hxxps://162[.]214[.]103[.]216/bins/sora[.]x86

Analysis

max time kernel
9s
max time network
66s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240226-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
10-04-2024 18:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://162.214.103.216/bins/sora.x86

Score

7^/10

antivm spyware stealer

Malware Config

Signatures

Changes its process name 64 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1671	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1671	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1671	Process not Found
Changes the process name, possibly in an attempt to hide itself	glean.dispatche	1670	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1679	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1678	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1679	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1678	Process not Found
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1680	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1677	Process not Found
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1680	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1677	Process not Found
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1676	Process not Found
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1676	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1675	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1675	Process not Found
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1682	Process not Found
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1682	Process not Found
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1684	Process not Found
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1684	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cache2 I/O	1685	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cookie	1686	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cookie	1686	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1687	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1687	Process not Found
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #1	1689	Process not Found
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #0	1688	Process not Found
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1690	Process not Found
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1690	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	1691	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #3	1692	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #3	1692	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	1691	Process not Found
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	1693	Process not Found
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	1693	Process not Found
Changes the process name, possibly in an attempt to hide itself	IndexedDB #1	1694	Process not Found
Changes the process name, possibly in an attempt to hide itself	IndexedDB #1	1694	Process not Found
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	1696	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC Launch	1697	Process not Found
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	1696	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC Launch	1697	Process not Found
Changes the process name, possibly in an attempt to hide itself	Breakpad Server	1695	Process not Found
Changes the process name, possibly in an attempt to hide itself	DOM Worker	1699	Process not Found
Changes the process name, possibly in an attempt to hide itself	DOM Worker	1699	Process not Found
Changes the process name, possibly in an attempt to hide itself	Sandbox Forked	1698	Process not Found
Changes the process name, possibly in an attempt to hide itself	Chroot Helper	1700	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #5	1703	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #5	1703	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #4	1702	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #4	1702	Process not Found
Changes the process name, possibly in an attempt to hide itself	MainThread	1698	firefox
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1712	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1712	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1712	Process not Found
Changes the process name, possibly in an attempt to hide itself	FSBroker1698	1713	Process not Found
Changes the process name, possibly in an attempt to hide itself	FSBroker1698	1713	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Process	1698	firefox
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1716	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1717	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1717	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1716	Process not Found
Changes the process name, possibly in an attempt to hide itself	ProfilerChild	1718	Process not Found
Changes the process name, possibly in an attempt to hide itself	ProfilerChild	1718	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1719	Process not Found

Reads user data of web browsers 56 IoCs

Reads stored browser data which can include saved credentials.

spyware stealer

description	ioc	Process
File opened for reading	/root/.mozilla/firefox/nicwi15t.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/nicwi15t.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/nicwi15t.default-release/addonStartup.json.lz4	firefox
File opened for reading	/root/.mozilla/firefox/nicwi15t.default-release/sessionstore.jsonlz4	Process not Found
File opened for reading	/root/.mozilla/firefox/nicwi15t.default-release/sessionCheckpoints.json	Process not Found
File opened for reading	/root/.mozilla/firefox/nicwi15t.default-release/user.js	firefox
File opened for reading	/root/.mozilla/firefox/nicwi15t.default-release/system-extensions	firefox
File opened for reading	/root/.mozilla/firefox/nicwi15t.default-release/cookies.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/nicwi15t.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/nicwi15t.default-release/cookies.sqlite-journal	firefox
File opened for reading	/root/.mozilla/firefox/nicwi15t.default-release/storage/ls-archive.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/nicwi15t.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/nicwi15t.default-release/handlers.json	firefox
File opened for reading	/root/.mozilla/firefox/nicwi15t.default-release/key4.db	firefox
File opened for reading	/root/.mozilla/firefox/nicwi15t.default-release/xulstore.json	firefox
File opened for reading	/root/.mozilla/firefox/nicwi15t.default-release/compatibility.ini	firefox
File opened for reading	/root/.mozilla/firefox/nicwi15t.default-release/extensions	firefox
File opened for reading	/root/.mozilla/firefox/nicwi15t.default-release/cert9.db	firefox
File opened for reading	/root/.mozilla/firefox/nicwi15t.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/nicwi15t.default-release/cookies.sqlite	firefox
File opened for reading	/root/.mozilla/firefox/nicwi15t.default-release/extension-preferences.json	Process not Found
File opened for reading	/root/.mozilla/firefox/nicwi15t.default-release/storage/permanent/chrome/idb	Process not Found
File opened for reading	/root/.mozilla/firefox/nicwi15t.default-release/sessionstore-backups/previous.jsonlz4	Process not Found
File opened for reading	/root/.mozilla/firefox/nicwi15t.default-release/cert9.db	Process not Found
File opened for reading	/root/.mozilla/firefox/nicwi15t.default-release/cookies.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/nicwi15t.default-release/sessionstore.js	Process not Found
File opened for reading	/root/.mozilla/firefox/nicwi15t.default-release/pkcs11.txt	firefox
File opened for reading	/root/.mozilla/firefox/nicwi15t.default-release/sessionstore-backups/recovery.js	Process not Found
File opened for reading	/root/.mozilla/firefox/nicwi15t.default-release/extensions.json	Process not Found
File opened for reading	/root/.mozilla/firefox/nicwi15t.default-release/permissions.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/nicwi15t.default-release/sessionstore-backups/recovery.baklz4	Process not Found
File opened for reading	/root/.mozilla/firefox/nicwi15t.default-release/storage.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/nicwi15t.default-release	firefox
File opened for reading	/root/.mozilla/firefox/nicwi15t.default-release/cert9.db-journal	firefox
File opened for reading	/root/.mozilla/firefox/nicwi15t.default-release/cert_override.txt	firefox
File opened for reading	/root/.mozilla/firefox/nicwi15t.default-release/storage/ls-archive.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/nicwi15t.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/nicwi15t.default-release/key4.db-journal	firefox
File opened for reading	/root/.mozilla/firefox/nicwi15t.default-release/cert9.db-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/nicwi15t.default-release/ClientAuthRememberList.txt	Process not Found
File opened for reading	/root/.mozilla/firefox/nicwi15t.default-release/sessionstore-backups/recovery.bak	Process not Found
File opened for reading	/root/.mozilla/firefox/nicwi15t.default-release/storage.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/nicwi15t.default-release/storage/permanent/chrome	Process not Found
File opened for reading	/root/.mozilla/firefox/nicwi15t.default-release/addons.json	Process not Found
File opened for reading	/root/.mozilla/firefox/nicwi15t.default-release/SiteSecurityServiceState.txt	Process not Found
File opened for reading	/root/.mozilla/firefox/nicwi15t.default-release/sessionstore-backups/previous.js	Process not Found
File opened for reading	/root/.mozilla/firefox/nicwi15t.default-release/prefs.js	firefox
File opened for reading	/root/.mozilla/firefox/nicwi15t.default-release	Process not Found
File opened for reading	/root/.mozilla/firefox/nicwi15t.default-release/sessionstore-backups/recovery.jsonlz4	Process not Found
File opened for reading	/root/.mozilla/firefox/nicwi15t.default-release/AlternateServices.txt	Process not Found
File opened for reading	/root/.mozilla/firefox/nicwi15t.default-release/key4.db	Process not Found
File opened for reading	/root/.mozilla/firefox/nicwi15t.default-release/storage	Process not Found
File opened for reading	/root/.mozilla/firefox/nicwi15t.default-release/permissions.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/nicwi15t.default-release/search.json.mozlz4	Process not Found
File opened for reading	/root/.mozilla/firefox/nicwi15t.default-release/times.json	Process not Found
File opened for reading	/root/.mozilla/firefox/nicwi15t.default-release/shield-preference-experiments.json	Process not Found

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc
File opened for reading	/proc/cpuinfo

Reads CPU attributes 1 TTPs 10 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq	Process not Found
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/size	Process not Found
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/size	Process not Found
File opened for reading	/sys/devices/system/cpu/present	Process not Found

Enumerates kernel/hardware configuration 1 TTPs 59 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/irq	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/irq	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_vendor	Process not Found
File opened for reading	/sys/bus/pci/devices	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/class	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/resource	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/vendor	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/uevent	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/kernel/security/apparmor/features/dbus/mask	dbus-daemon
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/device	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/class	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/class	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	firefox
File opened for reading	/sys/devices/system/cpu	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/resource	Process not Found

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/self/fd/89	firefox
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd/31	firefox
File opened for reading	/proc/self/fd/41	firefox
File opened for reading	/proc/self/fd/51	firefox
File opened for reading	/proc/filesystems	gvfsd
File opened for reading	/proc/self/fd/6	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/fd/29	firefox
File opened for reading	/proc/self/fd/38	firefox
File opened for reading	/proc/self/fd/48	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/1730/cmdline	Process not Found
File opened for reading	/proc/self/task/1834/stat	Process not Found
File opened for reading	/proc/self/fd/39	firefox
File opened for reading	/proc/self/fd/45	firefox
File opened for reading	/proc/1745/cmdline	Process not Found
File opened for reading	/proc/self/fd/75	firefox
File opened for reading	/proc/self/task/1783/stat	Process not Found
File opened for reading	/proc/self/fd/44	firefox
File opened for reading	/proc/self/cgroup	firefox
File opened for reading	/proc/self/fd/33	firefox
File opened for reading	/proc/self/stat	Process not Found
File opened for reading	/proc/self/mountinfo	firefox
File opened for reading	/proc/self/fd/40	firefox
File opened for reading	/proc/self/fd/47	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/filesystems	xdg-desktop-portal
File opened for reading	/proc/sys/kernel/cap_last_cap	Process not Found
File opened for reading	/proc/1570/cmdline	Process not Found
File opened for reading	/proc/1754/cmdline	Process not Found
File opened for reading	/proc/1779/statm	Process not Found
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/1591/cmdline	Process not Found
File opened for reading	/proc/1725/cmdline	Process not Found
File opened for reading	/proc/filesystems	xdg-document-portal
File opened for reading	/proc/1749/cmdline	Process not Found
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/fd/50	firefox
File opened for reading	/proc/self/task/1701/stat	Process not Found
File opened for reading	/proc/filesystems	gvfsd-fuse
File opened for reading	/proc/self/fd	Process not Found
File opened for reading	/proc/self/fd/46	firefox
File opened for reading	/proc/self/fd/90	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/1575/attr/current	Process not Found
File opened for reading	/proc/self/fd/42	firefox
File opened for reading	/proc/mounts	dbus-daemon
File opened for reading	/proc/self/task/1661/stat	Process not Found
File opened for reading	/proc/filesystems	xdg-permission-store
File opened for reading	/proc/1734/cmdline	Process not Found
File opened for reading	/proc/1805/statm	Process not Found
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/mountinfo	Process not Found
File opened for reading	/proc/self/fd/72	firefox
File opened for reading	/proc/1779/smaps	Process not Found
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/filesystems	dbus-daemon
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/1805/smaps	Process not Found
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd/77	firefox

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/firefox/.parentlock	firefox

/usr/bin/xdg-open
xdg-open https://162.214.103.216/bins/sora.x86
1⤵
PID:1569
- /usr/bin/dbus-send
  dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
  2⤵
  PID:1570
- - /usr/bin/dbus-launch
    dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
    3⤵
    PID:1571
- /bin/grep
  grep " = \\\"xfce4\\\"\$"
  2⤵
  PID:1577
- /usr/bin/xprop
  xprop -root _DT_SAVE_MODE
  2⤵
  PID:1576
- /bin/grep
  grep -i "^xfce_desktop_window"
  2⤵
  PID:1579
- /usr/bin/xprop
  xprop -root
  2⤵
  PID:1578
- /bin/grep
  grep -q "^Enlightenment"
  2⤵
  PID:1581
- /bin/uname
  uname
  2⤵
  PID:1582
- /bin/grep
  grep -q "^file://"
  2⤵
  PID:1584
- /bin/egrep
  egrep -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1586
- /usr/local/sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1586
- /usr/local/bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1586
- /usr/sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1586
- /usr/bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1586
- /sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1586
- /bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1586
- /usr/bin/xdg-mime
  xdg-mime query default x-scheme-handler/https
  2⤵
  PID:1590
- - /usr/bin/dbus-send
    dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
    3⤵
    PID:1591
  - - /usr/bin/dbus-launch
      dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
      4⤵
      PID:1592
- - /bin/grep
    grep " = \\\"xfce4\\\"\$"
    3⤵
    PID:1594
- - /usr/bin/xprop
    xprop -root _DT_SAVE_MODE
    3⤵
    PID:1593
- - /bin/grep
    grep -i "^xfce_desktop_window"
    3⤵
    PID:1596
- - /usr/bin/xprop
    xprop -root
    3⤵
    PID:1595
- - /bin/grep
    grep -q "^Enlightenment"
    3⤵
    PID:1598
- - /bin/uname
    uname
    3⤵
    PID:1599
- /usr/bin/which
  which firefox
  2⤵
  PID:1646
- /usr/bin/firefox
  /usr/bin/firefox https://162.214.103.216/bins/sora.x86
  2⤵
  PID:1659
- - /usr/bin/which
    which /usr/bin/firefox
    3⤵
    PID:1660
- /usr/lib/firefox/firefox
  /usr/lib/firefox/firefox https://162.214.103.216/bins/sora.x86
  2⤵
  - Reads user data of web browsers
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1659
- - /usr/bin/dbus-launch
    dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
    3⤵
    PID:1669
- - /usr/local/sbin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1722
- - /usr/local/bin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1722
- - /usr/sbin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1722
- - /usr/bin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1722

/usr/bin/dbus-daemon
/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1573

/bin/sed
sed -n "s/\$^[[:alnum:]+\\.-]*\$:.*\$/\\1/p"
1⤵
- Reads runtime system information
PID:1589

/bin/sed
sed "s/:/ /g"
1⤵
- Reads runtime system information
PID:1602

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1607

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1606

/usr/bin/head
head -n 1
1⤵
PID:1605

/bin/grep
grep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
1⤵
PID:1604

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1616

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1615

/usr/bin/head
head -n 1
1⤵
PID:1614

/bin/grep
grep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
1⤵
PID:1613

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1621

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1620

/usr/bin/head
head -n 1
1⤵
PID:1619

/bin/grep
grep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
1⤵
PID:1618

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1626

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1625

/usr/bin/head
head -n 1
1⤵
PID:1624

/bin/grep
grep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
1⤵
PID:1623

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1631

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1630

/usr/bin/head
head -n 1
1⤵
PID:1629

/bin/grep
grep "x-scheme-handler/https=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache
1⤵
PID:1628

/bin/sed
sed "s/:/ /g"
1⤵
PID:1634

/bin/sed
sed -e "s|-|/|"
1⤵
- Reads runtime system information
PID:1637

/bin/sed
sed -e "s|-|/|"
1⤵
- Reads runtime system information
PID:1640

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1645

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1649

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1652

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1658

/usr/bin/lsb_release
/usr/bin/lsb_release -idrc
1⤵
PID:1683

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -parentBuildID 20230522134052 -prefsLen 19257 -prefMapSize 230809 -appDir /usr/lib/firefox/browser "{0836bc73-4078-48d3-ab7a-e8ce9fc02079}" 1659 true socket
1⤵
- Changes its process name
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1698

/usr/libexec/xdg-desktop-portal
/usr/libexec/xdg-desktop-portal
1⤵
- Reads runtime system information
PID:1725

/usr/libexec/xdg-document-portal
/usr/libexec/xdg-document-portal
1⤵
- Reads runtime system information
PID:1730

/usr/libexec/xdg-permission-store
/usr/libexec/xdg-permission-store
1⤵
- Reads runtime system information
PID:1734

/usr/libexec/xdg-desktop-portal-gtk
/usr/libexec/xdg-desktop-portal-gtk
1⤵
PID:1745

/usr/lib/gvfs/gvfsd
/usr/lib/gvfs/gvfsd
1⤵
- Reads runtime system information
PID:1749

/usr/lib/gvfs/gvfsd-fuse
/usr/lib/gvfs/gvfsd-fuse /root/.gvfs -f -o big_writes
1⤵
- Reads runtime system information
PID:1754

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 21742 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{215393e7-2f62-49fb-9cf4-96c07b28a167}" 1659 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1779

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 2 -isForBrowser -prefsLen 21410 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{de30a598-cfba-4863-b73c-c8ad0e8e0294}" 1659 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1805

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 3 -isForBrowser -prefsLen 21759 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{1c77234a-9228-4c4b-93e7-8f9a4e10816f}" 1659 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1831

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/root/.cache/dconf/user

Filesize
2B

MD5
c4103f122d27677c9db144cae1394a66

SHA1
1489f923c4dca729178b3e3233458550d8dddf29

SHA256
96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

SHA512
5ea71dc6d0b4f57bf39aadd07c208c35f06cd2bac5fde210397f70de11d439c62ec1cdf3183758865fd387fcea0bada2f6c37a4a17851dd1d78fefe6f204ee54

Download Submit
/root/.cache/mozilla/firefox/nicwi15t.default-release/cache2/entries/3D1E19D09F398691ABF62061591970855193B42F

Filesize
13KB

MD5
d18271a1d9ecc8f516def8ffeb0d2468

SHA1
aa5b7422c104b302250903704181941270eeae56

SHA256
60ff600dbebd8a3a686364026aa0da4e08cf3b0d9c94abb01a82eb005ddb48e4

SHA512
792e70f2be2964eb91fe0e1bfb9f1564a5d6102206394f89aebd10881a147ff3a2a533ce89ef5782d225a83b37b6db0861307009498282d307ed9d7c53cad37d

Download Submit
/root/.dbus/session-bus/11c67417355f45d397f6be11f62e85a6-0

Filesize
466B

MD5
efef3506bd36974f246c385d16a418ec

SHA1
84ad6b7e50a3e96d7ae70708f7b00967f3fe0c3b

SHA256
8c8db3b5f0bb8120f0a5fe2a626cf5ac6482db62bb4601f9bb885488bee2343f

SHA512
f32754ccd3ae1455b2579786faf15f738749123ad15f8c09b918574b7824805d1d078aca17989c7a312724e27cb89a78b1dfb3c0e0612117d5eca8a38e7bf138

Download Submit
/root/.mozilla/firefox/Crash Reports/InstallTime20230522134052

Filesize
10B

MD5
fb83ad4ddb38c21091ac21f7cdb3b181

SHA1
a1bea3ffeb4bb9c60a7ca457064942978616897e

SHA256
ff2d438b0173b171d356a49f6f75af8dcac41e61468c523bc49516794cb98d70

SHA512
baf42c5b314ffab0432ba791b9f8fdfdefd0815ad326d967ecb3ba12547a21b6ffc2d9377d3b28a644abfe73dc2624e1ca79c678c8dbc9dcfd0b36cdc5e57ce0

Download Submit
/root/.mozilla/firefox/installs.ini

Filesize
62B

MD5
b74258d01d4f3700530190baab290e22

SHA1
68577aa9b70ed23649a26cb81aaf10d66a71cf5b

SHA256
f333e074628e145bcdf043a9657cfbcfedc1179efe82e49bc5a12052d5a29836

SHA512
b66c5ddebe647bea3c739895556f0b8331e4973f59d73b8babbbcb61925d79ced7d99ea01054a97340bd0a8aa94b1eb9b958b33a0a7bd3cd01b63d96c8961924

Download Submit
/root/.mozilla/firefox/k4fg286a.default/times.json

Filesize
47B

MD5
dc5a71fb0c283fe630cfa569c6944cf2

SHA1
5a7d08cc80ab78dd8bae7ad868615964ea7987e3

SHA256
1308050db43b9bed47e0fd348aa6a4a656b948a690a9b6006adbd521e83f5c89

SHA512
b13d6e48bc7f82560fafd3bd56575d897d4ca1483a9df739ad9ba4656c429bf4547f7c9f5c60ac403182f6e54f6f822a6e53158639f30ddd073a669aee64b56e

Download Submit
/root/.mozilla/firefox/nicwi15t.default-release/cert9.db

Filesize
224KB

MD5
ff74e3cc96a26acb1398013d9daa2c09

SHA1
1ba6f696193c1b0a0631d9d0826aee5c31522c43

SHA256
c8f3adea22448d529b22c84c8c6ba49ef68612974dae8517ba538181367bdcca

SHA512
8ffa7d51c7e55296d4760f4e1330f6179f29740427d493f567d9be0ed047c98f3149ec301c4a59071afb89b3f3b1783bc1d68785c988b6956608082e5fc1c5cd

Download Submit
/root/.mozilla/firefox/nicwi15t.default-release/cert9.db

Filesize
224KB

MD5
6656fa27b1cd9df9210ec5c318d11e29

SHA1
5e3219b5796f06a73e81cd9aedbce39ca29684c6

SHA256
770d8bb9d933fafeee1e0fda31b44e6af2434f66a9bc3616ddb96522ada721f4

SHA512
f4674840072922e482f0b407f51eacd223286a006d5c7a17cc8e14a2161df8c785c86f9dea3c2515b4f6b0d86f625b5604260c7d857e359e077cf114d282c9df

Download Submit
/root/.mozilla/firefox/nicwi15t.default-release/compatibility.ini

Filesize
163B

MD5
fe452b7294d5928a9a5863b89ee0a6bd

SHA1
a5d4c245071fa96476ba48b4725bdae7f1b7940f

SHA256
d5bfb07561606a19aa96557ea109b175050dc0eb805cbef9c813503587d77900

SHA512
dc37d8507f08849e3382d2dbafd4a64555dbd57a288c95131e9aefb366630f1585811a9e1456b861bb9d2b816ed88b18ffb7580cd92b41bb9b0227ce1363843e

Download Submit
/root/.mozilla/firefox/nicwi15t.default-release/cookies.sqlite

Filesize
96KB

MD5
9535f5fe817accc769c2c1d3354db39f

SHA1
6af62cf08717cf3bfa84eb1a7b311acf522ce560

SHA256
c53c15fcfac2bb57fdc88d23f932fc244dbaf4020f0f6eaecf0f77a37c21f8c5

SHA512
dc9c2c32eb42dda0a7a711e143aea58c603c1e9d885c3677e9fe86f525e1b0b32a46e240756263e56510b07e764ba69f2de13b90ec18210678242e10cfe17837

Download Submit
/root/.mozilla/firefox/nicwi15t.default-release/cookies.sqlite

Filesize
96KB

MD5
5caa766855d5613a999f71b7812d6451

SHA1
ad0d9a52a0d5cc7f11858301dbe47377ed99ee37

SHA256
3a8ce2b07e3e8678a13aa58ef5b942c4dccd8f9c84511bdeb8847ef270797e27

SHA512
17bb0f4c87ec178910795b25ce85e74cf599190c769592472c3e872f42930c93f28faf0ff3e448816a9abcc8af0459852bed52bee08cfe25d068879c6dfd8eba

Download Submit
/root/.mozilla/firefox/nicwi15t.default-release/key4.db

Filesize
288KB

MD5
78d6089b2773a8e28e9db6c9f48137c6

SHA1
81b4d1fdd8db6f8f204f221d8636b270eadd17af

SHA256
24af8d170d380b436abda00147a0ee81329212805c20944801f8d878c621d4a0

SHA512
cc8ba10be101178b8d414bcf225011104cf233927bc215cd9c2581043b6c949c3c8fb053a66caacae5f6f0332bb616c8f3ea13076da6818e52faf7da876a0dca

Download Submit
/root/.mozilla/firefox/nicwi15t.default-release/permissions.sqlite

Filesize
96KB

MD5
232fbc22dd03a8ec41edde02bdbea61c

SHA1
6ab4b39bca95418c52f7f861fd39e5fddb9cc7b6

SHA256
d88bf367aaf79efbb2e8fbdb1dc5bde1c1c3a53e0f4d8188027a63ec55d5f5f0

SHA512
055f1595f4a327347671db53cec8d89a310109d3f871c567e3d5b654b956fc0369d12437f7dc6d9327b973008f1327ee0dfdb5504f1b3cbe00da29941b1e5892

Download Submit
/root/.mozilla/firefox/nicwi15t.default-release/prefs-1.js

Filesize
1KB

MD5
173370c0bd371f206259a12481916671

SHA1
ca272bbe5e2004c1f3a139d261746cf611cdaa54

SHA256
b1ea496e0fde7f61d1f8ea3beae44a2bbc0325fd7c11925e9af6ac1e590bc287

SHA512
2306cd7d8ee61721f04b502492d0e7401f1016371cc5d79d46893c28ea7c800f508e416300ce8de4883e84406e6e62ac7b3a29f87b8a96d15de6d4d7a31a8d32

Download Submit
/root/.mozilla/firefox/nicwi15t.default-release/prefs-1.js

Filesize
1KB

MD5
24bda97320013b92bc79b7e3ebf60fcf

SHA1
c69f75e5d2b396e8780484eafe9ad0869978927b

SHA256
15fe2e289ac6c60f475a61c30103ee03dfa2e973e7759d89c3fd63f85dcff2e0

SHA512
563f6ae15f114445cd133a028f8e775d53193017024d955ad8b2619333570c445622f5b28425911e378fdb53202367d41654285dde81cca25c64ce64c1349ba2

Download Submit
/root/.mozilla/firefox/nicwi15t.default-release/prefs-1.js

Filesize
2KB

MD5
2d07a4f171c3f95a9515460a48fce3d6

SHA1
904989c28d0f6db060ffe437ba4b62569ac7358e

SHA256
95647a68421ef1418ae0e4955e9c9471265863c9e3dd3b10c4c55821f9aa112a

SHA512
6d09623a342fb8628743e544e5043a34520855cce2a290838c1a1f8bdcd16c08d4b5f93da78897b84d8ab4a66be3f8b1ed5a3b12efe7a786d4a5680c3a026eda

Download Submit
/root/.mozilla/firefox/nicwi15t.default-release/prefs-1.js

Filesize
2KB

MD5
665064998e0da68b5e260f4b4122582c

SHA1
c23176e113654fcad207fbecd4f72875cfe369bd

SHA256
5c3de6094366a9a7b57feb73b2add476cbfea2f10c585f81cbd56fa99565b6e4

SHA512
bc0841bcfaf8ba0893d5ac30f8ef0ceaeb5909aec0eaffaf8027902fab4188ec327db9a11d28a500d974c0c4b497a4e64ff9a8d9e4316239d2a791376aef066c

Download Submit
/root/.mozilla/firefox/nicwi15t.default-release/prefs-1.js

Filesize
2KB

MD5
1a7a7028e01467559594c044a89e7309

SHA1
5214e530a7d96a420b61b2faa9f5596e87a8defa

SHA256
cd37c22d2047948358e6e98ea37f595dbfcd24dd0e056c1e4b2fc501d754171b

SHA512
f942022cadf7e21f135fc94a6d49c78515efad7220edcc15a1cb2cc6027ad901e08fa57da35ffe2d2ab9d30b4958804023f7d423fc901e8389f4e5287c5cf7f8

Download Submit
/root/.mozilla/firefox/nicwi15t.default-release/prefs-1.js

Filesize
3KB

MD5
ac12e93b215409e936dd64f58ce925b2

SHA1
36cd9e27f38eb1c6421755398803c16e7e5ded54

SHA256
ecddd3117540aba08dbc0d91816fb5b56e715a132e430af7ccbb66270fe363b7

SHA512
8b1ae6d074c9854987316326df3eb140634894a61361529625303c67c4d13c7530ce704dadea72b298631d7774f2d59fca5f5771cb05352c52305e6342e23069

Download Submit
/root/.mozilla/firefox/nicwi15t.default-release/prefs-1.js

Filesize
4KB

MD5
34256dadbb96ba06b102059d550cf1a4

SHA1
a793a323375f7b474bf77f9ba9c6d81cff328fbc

SHA256
840e52ad3d218b91c6b27b922d081597e05dbeac9818abbefbc853699f93a278

SHA512
a346cfa93ed66779b6631221817e239e61bf81041ef67b238fec5f95e57908ef11478a04134ae3ffaf33415792f6ca732a1afe1dd5116ab6a364275e5e7863c0

Download Submit
/root/.mozilla/firefox/nicwi15t.default-release/prefs.js

Filesize
995B

MD5
0f1e1005d75b5924a631a6321ad33756

SHA1
0e7da335dd2cbea2f88024f40a8c356e1c611d27

SHA256
52b0cce5ad89386f7f136a359722ee95652a43184513f92db2d593a438aefa95

SHA512
bfa4062dfc10c5b4561bba8d30f86b665c10c3d9c543a73fbd80245ede1f6396c344184c5bcf51eb0a0aa347de47915fa75938c935b679a8b38d80aa1169bd71

Download Submit
/root/.mozilla/firefox/nicwi15t.default-release/storage/ls-archive.sqlite

Filesize
96KB

MD5
e0c613bfd69956a19ce2dc5e925aa223

SHA1
14accb230edcd6cb76967cdc6d4e5686db96b5df

SHA256
0d4cb11f6364c46a75f9eaddfca5c660b90dfd515df3afcd5e0baeca28a0f1ab

SHA512
01643c0131a392be92b3f281d7f633c1f502bff19090b0d716f1ac66aefecc3fcf92f393bef66b03089c9b9c6d8aaeb711b6a4f29d5a6729dd188c838f2272d1

Download Submit
/root/.mozilla/firefox/nicwi15t.default-release/storage/ls-archive.sqlite

Filesize
128KB

MD5
178d71e5529d637ac62f7e75fdd75896

SHA1
339f2b949cc4c207b66aea11137448ba28d36dcb

SHA256
7b0050f1bfaab85c8f9067ae7d7369056ff752c0c852ef1462a96c22169004d4

SHA512
ec0e0105fcfbbae356dd55efbcf92975f35bbe5cb93fcabf4c08443e871957635d14830b27c4e1ddefbbaff8f9b7ec3590bf417a9442e1d7ee3607d14d56f664

Download Submit
/root/.mozilla/firefox/nicwi15t.default-release/storage/permanent/chrome/.metadata-v2-tmp

Filesize
42B

MD5
d64e0dd4ce6cdb1fc10e5c8975b986ce

SHA1
fa244bf9e2ebdd96352120753a386dc6c98c820c

SHA256
eb54ba8764b7d453fdeddf00fcfc9c508ca06f53b6c311844bfc941899ca4bcf

SHA512
d68c0ce35c3d26f6692d2ea7831030ff9523893bdb8ff8d46336f99e3410bd73b1bd1c75c7c68d09acb4fba28888ce18dd2041852694d85a8a83c0e4d341cfa1

Download Submit
/root/.mozilla/firefox/nicwi15t.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite

Filesize
44KB

MD5
759544297aaa61f5fef8ee42d0ae4393

SHA1
fc2d66f6e60409e3e8d38623ce5f817fc7f571e0

SHA256
1bd2000cd972e80cefaec6e982ba261d224a818f367de0fdf8c51fa5a05d7ab5

SHA512
8aaa2ce66f10d46f7c9200af841ac7bd9f5b55c30308a14f0deda44ac62581c45daae45154487c0073a0d5847d5926cbb4072ca64a702ac6b834ad0bb482804f

Download Submit
/root/.mozilla/firefox/nicwi15t.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite

Filesize
12KB

MD5
e3ab4046be0ab9136bd978594a721132

SHA1
a221e60a9fcc8a68f11fe2e5c9a3cb37ab3127a0

SHA256
5d186786bef234e040305c5657727f46062a5ea2ec382dbff3b29c9b981f1a7e

SHA512
4bcbff7e4a971b01a0301a70c093c46382deaf86d50f2e94774f9cb22c2fa03917ac2941dab584f8c34e0a4b378e7892d911934258b85bb79a2644f093e0d479

Download Submit
/root/.mozilla/firefox/nicwi15t.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite

Filesize
16KB

MD5
20ad585f41e185b6fe65a85f4a029ae2

SHA1
1b932f9fc1b14f4ce0927d2d68e5787553c4dcd9

SHA256
ea39aee17a79ac9caa194bddfc19a2560689dab5e22d856ca5c0c7d18912c01d

SHA512
f8c6461c014c82649b865d333cab6b4007c124f6f7a5b1c233cdb8ced364db3e7ceec787a8d8a8497385a47bfb365724b6c26ce8c3af70107df7d49464438075

Download Submit
/root/.mozilla/firefox/nicwi15t.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
44KB

MD5
07a412e08825220262ad2890757ff779

SHA1
f46c127dbc070ded87a6078b3c1c761955f96de8

SHA256
da640f8b665841b520d2262a21cc3f82aeaa881cf81a1ddae27ef501d66544e4

SHA512
0134c783bf3293848e479b478ac57a1e0f4202cddfb8b57bc6275aada7345f398cf8a627e9b1c34fd618192c2f0c9737b1da487daf33f9c557ebc1377105582b

Download Submit
/root/.mozilla/firefox/nicwi15t.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
12KB

MD5
c764c4cc8e798f9c88d6b187e705e1a9

SHA1
6ebf616c3624ba177148c3e12d960a921032df97

SHA256
4ce5018adb9830f62f286aeed772272da008bafb61e1036112cee24b083e75c5

SHA512
1046baf1bd4789c8c87201a51db1fde4bbd812d5fc812bc43eb173f1df0e2736635541eb46f4524fb071d713e64eeb04cbd9922c1b0313e496b28bb422018f0f

Download Submit
/root/.mozilla/firefox/nicwi15t.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
164KB

MD5
8c63d552d7e52fc4f6387934815532e9

SHA1
e40f99bccddcd203d0458571ed415d5046695f3d

SHA256
634b4aa49d3e42e3c25fd477e046fa9d566cf2a0e127cb37ab92f8c010cb891f

SHA512
be9a6525109cf1fd394034af38ca726d1cc49258167296535d9fb6004f1d0a1dc3944dc4bbcf6ddc089cc0acf5b4a053756ea7a771d8a7c0c054490424720100

Download Submit
/root/.mozilla/firefox/nicwi15t.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
148KB

MD5
dd3f6ba37c670af5953593535e435d04

SHA1
ecfe4e650a050bce77e8ff7468de04c1b8acc9a4

SHA256
5cc6fa137a1f3a7d0b615b178877f12c460b22f95702eb7534d5732ee6599561

SHA512
86e0482543faae6fb279ca71e1e6d6461d32317e74baebb3973e0fde9800107faeb9c2347be6cf8a47556ae43c8e6c224a595e952f621e40ad2c5eba920df2b3

Download Submit
/root/.mozilla/firefox/nicwi15t.default-release/times.json

Filesize
50B

MD5
5d238bfbfc938d778cb440d11d85dd3d

SHA1
67198f2cacbaf59b537c62747383f27ebaaf0b7b

SHA256
d3673178c23fa29960d7429f4c83a314b58c9ec9c9b73763e57d5a2419cdef73

SHA512
160c0ba45e418ebed3c87b17b8324a949e4b441f7fbc8adefe99253d38b8c69318c8f4e5d1c23008b8cd704e7f1011701aca14d207adcaf67bad997ed1e5341b

Download Submit
/root/.mozilla/firefox/nicwi15t.default-release/times.json

Filesize
47B

MD5
e5bb1d4e07b62c2a4df8b66951449133

SHA1
efc7956a5ac07c35879ca52e28a2c3b445f12546

SHA256
0826438c7a608e04663210f8622147fdbdd3606914173ccf2b721280f9d0705a

SHA512
a8272c7f9c6cbc71f12826635cc81a6052ec1b4d5712bcf2e7134a3b8754f750d4ea385e071e2a81452adefedc399a165c0bb7bd6fd905f6ab9bd8c7728a7130

Download Submit
/root/.mozilla/firefox/profiles.ini

Filesize
259B

MD5
cc9bab1f2999ef654d943cf145e0574b

SHA1
5186bd88f67d65342f1403e041f31c05caee79d5

SHA256
29c91f809d998ebfc957e29ae77d709ae16ca41da64401ed30878fb3380625fd

SHA512
142bcd98e34d638e81a0d964e5e84afcd5a7e0360d4bff3a73519f2ef202561d9eebb5941f5c57d9eccf2949301143bf24326a25eb69388a7bf4bea1b104f0bf

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads