hxxp://livex2[.]plstreams100[.]stream

Analysis

max time kernel
3s
max time network
37s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240226-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
11/04/2024, 08:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://livex2.plstreams100.stream

Score

7^/10

antivm spyware stealer

Malware Config

Signatures

Changes its process name 64 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1690	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1690	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1690	Process not Found
Changes the process name, possibly in an attempt to hide itself	glean.dispatche	1689	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1695	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1695	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1694	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1694	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1693	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1693	Process not Found
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1696	Process not Found
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1696	Process not Found
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1692	Process not Found
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1692	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1691	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1691	Process not Found
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1698	Process not Found
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1698	Process not Found
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1700	Process not Found
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1700	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cache2 I/O	1701	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cookie	1702	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cookie	1702	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1703	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1703	Process not Found
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #1	1705	Process not Found
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #0	1704	Process not Found
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1706	Process not Found
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1706	Process not Found
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	1707	Process not Found
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	1707	Process not Found
Changes the process name, possibly in an attempt to hide itself	IndexedDB #1	1708	Process not Found
Changes the process name, possibly in an attempt to hide itself	IndexedDB #1	1708	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC Launch	1711	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC Launch	1711	Process not Found
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	1710	Process not Found
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	1710	Process not Found
Changes the process name, possibly in an attempt to hide itself	Breakpad Server	1709	Process not Found
Changes the process name, possibly in an attempt to hide itself	DOM Worker	1713	Process not Found
Changes the process name, possibly in an attempt to hide itself	DOM Worker	1713	Process not Found
Changes the process name, possibly in an attempt to hide itself	Sandbox Forked	1712	Process not Found
Changes the process name, possibly in an attempt to hide itself	Chroot Helper	1714	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #5	1718	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #5	1718	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #4	1717	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #4	1717	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #3	1716	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #3	1716	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	1715	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	1715	Process not Found
Changes the process name, possibly in an attempt to hide itself	MainThread	1712	firefox
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1730	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1730	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1730	Process not Found
Changes the process name, possibly in an attempt to hide itself	FSBroker1712	1731	Process not Found
Changes the process name, possibly in an attempt to hide itself	FSBroker1712	1731	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Process	1712	firefox
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1733	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1733	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1732	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1732	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1735	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1735	Process not Found
Changes the process name, possibly in an attempt to hide itself	ProfilerChild	1734	Process not Found

Reads user data of web browsers 64 IoCs

Reads stored browser data which can include saved credentials.

spyware stealer

description	ioc	Process
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/places.sqlite-wal	firefox
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/SiteSecurityServiceState.txt	Process not Found
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/xulstore.json	firefox
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/sessionstore.js	Process not Found
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/favicons.sqlite	firefox
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/bookmarkbackups	Process not Found
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/sessionstore-backups/previous.js	Process not Found
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/extension-settings.json	Process not Found
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/storage/temporary	Process not Found
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/key4.db-journal	firefox
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/AlternateServices.txt	Process not Found
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/prefs.js	firefox
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/cookies.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/addonStartup.json.lz4	firefox
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/cookies.sqlite-journal	firefox
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/sessionCheckpoints.json	Process not Found
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/times.json	Process not Found
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/shield-preference-experiments.json	Process not Found
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/cert9.db-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/cert9.db	firefox
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/key4.db	firefox
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/storage/default	Process not Found
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/cert_override.txt	firefox
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/favicons.sqlite-wal	firefox
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/search.json.mozlz4	Process not Found
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/places.sqlite-journal	firefox
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/permissions.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/addons.json	Process not Found
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/sessionstore-backups/recovery.jsonlz4	Process not Found
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/cert9.db-journal	firefox
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/cookies.sqlite	firefox
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/storage	Process not Found
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/storage/permanent/chrome/idb	Process not Found
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/ExperimentStoreData.json	Process not Found
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/favicons.sqlite-journal	firefox
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/sessionstore-backups/previous.jsonlz4	Process not Found
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/extension-preferences.json	Process not Found
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/sessionstore-backups/recovery.bak	Process not Found
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/ClientAuthRememberList.txt	Process not Found
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/cookies.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/storage/ls-archive.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/storage/permanent/chrome	Process not Found
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/sessionstore.jsonlz4	Process not Found
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/handlers.json	firefox
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/pkcs11.txt	firefox
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/content-prefs.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/extensions	firefox
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/key4.db	Process not Found
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/places.sqlite	firefox
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/compatibility.ini	firefox
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/user.js	firefox
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release	Process not Found
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/system-extensions	firefox
File opened for reading	/root/.mozilla/firefox/p6wdng6g.default-release/storage.sqlite-journal	Process not Found

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc
File opened for reading	/proc/cpuinfo

Reads CPU attributes 1 TTPs 11 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	Process not Found
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq	Process not Found
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/size	Process not Found
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/size	Process not Found

Enumerates kernel/hardware configuration 1 TTPs 60 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/kernel/security/apparmor/features/dbus/mask	dbus-daemon
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/device	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/resource	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/vendor	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/uevent	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/vendor	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/class	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/device	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/device	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/resource	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_vendor	Process not Found
File opened for reading	/sys/devices/system/cpu	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/irq	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/device	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/irq	Process not Found

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/filesystems	dbus-daemon
File opened for reading	/proc/1600/status	Process not Found
File opened for reading	/proc/self/fd/38	firefox
File opened for reading	/proc/self/fd/44	firefox
File opened for reading	/proc/1795/smaps	Process not Found
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/fd/40	firefox
File opened for reading	/proc/self/fd/42	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/fd/37	firefox
File opened for reading	/proc/filesystems	xdg-document-portal
File opened for reading	/proc/filesystems	gvfsd
File opened for reading	/proc/self/task/1801/stat	Process not Found
File opened for reading	/proc/1817/statm	Process not Found
File opened for reading	/proc/self/fd/6	firefox
File opened for reading	/proc/self/fd/35	firefox
File opened for reading	/proc/self/task/1851/stat	Process not Found
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd/45	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/1741/cmdline	Process not Found
File opened for reading	/proc/filesystems	gvfsd-fuse
File opened for reading	/proc/self/task/1824/stat	Process not Found
File opened for reading	/proc/1616/cmdline	Process not Found
File opened for reading	/proc/1683/cmdline	Process not Found
File opened for reading	/proc/1770/cmdline	Process not Found
File opened for reading	/proc/mounts	dbus-daemon
File opened for reading	/proc/self/task/1685/stat	Process not Found
File opened for reading	/proc/self/fd/31	firefox
File opened for reading	/proc/self/fd/29	firefox
File opened for reading	/proc/self/mountinfo	firefox
File opened for reading	/proc/1750/cmdline	Process not Found
File opened for reading	/proc/filesystems	xdg-desktop-portal-gtk
File opened for reading	/proc/1761/cmdline	Process not Found
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/fd/93	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/mountinfo	Process not Found
File opened for reading	/proc/self/fd/50	firefox
File opened for reading	/proc/1746/cmdline	Process not Found
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/1865/smaps	Process not Found
File opened for reading	/proc/self/fd	Process not Found
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd/39	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/1817/smaps	Process not Found
File opened for reading	/proc/1865/statm	Process not Found
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/fd/46	firefox
File opened for reading	/proc/self/fd/47	firefox
File opened for reading	/proc/self/fd/51	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/1600/attr/current	Process not Found
File opened for reading	/proc/1593/cmdline	Process not Found
File opened for reading	/proc/self/stat	Process not Found
File opened for reading	/proc/self/fd/34	firefox
File opened for reading	/proc/self/fd/48	firefox
File opened for reading	/proc/self/fd/72	firefox
File opened for reading	/proc/sys/kernel/cap_last_cap	Process not Found
File opened for reading	/proc/self/fd/43	firefox
File opened for reading	/proc/self/fd/75	firefox

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/firefox/.parentlock	firefox

/usr/bin/xdg-open
xdg-open http://livex2.plstreams100.stream
1⤵
PID:1592
- /usr/bin/dbus-send
  dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
  2⤵
  PID:1593
- - /usr/bin/dbus-launch
    dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
    3⤵
    PID:1594
- /bin/grep
  grep " = \\\"xfce4\\\"\$"
  2⤵
  PID:1602
- /usr/bin/xprop
  xprop -root _DT_SAVE_MODE
  2⤵
  PID:1601
- /bin/grep
  grep -i "^xfce_desktop_window"
  2⤵
  PID:1604
- /usr/bin/xprop
  xprop -root
  2⤵
  PID:1603
- /bin/grep
  grep -q "^Enlightenment"
  2⤵
  PID:1606
- /bin/uname
  uname
  2⤵
  PID:1607
- /bin/grep
  grep -q "^file://"
  2⤵
  PID:1609
- /bin/egrep
  egrep -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1611
- /usr/local/sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1611
- /usr/local/bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1611
- /usr/sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1611
- /usr/bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1611
- /sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1611
- /bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1611
- /usr/bin/xdg-mime
  xdg-mime query default x-scheme-handler/http
  2⤵
  PID:1615
- - /usr/bin/dbus-send
    dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
    3⤵
    PID:1616
  - - /usr/bin/dbus-launch
      dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
      4⤵
      PID:1617
- - /bin/grep
    grep " = \\\"xfce4\\\"\$"
    3⤵
    PID:1620
- - /usr/bin/xprop
    xprop -root _DT_SAVE_MODE
    3⤵
    PID:1619
- - /bin/grep
    grep -i "^xfce_desktop_window"
    3⤵
    PID:1622
- - /usr/bin/xprop
    xprop -root
    3⤵
    PID:1621
- - /bin/grep
    grep -q "^Enlightenment"
    3⤵
    PID:1624
- - /bin/uname
    uname
    3⤵
    PID:1625
- /usr/bin/which
  which firefox
  2⤵
  PID:1668
- /usr/bin/firefox
  /usr/bin/firefox http://livex2.plstreams100.stream
  2⤵
  PID:1683
- - /usr/bin/which
    which /usr/bin/firefox
    3⤵
    PID:1684
- /usr/lib/firefox/firefox
  /usr/lib/firefox/firefox http://livex2.plstreams100.stream
  2⤵
  - Reads user data of web browsers
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1683
- - /usr/bin/dbus-launch
    dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
    3⤵
    PID:1688
- - /usr/local/sbin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1738
- - /usr/local/bin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1738
- - /usr/sbin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1738
- - /usr/bin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1738

/usr/bin/dbus-daemon
/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1598

/bin/sed
sed -n "s/\$^[[:alnum:]+\\.-]*\$:.*\$/\\1/p"
1⤵
- Reads runtime system information
PID:1614

/bin/sed
sed "s/:/ /g"
1⤵
PID:1628

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1633

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1632

/usr/bin/head
head -n 1
1⤵
PID:1631

/bin/grep
grep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
1⤵
PID:1630

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1638

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1637

/usr/bin/head
head -n 1
1⤵
PID:1636

/bin/grep
grep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
1⤵
PID:1635

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1643

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1642

/usr/bin/head
head -n 1
1⤵
PID:1641

/bin/grep
grep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
1⤵
PID:1640

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1648

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1647

/usr/bin/head
head -n 1
1⤵
PID:1646

/bin/grep
grep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
1⤵
PID:1645

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1653

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1652

/usr/bin/head
head -n 1
1⤵
PID:1651

/bin/grep
grep "x-scheme-handler/http=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache
1⤵
PID:1650

/bin/sed
sed "s/:/ /g"
1⤵
- Reads runtime system information
PID:1656

/bin/sed
sed -e "s|-|/|"
1⤵
- Reads runtime system information
PID:1659

/bin/sed
sed -e "s|-|/|"
1⤵
- Reads runtime system information
PID:1662

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1667

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1674

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1677

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1682

/usr/bin/lsb_release
/usr/bin/lsb_release -idrc
1⤵
PID:1699

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -parentBuildID 20230522134052 -prefsLen 19257 -prefMapSize 230809 -appDir /usr/lib/firefox/browser "{3a36295f-e8a9-4b11-9ded-3e997ad013f7}" 1683 true socket
1⤵
- Changes its process name
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1712

/usr/libexec/xdg-desktop-portal
/usr/libexec/xdg-desktop-portal
1⤵
PID:1741

/usr/libexec/xdg-document-portal
/usr/libexec/xdg-document-portal
1⤵
- Reads runtime system information
PID:1746

/usr/libexec/xdg-permission-store
/usr/libexec/xdg-permission-store
1⤵
PID:1750

/usr/libexec/xdg-desktop-portal-gtk
/usr/libexec/xdg-desktop-portal-gtk
1⤵
- Reads runtime system information
PID:1761

/usr/lib/gvfs/gvfsd
/usr/lib/gvfs/gvfsd
1⤵
- Reads runtime system information
PID:1765

/usr/lib/gvfs/gvfsd-fuse
/usr/lib/gvfs/gvfsd-fuse /root/.gvfs -f -o big_writes
1⤵
- Reads runtime system information
PID:1770

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 21750 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{458e13ed-a704-4fa3-9427-15634a9d9ff7}" 1683 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
PID:1795

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 2 -isForBrowser -prefsLen 21475 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{511a644f-768c-45d7-8a2e-12a206106812}" 1683 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1817

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 3 -isForBrowser -prefsLen 21824 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{22f283b1-b1e3-4dbe-983a-8873bcb7c4f0}" 1683 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1848

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 4 -isForBrowser -prefsLen 27881 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{62842146-43c9-4519-8849-62b86f38ccc4}" 1683 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1865

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/root/.cache/dconf/user

Filesize
2B

MD5
c4103f122d27677c9db144cae1394a66

SHA1
1489f923c4dca729178b3e3233458550d8dddf29

SHA256
96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

SHA512
5ea71dc6d0b4f57bf39aadd07c208c35f06cd2bac5fde210397f70de11d439c62ec1cdf3183758865fd387fcea0bada2f6c37a4a17851dd1d78fefe6f204ee54

Download Submit
/root/.cache/mozilla/firefox/p6wdng6g.default-release/cache2/entries/3D1E19D09F398691ABF62061591970855193B42F

Filesize
13KB

MD5
61023712ee7b61875e625277d6e681fe

SHA1
0e3f27d656acae8c308e87cf6c7e7d067c89be57

SHA256
c97fa0be64599cfaf71f2479883b168a7ffaa2c27b0d6eb0c4b916557b13e689

SHA512
b102a6a696845ac5b2e4f373f5f670517cd2d5e29ee7b4174b12c557a5e570385190361669200bec0180be4735458cea5c275a284a62030da3a2826bc257975a

Download Submit
/root/.dbus/session-bus/11c67417355f45d397f6be11f62e85a6-0

Filesize
466B

MD5
ffc6b7d48f9a67d6c75b1c0d40f5bbb6

SHA1
718738e597ab90c5b023a3c38aae1ba29283203a

SHA256
41746ef7a4bc0070e151c19b3add56d900ed61e00a8a72961868b837283fca52

SHA512
72d52dfb29453227380530c3238148725946c189bd62ed58f741766481e7aef73813678a976c2cd3584cfabff09c87369622dc8a81919ae9532d19504ed50bd7

Download Submit
/root/.mozilla/firefox/Crash Reports/InstallTime20230522134052

Filesize
10B

MD5
77caf58d667730ac64229e71e6dc5af0

SHA1
9dace3541d4657a992814506ca6b84809062191d

SHA256
da010a2c10791ab75dbfd079b37ad05daaa98471e8b02782c1d650ca23ff71d8

SHA512
71356c04e384c23c5cad235cedd5aa36bffbd279ffb5af526a918dc5b89abf819c8f16a10d45ce7675d5c15b09ae72f4214f8e2c82dd807764082bda6e5dd34f

Download Submit
/root/.mozilla/firefox/d0t61o9e.default/times.json

Filesize
47B

MD5
ac31e3122bc0f9b3dcb83cb08300b86b

SHA1
c61da6511ddd6f93eec4556b151f702488a672d5

SHA256
4cf3def26ac6ecc026b052aa82d96f26d51aa17158a7dee98cd62dfa45bcd637

SHA512
94e467322de4bf225527e41b89d271a935ea2bb95e0224d4e6efabe0f7d701e11284923ba54c5113e66018754950d792133dafa1096aa428dfe3782b491f2d56

Download Submit
/root/.mozilla/firefox/installs.ini

Filesize
62B

MD5
e02dc32ca4befcba74781a4d3b2716de

SHA1
8f5d57e0cb9206c42fd7625efef0e01bf317f2f4

SHA256
cefa1f6ccb91643ab742e2cd4b950f3f9e552ea041162fe315bed2c251b1346a

SHA512
e28ff3bf3a4a30279125256049fb5e4de58c1d08db494131ceec950d4984eab42108e60dca4bd5dbf5d2cf423aa99254e7aae0ee3dfeec48d45d979fb9947428

Download Submit
/root/.mozilla/firefox/p6wdng6g.default-release/cert9.db

Filesize
224KB

MD5
703dc0dd83aa0d68bd6301684d4a68b7

SHA1
7f1c1cbd051cac584a232547b3e5b06d64627c2e

SHA256
2f4d8afba3ec654d2029636bf91083c70267e76f77e86042616fed9e7b6a3b14

SHA512
cf2d5f5a15077bb6f7c46c4350694c560b1b1b87364b0f019e5c5a906881b716489d6472e15cb29358c5e4e34aacb16e9791aed6421da661ac1156bc49e534bf

Download Submit
/root/.mozilla/firefox/p6wdng6g.default-release/cert9.db

Filesize
224KB

MD5
a5ba6516b1848182eab8e21ef1220bbf

SHA1
598f0a5a59f34ffe6630bc00b015ea42f5b3d484

SHA256
4b5fb4254e5cb1ab60bdb5f3c1afebe6b64dac28b1bfb56a6b17234cbb081a2f

SHA512
c835c18f0f1e8cc83939b6b64fef1eae5285712edd8e53c72d0ec957a61c583dbf5c7d31c41031e23860bb1ceb80e6c6259d28b3b0c7e04d4aeb74571a66f613

Download Submit
/root/.mozilla/firefox/p6wdng6g.default-release/cert9.db

Filesize
224KB

MD5
b2e8156f6d8651b80290f9960536daac

SHA1
987895f69c2fd8917d41cacaac31ac64bc80584c

SHA256
dec6f48a1b3d3e2783a7c2048244fca24d3634648bb38877d7c1e079cd26d4de

SHA512
c14811775316da74f5e2717ccc8d5ad43b7ba85fff12f9f40c38fd8fba22576205d53d744721a5c3702efb911d662c7eca0987142f8457be4c585c94f0a73905

Download Submit
/root/.mozilla/firefox/p6wdng6g.default-release/compatibility.ini

Filesize
163B

MD5
fe452b7294d5928a9a5863b89ee0a6bd

SHA1
a5d4c245071fa96476ba48b4725bdae7f1b7940f

SHA256
d5bfb07561606a19aa96557ea109b175050dc0eb805cbef9c813503587d77900

SHA512
dc37d8507f08849e3382d2dbafd4a64555dbd57a288c95131e9aefb366630f1585811a9e1456b861bb9d2b816ed88b18ffb7580cd92b41bb9b0227ce1363843e

Download Submit
/root/.mozilla/firefox/p6wdng6g.default-release/cookies.sqlite

Filesize
96KB

MD5
9535f5fe817accc769c2c1d3354db39f

SHA1
6af62cf08717cf3bfa84eb1a7b311acf522ce560

SHA256
c53c15fcfac2bb57fdc88d23f932fc244dbaf4020f0f6eaecf0f77a37c21f8c5

SHA512
dc9c2c32eb42dda0a7a711e143aea58c603c1e9d885c3677e9fe86f525e1b0b32a46e240756263e56510b07e764ba69f2de13b90ec18210678242e10cfe17837

Download Submit
/root/.mozilla/firefox/p6wdng6g.default-release/cookies.sqlite

Filesize
96KB

MD5
5caa766855d5613a999f71b7812d6451

SHA1
ad0d9a52a0d5cc7f11858301dbe47377ed99ee37

SHA256
3a8ce2b07e3e8678a13aa58ef5b942c4dccd8f9c84511bdeb8847ef270797e27

SHA512
17bb0f4c87ec178910795b25ce85e74cf599190c769592472c3e872f42930c93f28faf0ff3e448816a9abcc8af0459852bed52bee08cfe25d068879c6dfd8eba

Download Submit
/root/.mozilla/firefox/p6wdng6g.default-release/favicons.sqlite

Filesize
224KB

MD5
3c0a1ec298284608bfa51081ea539be3

SHA1
e51b58f6fe89d45fd8a1d935b51da172d5f6f32e

SHA256
34c4fe7ab2d3e44f193b489ebe84c17d67b336546af9ef231897ec09d7ff16f2

SHA512
8550f530377f7a98c46a6989bec2c43ed644274509a5b987e8e0d034bf867b3315dcc75a2c851a5ac43a45b40bf51c789d828a9a69c02157b3e900467341a28f

Download Submit
/root/.mozilla/firefox/p6wdng6g.default-release/key4.db

Filesize
288KB

MD5
3cd389fea074c810f4112fdeb5c21440

SHA1
ecc9380403f768b7ce8576744bb17d6f336b79b9

SHA256
e99902c2dddd096e88831112c6d89d6888f9245d6304a3662dc039e80fee6a60

SHA512
64d2be5a137192b0312d9ac5b821009dc570d8ab080588a9f1ef54662dedac24927f53fa8fee77f0ee662657363f97314bb6bdf3864317ca68127c8afabfc2ea

Download Submit
/root/.mozilla/firefox/p6wdng6g.default-release/permissions.sqlite

Filesize
96KB

MD5
211c4d8ecd0e5f19c9674e191d90b7c7

SHA1
77db4b8619c30ec2016724d1db660c2bd060ec77

SHA256
21b18dace51b31f376d7b51574714226815a128d09e03fbc6198099b0cee1f9b

SHA512
01861b5c56dd8cfe1f87fa061f6fc1cffac8dfaff30126898198c6190757df31173add6c7d85e93a710d82f6199f9219804ea0811eaf32efbcc3f2296b07790b

Download Submit
/root/.mozilla/firefox/p6wdng6g.default-release/places.sqlite

Filesize
1.3MB

MD5
c78329a9acd21ffaff86d8fa2872cde3

SHA1
508d614121a2cdccb1e75770335707fbbe3ff5a5

SHA256
c6c862483465c92f11995604bf4193f48da050f869691c4c654c8412bf5d6ffd

SHA512
763dbb375cf498ba32ab98edc7e166390eeb27653fa398dc1937596148d41bee88952d62ec5144f80ff0fce5b3aac9467e7e3ab3dd1c4f7ac6531c9720462da5

Download Submit
/root/.mozilla/firefox/p6wdng6g.default-release/prefs-1.js

Filesize
2KB

MD5
ab3563d196923be07d67aeddd93808c4

SHA1
9e9c65cc7250a9d28054f4f59622e327140ad332

SHA256
0eecc6c854e072a48141df708bf8ef646695e646853b73e17e57d50c22ebb21f

SHA512
94189f768dad063b0a28435cfb239f66500b05aed55928e858d86aace757473baa4f74a49664fb21d626e182c7d29d4586acdd79af72c5f5e704020bebc09bb7

Download Submit
/root/.mozilla/firefox/p6wdng6g.default-release/prefs-1.js

Filesize
3KB

MD5
069386a0eeac8af9c54aeccc624fdc58

SHA1
7babc2c1ac2e0d63599bc6a652f9949079041d0d

SHA256
ad0566cc2bd0330c46fee63ab1fbb680d925624b99af3a56aee2a01b09421058

SHA512
5b0f490fe9bf880dbefddc94b05d119012c450610ee9290f73c0d3481988a22b34161ae557a0abdb5168c5cf34b337ce197f981c1cf101e365327d4cf7e87971

Download Submit
/root/.mozilla/firefox/p6wdng6g.default-release/prefs-1.js

Filesize
4KB

MD5
23e613e8baf3a05880f6d68c7331b108

SHA1
4389d2e24ef5d4b295117a02e53c03f9014b4c26

SHA256
a2da65fe77f275f6788684c2587382fd41d52bb76ad00ff46d636b2f366d830f

SHA512
7849df88e54b68746171b81643114892d5c8565cb445cab68615fefc8ec85eb316639c8c080d9afce585cab00a0c766b80eedb8b4cc34017a430c2806182988e

Download Submit
/root/.mozilla/firefox/p6wdng6g.default-release/prefs.js

Filesize
1KB

MD5
c43b5155a8ea2844c8175aee52a7b316

SHA1
08067f81850ab427be56c61dc969f71d721048eb

SHA256
cfab2ddcdf8d469499de273ddbb96d34ac194692b6bf3e523b31b1b6720b83fc

SHA512
ed02f54f3a23ad9e621c3409b126dd75843abc85c94276f9db1168f6eb05e69bece5e1d165db790ce502fd9fd64b092bef07fb49bc2f0083eb51e1e3d28f876c

Download Submit
/root/.mozilla/firefox/p6wdng6g.default-release/storage/ls-archive.sqlite

Filesize
96KB

MD5
e0c613bfd69956a19ce2dc5e925aa223

SHA1
14accb230edcd6cb76967cdc6d4e5686db96b5df

SHA256
0d4cb11f6364c46a75f9eaddfca5c660b90dfd515df3afcd5e0baeca28a0f1ab

SHA512
01643c0131a392be92b3f281d7f633c1f502bff19090b0d716f1ac66aefecc3fcf92f393bef66b03089c9b9c6d8aaeb711b6a4f29d5a6729dd188c838f2272d1

Download Submit
/root/.mozilla/firefox/p6wdng6g.default-release/storage/ls-archive.sqlite

Filesize
128KB

MD5
178d71e5529d637ac62f7e75fdd75896

SHA1
339f2b949cc4c207b66aea11137448ba28d36dcb

SHA256
7b0050f1bfaab85c8f9067ae7d7369056ff752c0c852ef1462a96c22169004d4

SHA512
ec0e0105fcfbbae356dd55efbcf92975f35bbe5cb93fcabf4c08443e871957635d14830b27c4e1ddefbbaff8f9b7ec3590bf417a9442e1d7ee3607d14d56f664

Download Submit
/root/.mozilla/firefox/p6wdng6g.default-release/storage/permanent/chrome/.metadata-v2-tmp

Filesize
42B

MD5
8459956e17c8f42cfe5ba023dfb33ce9

SHA1
646c71215e9936fd09042699b1e6dff66f192587

SHA256
1c8b7fad62b50f302569dc9f4459652c7d23a982ca97020a26d0933733f83add

SHA512
4c2f6605249b8103899b738ff350d4b7246aa628019c4734060376523a30128c6cd828c92581129134da16383a2a65bce85aa724eb724380308cfc920a64b356

Download Submit
/root/.mozilla/firefox/p6wdng6g.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite

Filesize
44KB

MD5
a8dd7ebaad5528b23f82ccb1534cea18

SHA1
600daceacfb5cf9df0b66ba7dce4516b2ac4df70

SHA256
e5b0d02c18ae36c4a220f41fd97c66060c17aaafcbb324a57ccdc2707c44c4ec

SHA512
67f867a8e2b37fb6bececd5ebc570ca594ea329142badd63d1281d5e735f515a5e329abc6eb9a9d3465aab0a08541b4888018d859964f160a52345ab93532bff

Download Submit
/root/.mozilla/firefox/p6wdng6g.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite

Filesize
12KB

MD5
065bfa644e1b6144622e246240484e74

SHA1
664f0ee5f1a84f1bd0956cb8fb6cbccb0aa961ab

SHA256
47a8b0382b776f45e0d945c4a226c7787d02d0ce68a87e2283fb1f5dc610a160

SHA512
45ecfdba0a485d3b1d63e734368234bdb2794479fc78a563e7237708f3a2d9702256359566ef03d31ccb388b32d7d3da4b3c9ebe8fc53de61d4698b86ca8c70a

Download Submit
/root/.mozilla/firefox/p6wdng6g.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite

Filesize
44KB

MD5
7352c8848e88edc39b7fb5e663888187

SHA1
8c3dffe25cc56c7aec1b782292d6fceed81e6304

SHA256
7a462086a26978809c719e57a7ea6a25568767fb7532014e8531fda94b660e0a

SHA512
f2a0dbbab5c2c1702b03bce15a47739481f523e127d1372b40534db9a20b2bc99fb53710ee0e5d44176188817cac704cf4f98cdf087e7e89d244281fcfc3b280

Download Submit
/root/.mozilla/firefox/p6wdng6g.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite

Filesize
12KB

MD5
560f0ec133bf240e571a9f12d09e30b5

SHA1
93c8471cd74ce973ea266dcbe22af7a522842009

SHA256
3dc1c7cb27044a10bdbbbb03a5b892394e15fed1efdcd7965b8f0f9a9e48beb5

SHA512
4e7d790721cabea9b679d8d69e67e7f9403eda6489cfb64e27e815b575caf2ef5bd34fcc3de86ff273e9def40f5916fa80c0385f617faf7c95629f11ac6cdfb6

Download Submit
/root/.mozilla/firefox/p6wdng6g.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite

Filesize
44KB

MD5
759544297aaa61f5fef8ee42d0ae4393

SHA1
fc2d66f6e60409e3e8d38623ce5f817fc7f571e0

SHA256
1bd2000cd972e80cefaec6e982ba261d224a818f367de0fdf8c51fa5a05d7ab5

SHA512
8aaa2ce66f10d46f7c9200af841ac7bd9f5b55c30308a14f0deda44ac62581c45daae45154487c0073a0d5847d5926cbb4072ca64a702ac6b834ad0bb482804f

Download Submit
/root/.mozilla/firefox/p6wdng6g.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite

Filesize
12KB

MD5
608bddc28b27330638d4b360f08bdd8f

SHA1
a1a4a56f2dba99b4bb9c2fe523c548d6876f7be9

SHA256
d8a39397fbaa06477f3de5e56d934b3f665c147707c7de71f8bb59f19ced1895

SHA512
cad287ec9167fc3524ad5c1952ea227c2ad95940427f589ec1cb22864af02f76e47ea5c0573a6b0f04752e73e033db9fdb1fd96507db5022829fd0e4a333bdfa

Download Submit
/root/.mozilla/firefox/p6wdng6g.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
44KB

MD5
07a412e08825220262ad2890757ff779

SHA1
f46c127dbc070ded87a6078b3c1c761955f96de8

SHA256
da640f8b665841b520d2262a21cc3f82aeaa881cf81a1ddae27ef501d66544e4

SHA512
0134c783bf3293848e479b478ac57a1e0f4202cddfb8b57bc6275aada7345f398cf8a627e9b1c34fd618192c2f0c9737b1da487daf33f9c557ebc1377105582b

Download Submit
/root/.mozilla/firefox/p6wdng6g.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
12KB

MD5
2f546bbcb458ad8558c068cfaac4d900

SHA1
23f43f4a42916a5d49346fed5488b5f9ee0b5183

SHA256
6f765d3e3395f9a1af9a58e250348690016c9f13a3fe7d3e18671749a30eaf8b

SHA512
addda6bdac209936bbc91631ca8cea53bb0f264cb7bf5922b354ef17f0f8cd8912d96ab97b77a4b72d1a42ac70f4ed9a4e7d090ad0f5c3712054b23a4176b50d

Download Submit
/root/.mozilla/firefox/p6wdng6g.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
164KB

MD5
0afddd50d9a319cb73a4f9cebdf7a673

SHA1
4023717188835cf04631048da4f3d52e7486ab0c

SHA256
e77d8c1d99726948356a25a3c9219e8020211de706c5144f572e1e06e9dc8e58

SHA512
1f64b8b30c59c49fb69dbecf00a46fe86fe9442851180fac13da75586b2ce94510af555e58825e933531d2ea4337bae30d7dd8a454bfaf272f7a60ba1bfeac1b

Download Submit
/root/.mozilla/firefox/p6wdng6g.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
148KB

MD5
dd3f6ba37c670af5953593535e435d04

SHA1
ecfe4e650a050bce77e8ff7468de04c1b8acc9a4

SHA256
5cc6fa137a1f3a7d0b615b178877f12c460b22f95702eb7534d5732ee6599561

SHA512
86e0482543faae6fb279ca71e1e6d6461d32317e74baebb3973e0fde9800107faeb9c2347be6cf8a47556ae43c8e6c224a595e952f621e40ad2c5eba920df2b3

Download Submit
/root/.mozilla/firefox/p6wdng6g.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
168KB

MD5
e87498f20e6ffb24c100b389c9186fd6

SHA1
919ac3ffd22845e2ed3bf53ff974ab495d0a7c73

SHA256
98fb2b81377690e84819f72cb58f02505856485830b2bb98c5f1e3b4804013d0

SHA512
706619b456d5beba0308ca27ff3e011c844aea05ad99ae3a572748c8dbb20e9992be624609ca1cb56ff82f29181c9b1e95b9ce7032601db4c24d2e13e5d454e7

Download Submit
/root/.mozilla/firefox/p6wdng6g.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
232KB

MD5
acf01119af3ee0d161b6e1049e26f195

SHA1
8bc33819ec10dae13e2ff134ad511eab20b6c1cd

SHA256
e1998c974705b8d904597e177b52c35f5d66b635fe71441941000bc7cfc675f2

SHA512
cb015e43fb40912970f77491b51c56099fb889e4eea4920e758081e207589a13c7c65ef556735ad7ca5fd90fef9ed3e86907f7f12570d07f8fc83f313fbef2dc

Download Submit
/root/.mozilla/firefox/p6wdng6g.default-release/times.json

Filesize
50B

MD5
78f3c85f8f83e6518f43ba44038b1179

SHA1
4d23905ad757313fbb20e139c9a49653423f91aa

SHA256
c73736f76ffee791df49ebef5e4bcf76732f7bcdcd8899721ba73e63237a622d

SHA512
076f936229e49f33356059c6b1e8da3b54e9f0ac015c5ae824707894aad55eb1870623e53b79cef194c8aa00f65e59b96bfa7947e99af52f40adc1fdd49ea778

Download Submit
/root/.mozilla/firefox/p6wdng6g.default-release/times.json

Filesize
47B

MD5
0c5cee5a99fa55cd4ba5e47a2f54035c

SHA1
b56bff5021c274112ef7ab6e632c178466bb3a05

SHA256
679c62fc878ae01712cb2b86b372a525c1adef78aa10def34cb1a4a94b2fd2f1

SHA512
b7c94e78664334a4282bd8eff1d508cb1e5c51e3ce3b38da2016d780bb207b239a0080aca612853f409a39ac39f4fc97f477500ed9fc93253f5e8a3b749f595d

Download Submit
/root/.mozilla/firefox/profiles.ini

Filesize
259B

MD5
b0da621de7cb30d72fdee9a4c7d5d481

SHA1
5e2dff3f53dcf6b5d928ef274b2dede4ba2ddbcc

SHA256
bad51f0f0d131f1b2dd2ca0fecd61f3fef0084afae3f5bd33acc2183ac62d858

SHA512
b54732822f93fd0ff97247693c621e8e0f8de0458505c8a31743c057455164bb0462b34ff1ade55c6ffd832d8e245bbb5838a7cda513f0dac4c070c4c1a6c306

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads