aa0e8944dc47b3afdc4170960463565e780dc959e717329334fda

Download Submit
/root/.mozilla/firefox/nfdr5lai.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite

Filesize
44KB

MD5
759544297aaa61f5fef8ee42d0ae4393

SHA1
fc2d66f6e60409e3e8d38623ce5f817fc7f571e0

SHA256
1bd2000cd972e80cefaec6e982ba261d224a818f367de0fdf8c51fa5a05d7ab5

SHA512
8aaa2ce66f10d46f7c9200af841ac7bd9f5b55c30308a14f0deda44ac62581c45daae45154487c0073a0d5847d5926cbb4072ca64a702ac6b834ad0bb482804f

Download Submit
/root/.mozilla/firefox/nfdr5lai.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite

Filesize
12KB

MD5
e36dc06bc7e151ebf6427138a37d98cc

SHA1
9b5ed7b61610b377b658dac0e19d94242a47d7f4

SHA256
3d9ed606983f396a9762efa68cce878f768303d55dd3df1c360a323fe2236586

SHA512
0d09bd5baf4485d09f6ea695a3391ff365f6b873c87ad629b8f5c6ddc7604717f7183e9c99b03b3aee7c46279f66118854bdd878db6bb7f243e35912811db0a8

Download Submit
/root/.mozilla/firefox/nfdr5lai.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite

Filesize
16KB

MD5
98f81dfe2e4d961a75113509b4d997a3

SHA1
87b3c33770626a2a394b661ae4b183b7af703149

SHA256
b82b758dee413830895dee12188a1a3455de7d740c2f83c0ae4f8cecad92bb43

SHA512
6ebb7d8af5af4ddb71844aa9861bccd90e174381054170236949c52d4a5ce8494d63fa98a95bb52d7d44f43551a0dc530c2c891bc8d7a4113efcfa831626302b

Download Submit
/root/.mozilla/firefox/nfdr5lai.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
44KB

MD5
07a412e08825220262ad2890757ff779

SHA1
f46c127dbc070ded87a6078b3c1c761955f96de8

SHA256
da640f8b665841b520d2262a21cc3f82aeaa881cf81a1ddae27ef501d66544e4

SHA512
0134c783bf3293848e479b478ac57a1e0f4202cddfb8b57bc6275aada7345f398cf8a627e9b1c34fd618192c2f0c9737b1da487daf33f9c557ebc1377105582b

Download Submit
/root/.mozilla/firefox/nfdr5lai.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
12KB

MD5
ea95522b866a34b56f718fe2839876d1

SHA1
66cbbed434c9342dbcb8af7293c589dc87e3138e

SHA256
c4dff9072e4ce9c7ba0c9f3285561e5adc88e748f9e0e8877d78a1d75594ff48

SHA512
d18dd95494bd6d8e24252a34da5ea61febf124f8ba492de3a508c7a692229d6c62535e7a0165f869b50c0abe7d0a605b11d9c9e25b80f03b6138a9a48b9b549b

Download Submit
/root/.mozilla/firefox/nfdr5lai.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
164KB

MD5
65afd0afb700b90aecb15c7bcc071ee5

SHA1
ef829c4c4c07869c265cbc2e6b4d93740f483d93

SHA256
aef75f316c00a5c9cf0a0c31e82bda29d6471c646f755ab509f2df3d57cec546

SHA512
2d0746e452230f24bd207d6b2c8980b5c379982d71b670a929612369611f22a3c0e23167b760839563f4c7744013c80cc97a927bd26908f71dbee2f170181a04

Download Submit
/root/.mozilla/firefox/nfdr5lai.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
148KB

MD5
dd3f6ba37c670af5953593535e435d04

SHA1
ecfe4e650a050bce77e8ff7468de04c1b8acc9a4

SHA256
5cc6fa137a1f3a7d0b615b178877f12c460b22f95702eb7534d5732ee6599561

SHA512
86e0482543faae6fb279ca71e1e6d6461d32317e74baebb3973e0fde9800107faeb9c2347be6cf8a47556ae43c8e6c224a595e952f621e40ad2c5eba920df2b3

Download Submit
/root/.mozilla/firefox/nfdr5lai.default-release/times.json

Filesize
50B

MD5
c746533637b470456ab5d1003c1b3239

SHA1
ef1ec09dc883c6998ea170f4d687675bec914e30

SHA256
f44a6cd6bb404bd83c1c4abeb62f3ad86274567496a4484af11b02eae4db4b78

SHA512
5a9e08a3b3512c5f4ec6855c4d8d418aee2d8f2029b13d6e87e6b32ee9a15f6cfc8c842102b91a0cb2abbf8cfb931b7aad6401a6292e7d83c1a014264ecccf56

Download Submit
/root/.mozilla/firefox/nfdr5lai.default-release/times.json

Filesize
47B

MD5
1876f8bd081e9da210ca314c2f9d49a4

SHA1
f81a15193378c594db5b5e4730414590c49d5faa

SHA256
1015c20f41c61217d542377cf75be3ea008179b7524e3101528a6cb4cfd66aba

SHA512
0399ae3239e7f246b4c9e1a250669a70b5544ec4fb5d3443db1b149126f0eba10aa9114431f4f3dce9aa250796f31a387041d544955802465c866e05b2f5d2fd

Download Submit
/root/.mozilla/firefox/profiles.ini

Filesize
259B

MD5
30a1848efd24649705cd5667b4fbc828

SHA1
f4e22cb7fb8ef51a17e7a4ee36909e7634844ce9

SHA256
565f7c713f77a99cb4e8ff05e0764840edb67e41436ab058f30bdd15794e6e37

SHA512
ca17772903944b00c743f37a658b739adb69a4fcf6c3602cad717a999312d08d2f4f660e8e77b24c9c71c62ffac677b61c66dc85ac0480757d023f140cbc6b78

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads