hxxps://www[.]google[.]com

max time kernel
3s
max time network
11s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240226-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
16/04/2024, 09:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://www.google.com

Score

7^/10

antivm spyware stealer

Malware Config

Signatures

Changes its process name 64 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1568	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1568	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1568	Process not Found
Changes the process name, possibly in an attempt to hide itself	glean.dispatche	1567	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1573	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1573	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1572	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1572	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1571	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1571	Process not Found
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1574	Process not Found
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1574	Process not Found
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1570	Process not Found
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1570	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1569	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1569	Process not Found
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1576	Process not Found
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1576	Process not Found
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1578	Process not Found
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1578	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cache2 I/O	1579	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cookie	1580	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cookie	1580	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1581	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1581	Process not Found
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #1	1583	Process not Found
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #0	1582	Process not Found
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1584	Process not Found
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1584	Process not Found
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	1585	Process not Found
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	1585	Process not Found
Changes the process name, possibly in an attempt to hide itself	IndexedDB #1	1586	Process not Found
Changes the process name, possibly in an attempt to hide itself	IndexedDB #1	1586	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC Launch	1589	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC Launch	1589	Process not Found
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	1588	Process not Found
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	1588	Process not Found
Changes the process name, possibly in an attempt to hide itself	Breakpad Server	1587	Process not Found
Changes the process name, possibly in an attempt to hide itself	DOM Worker	1591	Process not Found
Changes the process name, possibly in an attempt to hide itself	DOM Worker	1591	Process not Found
Changes the process name, possibly in an attempt to hide itself	Sandbox Forked	1590	Process not Found
Changes the process name, possibly in an attempt to hide itself	Chroot Helper	1592	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #5	1596	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #5	1596	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #4	1595	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #4	1595	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #3	1594	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #3	1594	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	1593	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	1593	Process not Found
Changes the process name, possibly in an attempt to hide itself	MainThread	1590	firefox
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1598	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1598	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1598	Process not Found
Changes the process name, possibly in an attempt to hide itself	FSBroker1590	1599	Process not Found
Changes the process name, possibly in an attempt to hide itself	FSBroker1590	1599	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Process	1590	firefox
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1601	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1601	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1600	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1600	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1603	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1603	Process not Found
Changes the process name, possibly in an attempt to hide itself	ProfilerChild	1602	Process not Found

Reads user data of web browsers 64 IoCs

Reads stored browser data which can include saved credentials.

spyware stealer

description	ioc	Process
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/favicons.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/extension-preferences.json	Process not Found
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/pkcs11.txt	firefox
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/ExperimentStoreData.json	Process not Found
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/favicons.sqlite-wal	firefox
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/places.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/protections.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/storage/permanent/chrome/idb	Process not Found
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/times.json	Process not Found
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/addons.json	Process not Found
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/extension-settings.json	Process not Found
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/places.sqlite	firefox
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/key4.db	Process not Found
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/content-prefs.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/places.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/protections.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/storage.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/storage/ls-archive.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/cert9.db-journal	firefox
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/shield-preference-experiments.json	Process not Found
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/cookies.sqlite-journal	firefox
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/storage/permanent/chrome	Process not Found
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/favicons.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/sessionCheckpoints.json	Process not Found
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/SiteSecurityServiceState.txt	Process not Found
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/search.json.mozlz4	Process not Found
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/thumbnails	Process not Found
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/favicons.sqlite-journal	firefox
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release	Process not Found
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/cookies.sqlite	firefox
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/storage/ls-archive.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/sessionstore-backups/recovery.baklz4	Process not Found
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/cert9.db	Process not Found
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/prefs.js	firefox
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/handlers.json	firefox
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/permissions.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/cert9.db	firefox
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/xulstore.json	firefox
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/bookmarkbackups	Process not Found
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/cookies.sqlite-wal	Process not Found
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/extensions.json	Process not Found
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/permissions.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/sessionstore-backups/recovery.jsonlz4	Process not Found
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/sessionstore.js	Process not Found
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/places.sqlite-journal	firefox
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/storage.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/key4.db-journal	firefox
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite-journal	Process not Found
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/sessionstore-backups/previous.js	Process not Found
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/cookies.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release	firefox
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/sessionstore-backups/previous.jsonlz4	Process not Found
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/sessionstore-backups/recovery.bak	Process not Found
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/addonStartup.json.lz4	firefox
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite	Process not Found
File opened for reading	/root/.mozilla/firefox/fznj3xoi.default-release/sessionstore-backups/recovery.js	Process not Found

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc
File opened for reading	/proc/cpuinfo

Reads CPU attributes 1 TTPs 11 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/present	Process not Found
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq	Process not Found
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/size	Process not Found
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/size	Process not Found
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/online	Process not Found
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox

Enumerates kernel/hardware configuration 1 TTPs 60 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/irq	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/uevent	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/device	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/vendor	Process not Found
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/class	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/vendor	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/class	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/vendor	Process not Found
File opened for reading	/sys/devices/system/cpu	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/resource	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/resource	Process not Found
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/device	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/vendor	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/resource	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/class	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/device	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/irq	Process not Found
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/vendor	Process not Found
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/irq	Process not Found
File opened for reading	/sys/kernel/security/apparmor/features/dbus/mask	dbus-daemon

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/fd/40	firefox
File opened for reading	/proc/1609/cmdline	Process not Found
File opened for reading	/proc/self/fd/6	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/1666/statm	Process not Found
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/1732/smaps	Process not Found
File opened for reading	/proc/self/cgroup	firefox
File opened for reading	/proc/1666/smaps	Process not Found
File opened for reading	/proc/filesystems	dbus-daemon
File opened for reading	/proc/1566/attr/current	Process not Found
File opened for reading	/proc/self/fd/31	firefox
File opened for reading	/proc/self/fd/44	firefox
File opened for reading	/proc/1618/cmdline	Process not Found
File opened for reading	/proc/filesystems	xdg-desktop-portal-gtk
File opened for reading	/proc/self/mountinfo	Process not Found
File opened for reading	/proc/filesystems	xdg-document-portal
File opened for reading	/proc/1629/cmdline	Process not Found
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/1715/smaps	Process not Found
File opened for reading	/proc/self/task/1718/stat	Process not Found
File opened for reading	/proc/self/fd/38	firefox
File opened for reading	/proc/self/fd/46	firefox
File opened for reading	/proc/self/fd/49	firefox
File opened for reading	/proc/self/fd/50	firefox
File opened for reading	/proc/self/task/1597/stat	Process not Found
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/fd/35	firefox
File opened for reading	/proc/self/task/1695/stat	Process not Found
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/1688/smaps	Process not Found
File opened for reading	/proc/self/fd	Process not Found
File opened for reading	/proc/1688/statm	Process not Found
File opened for reading	/proc/self/stat	Process not Found
File opened for reading	/proc/1554/cmdline	Process not Found
File opened for reading	/proc/self/fd/39	firefox
File opened for reading	/proc/self/fd/48	firefox
File opened for reading	/proc/filesystems	xdg-desktop-portal
File opened for reading	/proc/filesystems	gvfsd
File opened for reading	/proc/1566/status	Process not Found
File opened for reading	/proc/self/fd/36	firefox
File opened for reading	/proc/self/fd/51	firefox
File opened for reading	/proc/sys/kernel/cap_last_cap	Process not Found
File opened for reading	/proc/self/fd/37	firefox
File opened for reading	/proc/self/fd/41	firefox
File opened for reading	/proc/1614/cmdline	Process not Found
File opened for reading	/proc/self/task/1556/stat	Process not Found
File opened for reading	/proc/1638/cmdline	Process not Found
File opened for reading	/proc/self/task/1672/stat	Process not Found
File opened for reading	/proc/self/fd/111	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/1732/statm	Process not Found
File opened for reading	/proc/mounts	dbus-daemon
File opened for reading	/proc/self/fd/34	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/filesystems	gvfsd-fuse
File opened for reading	/proc/self/fd/74	firefox
File opened for reading	/proc/self/fd/45	firefox
File opened for reading	/proc/self/fd/47	firefox
File opened for reading	/proc/self/task/1736/stat	Process not Found
File opened for reading	/proc/1633/cmdline	Process not Found

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/firefox/.parentlock	firefox

/usr/bin/firefox
firefox -new-tab https://www.google.com
1⤵
PID:1554
- /usr/bin/which
  which /usr/bin/firefox
  2⤵
  PID:1555

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -new-tab https://www.google.com
1⤵
- Reads user data of web browsers
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
PID:1554
- /usr/bin/dbus-launch
  dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
  2⤵
  PID:1562
- /usr/local/sbin/dbus-launch
  dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
  2⤵
  PID:1606
- /usr/local/bin/dbus-launch
  dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
  2⤵
  PID:1606
- /usr/sbin/dbus-launch
  dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
  2⤵
  PID:1606
- /usr/bin/dbus-launch
  dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
  2⤵
  PID:1606

/usr/bin/dbus-daemon
/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1564

/usr/bin/lsb_release
/usr/bin/lsb_release -idrc
1⤵
PID:1577

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -parentBuildID 20230522134052 -prefsLen 19257 -prefMapSize 230809 -appDir /usr/lib/firefox/browser "{8b7e7285-ef38-413e-906e-75093c35d807}" 1554 true socket
1⤵
- Changes its process name
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1590

/usr/libexec/xdg-desktop-portal
/usr/libexec/xdg-desktop-portal
1⤵
- Reads runtime system information
PID:1609

/usr/libexec/xdg-document-portal
/usr/libexec/xdg-document-portal
1⤵
- Reads runtime system information
PID:1614

/usr/libexec/xdg-permission-store
/usr/libexec/xdg-permission-store
1⤵
PID:1618

/usr/libexec/xdg-desktop-portal-gtk
/usr/libexec/xdg-desktop-portal-gtk
1⤵
- Reads runtime system information
PID:1629

/usr/lib/gvfs/gvfsd
/usr/lib/gvfs/gvfsd
1⤵
- Reads runtime system information
PID:1633

/usr/lib/gvfs/gvfsd-fuse
/usr/lib/gvfs/gvfsd-fuse /root/.gvfs -f -o big_writes
1⤵
- Reads runtime system information
PID:1638

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 21750 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{d16e1958-7709-4ad2-a4c7-21a5e7be37e9}" 1554 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1666

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 2 -isForBrowser -prefsLen 21475 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{baf4781c-7aae-4c88-b656-fa0a97207319}" 1554 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1688

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 3 -isForBrowser -prefsLen 21824 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{27343959-f376-441e-aace-eb71ae50ba9a}" 1554 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1715

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 4 -isForBrowser -prefsLen 27881 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{defffae7-c9b8-41b1-9d72-7ab18f52c912}" 1554 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/root/.cache/dconf/user

Filesize
2B

MD5
cf595bf90db7193297195e48ba82104d

SHA1
c8d66731e39b0d3fb47ea2877a6ad8150ee145d7

SHA256
2ecd8a6b7d2845546659ad4cf443533cf921b19dc81fa83934e83821b4dfdcb7

SHA512
083c0151f931208dcb4b0134762c30d1858c6cafa40eaeb4113b69717dc286ac69a890b548b7dfb489cd3b2527903ac45236bb13af8d2c5f2f27807c6d62b6e7

Download Submit
/root/.cache/mozilla/firefox/fznj3xoi.default-release/cache2/entries/0EC4CDE0C33626CA7FA76264533E1686E66A2198

Filesize
21KB

MD5
63e4dcd1dc6c976af64722f849e5b0cb

SHA1
5c1f9550b8a1a72e11d3ea4eb7fd8463675d14ce

SHA256
b84dbcc341330c71bd00c095aaec1720b517eac7f9210603b69c85dd76b354b2

SHA512
cbfe3033535a0362df2e5cddbf9e759d2f62f2bf6355c4ae7ca61d3c03660f46277a32cdbacb4f855333d978f1899598986baa5223111814c97dd7113de7280d

Download Submit
/root/.cache/mozilla/firefox/fznj3xoi.default-release/cache2/entries/3D1E19D09F398691ABF62061591970855193B42F

Filesize
13KB

MD5
384c056d024fc5fb832acbfd1fe130b2

SHA1
e9cd3b0e8367a88cf61906f64f8ea5330c5a2832

SHA256
94d25bc1e5c94aea2d3d6db28b3586db5065fe76a195d11fdefba7c8b7a73d43

SHA512
31cc36553e54f8e1781950fa285cd784cb82497f841b048f6c9d1138d692ab34f41ed43c73b4097e06e352fd1851c6c304d4c2d0ca01f9b17125196fa7aa0b33

Download Submit
/root/.cache/mozilla/firefox/fznj3xoi.default-release/cache2/entries/44230749A38B6989F56217B435A03E84CCADE62D

Filesize
26KB

MD5
cfc4d622c4f7983b1ac3c6a4ee0a841d

SHA1
a79cd18e07cbee3d90e4b7137a237d77c4a0ae06

SHA256
c29964ba69c7f3ceaba5317bb3262f1e31ef1f0e2245147580ec691107fc0cfd

SHA512
6af767dbe257e69e5cc31dca0766603e3934834f4fc2c6c681b7bf2710c9b6c36f2cef0341f6ed4e6243fd707cd8b8c6f6708c534d7f85d18cf905abb43fd978

Download Submit
/root/.cache/mozilla/firefox/fznj3xoi.default-release/cache2/entries/5BFB16A85A6415C5E282039C927A86A8290D09EC

Filesize
11KB

MD5
943a68b49a1a13293d5af15a07debfe2

SHA1
3e980a991eeb8014e985e81609f947844ea580b7

SHA256
1d0aebcf458eeccc9f5302bb833d7fe15328419d4e611d6893eb8f9190278eb8

SHA512
0010138990620aabbbd3d779c3315871f98d7a12094938ab02b726dd73cae9917fa347f7414be80861afd276207881992c01387fe4d4ad75f2ff04495ba7daa6

Download Submit
/root/.cache/mozilla/firefox/fznj3xoi.default-release/cache2/entries/6979334FED794BAA5333B91A986874900AE80BCE

Filesize
17KB

MD5
0b8d84b29cbb187f143f3ae870edd9e9

SHA1
fd62caa2220c92336de8709d41c5d1615d891807

SHA256
b5274f2b7c0841028d7c77a937984ffe82935af02b81cf92e6fdbaf64def4518

SHA512
f4d5bef80d617453a1d78e4b596ba8fa0703166faf0da155fa8a08171aa3c9da6cb5cdd67b475425c38c1560db354f68a453d5a192ae8d3aa81e2423ed52473e

Download Submit
/root/.cache/mozilla/firefox/fznj3xoi.default-release/cache2/entries/740D98CF01550607B0C0C173BEDE235CDD244769

Filesize
12KB

MD5
18ddb1fc5409d727aeb18bed0fd54a53

SHA1
c972b4206acb7efaffa438b58f2d6adc0a24b1fc

SHA256
38bcfe0a47bacb4d3072262e01dd006f632f738b6014daa2533ce302ca589c85

SHA512
9c449c770f8db26eaba60b13139189d32fe4fb15281e830bd5f514d56d92e3bbeb5e523babe8229af8b0985ee768e8465f503c58a67eafb4d4cd018f3f05e696

Download Submit
/root/.cache/mozilla/firefox/fznj3xoi.default-release/cache2/entries/82F4CDEDC8A08E6BCE520A4114F15825F2E886F6

Filesize
62KB

MD5
7ffef1f2f7fffcb7872244a913e41567

SHA1
6d8ab4e853fe1b832160be768dcdf94227acb3ba

SHA256
9e0e8bc75eaaaeb953eab838f7af0d9ef051237fa5060f563006316c3b1bf41f

SHA512
d7a0190f4fcd9d06f2756ac025d03731f37998b50dcd3e1d2b6eeed564f7e5e997433789d80f3d5b3e5b3432b6a51fed34ee3d0a9f9f2c2a65c47286a2db5e88

Download Submit
/root/.dbus/session-bus/11c67417355f45d397f6be11f62e85a6-0

Filesize
466B

MD5
9c5809bea10b501061a75239a1c53eaa

SHA1
f2af2e4c34c65563329707cdaf1a5d35c7b964b3

SHA256
0e715b33c1a0a6411fbef15f3d6a364467b1637a9b5fddb389db9e4565da5612

SHA512
1727d390c6c7c8ca29a467a5dfe6ac1675f390622b1de7f9d8c3ba0c752a6c3721127c70cad2dc73a452b787f741e3bca136a3942a3531a6162b4d14a0a783de

Download Submit
/root/.mozilla/firefox/8hg6ud51.default/times.json

Filesize
47B

MD5
969e80cfe023d08d0307a7570178907e

SHA1
0a26091c0a21ffa905539de35360accf1219bd0b

SHA256
cbd497f598c5ec1e959f6e2a63c6df1856f1455effbdb8a0ef4b1b07ae459266

SHA512
e3d0398ce1e9a9eac48c99ea401335b5024c9057b7c64cf46a232d20f7dc0440545d53c3688c5ee61917e5bdcab2f47dc8a0ff5411b8a3d898e4b45a17607f90

Download Submit
/root/.mozilla/firefox/Crash Reports/InstallTime20230522134052

Filesize
10B

MD5
0529788f9a315e63d5c9fad1ed4676c8

SHA1
c7ffc06adcba498f153db02ecb5803ecad13764f

SHA256
c221fc947726dec4a5c992491a46964da748ab4dcbbe13df6348d93920e1a386

SHA512
26dbfaa124839f4ed0b2a806ad28f01e8edac71ed374ff23024d635617439afe0eff8c2bc4d4e2e01103eb485576bfd4fc399ef59feee829b124e643d62d626a

Download Submit
/root/.mozilla/firefox/fznj3xoi.default-release/cert9.db

Filesize
224KB

MD5
a71f2e90a8ed1ba05425b8430b4e7a6d

SHA1
dd12d47a70ee4ba27b83dea74e4209881431d973

SHA256
adc971909d6ec98a78c63eeef6e3364276c4aabda194c9f5e91bcff450592271

SHA512
24bbc4949ee7749f84422257239acea8f768b165e3cc35872910ea6c46f563357c9469232a457c2831f0f0a85e713329b5bd2eb50605712e0150f0dac754ca21

Download Submit
/root/.mozilla/firefox/fznj3xoi.default-release/cert9.db

Filesize
224KB

MD5
b0083951f887a25bc51ccf1ca70952a6

SHA1
0a9c8117e6e9cb7cf1733be0d86ab8191cf01c7b

SHA256
bc025bc79a45cf9b7a199c31723b4c9206eec54180f8b9c268b373604f05df0c

SHA512
d122a70f4c520c802f2e9be2033e452b577f72a2c37bdeeedef40fed32a985660068fb6ed32e41d6bd16d684c90d4317bea73a0ab750e1a1e179f97a0b2b9142

Download Submit
/root/.mozilla/firefox/fznj3xoi.default-release/cert9.db

Filesize
224KB

MD5
be19cee56e6dd920bd476a26f022c28e

SHA1
e1b2e9909eea7640135088116bc3c3448bde796b

SHA256
bdc22197f3d3ab321e9194e3deecc3ab25c249e918d4b5a5d0aa79e522a543c5

SHA512
ca2eb92622115695ae0bc9cb91ece440fbe988f879592145cd3c39111b692c5c5439dd5f468eb77e477085f2929bae5b585d3383cc591c378e09f73a048fd36d

Download Submit
/root/.mozilla/firefox/fznj3xoi.default-release/cert9.db

Filesize
224KB

MD5
4ba12d915613d915991ead911fd21d75

SHA1
184d5d97e106c6011b37adda353ee0303143a99b

SHA256
aebe1c644927ce227d4cc925da09bd214a240d51523e07d7d9e34922f20d390c

SHA512
bb0de0a3ac8153b318b3a949bb4a485e513927062b8f66d97e769bb22a8ae6cca9ecd6f81ec22508ef91f972198e6a562b0fec5efb31edda7e2ab103919310a6

Download Submit
/root/.mozilla/firefox/fznj3xoi.default-release/compatibility.ini

Filesize
163B

MD5
fe452b7294d5928a9a5863b89ee0a6bd

SHA1
a5d4c245071fa96476ba48b4725bdae7f1b7940f

SHA256
d5bfb07561606a19aa96557ea109b175050dc0eb805cbef9c813503587d77900

SHA512
dc37d8507f08849e3382d2dbafd4a64555dbd57a288c95131e9aefb366630f1585811a9e1456b861bb9d2b816ed88b18ffb7580cd92b41bb9b0227ce1363843e

Download Submit
/root/.mozilla/firefox/fznj3xoi.default-release/content-prefs.sqlite

Filesize
224KB

MD5
1fc2e7b7fe2c5be305dfa9a2bbb60771

SHA1
4967389dea050001cb1af3ec799edb7805c3abb8

SHA256
1953edcac737d1ad3de6fbf69671163882fdc0be5bd21d00378d8d8c753c757a

SHA512
fba536378ab9b5f04d92f1029b92d255c7da445a29e2527647bc16e57d02c179de1e78a2de11db1b00cc54c24d3715980c84c0cde103f47c6150f2e7bb8f93d5

Download Submit
/root/.mozilla/firefox/fznj3xoi.default-release/cookies.sqlite

Filesize
96KB

MD5
9535f5fe817accc769c2c1d3354db39f

SHA1
6af62cf08717cf3bfa84eb1a7b311acf522ce560

SHA256
c53c15fcfac2bb57fdc88d23f932fc244dbaf4020f0f6eaecf0f77a37c21f8c5

SHA512
dc9c2c32eb42dda0a7a711e143aea58c603c1e9d885c3677e9fe86f525e1b0b32a46e240756263e56510b07e764ba69f2de13b90ec18210678242e10cfe17837

Download Submit
/root/.mozilla/firefox/fznj3xoi.default-release/cookies.sqlite

Filesize
96KB

MD5
5caa766855d5613a999f71b7812d6451

SHA1
ad0d9a52a0d5cc7f11858301dbe47377ed99ee37

SHA256
3a8ce2b07e3e8678a13aa58ef5b942c4dccd8f9c84511bdeb8847ef270797e27

SHA512
17bb0f4c87ec178910795b25ce85e74cf599190c769592472c3e872f42930c93f28faf0ff3e448816a9abcc8af0459852bed52bee08cfe25d068879c6dfd8eba

Download Submit
/root/.mozilla/firefox/fznj3xoi.default-release/favicons.sqlite

Filesize
224KB

MD5
3c0a1ec298284608bfa51081ea539be3

SHA1
e51b58f6fe89d45fd8a1d935b51da172d5f6f32e

SHA256
34c4fe7ab2d3e44f193b489ebe84c17d67b336546af9ef231897ec09d7ff16f2

SHA512
8550f530377f7a98c46a6989bec2c43ed644274509a5b987e8e0d034bf867b3315dcc75a2c851a5ac43a45b40bf51c789d828a9a69c02157b3e900467341a28f

Download Submit
/root/.mozilla/firefox/fznj3xoi.default-release/key4.db

Filesize
288KB

MD5
f9feddf2c0b6aab20cf05de996bec002

SHA1
42921db586f47cd3e5b4e788b1d68a5573f5aa0f

SHA256
c4d64d64ae94303198b32217b511fef02c61c83f3378247ec81e1a9435502e06

SHA512
a017fdf54688556a42842ac8e4d4a543df7d2e0a1e32725e199b67d98190bda9eb63a7307c6f7260686f33176afb0e5f16ecd4bf932ed22e249e6346b17338af

Download Submit
/root/.mozilla/firefox/fznj3xoi.default-release/permissions.sqlite

Filesize
96KB

MD5
af672a70bf700c2bb8860e8dc0bfc9a7

SHA1
fffaecfcb96d27e4e3ab5f8984707edc6145b6a7

SHA256
dca146a9ffb2aa82b67f169c250b72cfb95894b48f98adfb8cc407015abeb4d1

SHA512
f1f69d9ecfd12f7939997985b56bfdc0e5bb32b8300ac17e9f7400fd68b2f4f1766083659f9d8fc7f3a7041d8a5390e97d1aad084e8c3f20694171a5501c8969

Download Submit
/root/.mozilla/firefox/fznj3xoi.default-release/places.sqlite

Filesize
1.3MB

MD5
e8d97d401005feb44347d7550ed4ff08

SHA1
76a785757e74ccbc0c7a69aadcefbbb337192eef

SHA256
c135309b4479da0cd28525d127623650ddbc3f69da77218df3b187dcee7e7c4b

SHA512
8dbf363e106d9f620596b5c9753c2b8d9f9111a1fddc706553120a30f1138f58c1d3a55cec99b1ee13f18b990b6e8b6339433bbea57b315f48e5e6ae2592ebe2

Download Submit
/root/.mozilla/firefox/fznj3xoi.default-release/prefs-1.js

Filesize
2KB

MD5
cf9d62c44cfe3e1528d4fc0ec5843d63

SHA1
a9b4ba8fa6d2d7dd604abfaf3dd4f603f365b838

SHA256
1a19840bb2a4a2f7321f501df36eb68f707590cd33aab1f4578de55e1d584805

SHA512
c6fb099577a924bf70f30d60bc40d48240a3d1742535de9f1f269c5b7252d5011c2bdf90211446a98a5e33e36be28fdb9fc0e7e40042f6b4d6241bba3065d9fc

Download Submit
/root/.mozilla/firefox/fznj3xoi.default-release/prefs-1.js

Filesize
2KB

MD5
3b713c15b66af4470d6e4a4c92eb9981

SHA1
4ed83c4a45dd89f88728b880e9f30abd4e787405

SHA256
8cdedbc33dfd43352cd3e050213afbb87ec09663902cd55d6b148f4c202b6eda

SHA512
8be8b537c7bafb2a1bc96f94278c99cc75eb6e6d65f194a675281974ee11fb215e2001561a7f3497c29ed821ad378b193700a88c227d3dc7aea105f2ff1e9497

Download Submit
/root/.mozilla/firefox/fznj3xoi.default-release/prefs-1.js

Filesize
3KB

MD5
98d744f694fef618f64796d166ee1950

SHA1
7219a490e26bb23aebfd6b2c2fc502ab2a6ca529

SHA256
e2c197f5f5960bb5d9c38e8e569d18a4b20724658cc3b6e790b8147481064a4f

SHA512
819249364394832dc05481448572d9ebc11b17e5985a036507b8a987f26399dd5177b810163d71220ead2125d55b90ca3960df28ffa56268438ff5965b6fb636

Download Submit
/root/.mozilla/firefox/fznj3xoi.default-release/prefs-1.js

Filesize
4KB

MD5
8717568ece1baa9c628d3137106b4c38

SHA1
72523b7a3f41e7e705c3dcd8bd56c506944bbaa6

SHA256
4e5602729d50e9b08f8b98acd082d50206f37f0206d9e75cc16eb0a55c81721c

SHA512
e6f6e072a0813e6007fb8261ae8655411eb967197abe964e0f4bda5dd857b7925b56307374b93ed4a9540cb30276d04e0f667e6e9b1aca784ba558fe5c31af30

Download Submit
/root/.mozilla/firefox/fznj3xoi.default-release/prefs.js

Filesize
1KB

MD5
f50de5666b289a576f0132f01c25fc42

SHA1
caedce32929ad56e5397066426dba540733b2ee5

SHA256
9c7386b782de6fe6ae97f729a15e9af3c889d20d12c97390d480902e877acbcb

SHA512
d8b6dd75bbaec824b89ded0f364e06eaf1f7a895f1c33ca19cbb43e6058d33ec4935eb66a183f19e322e2e947dabb4c08462787506d2a9b8d76c3e9b294bd05e

Download Submit
/root/.mozilla/firefox/fznj3xoi.default-release/protections.sqlite

Filesize
64KB

MD5
c7cc11494c34e02565df83d17beb33b3

SHA1
f379ad7c0fa73476d3828d8a89ef843046332c12

SHA256
7ca17bb171e22b4ec498c1d20587b30d62d773b114d0e66bb00ec874506eb85f

SHA512
0cfcb15a985a35e917c9652721b516e2d1c358c6db3dca4452e866d250b6269c4cc69773277f5ddd5a0c5a338f95d9f6134224f0097df194985161cd3d47cfd6

Download Submit
/root/.mozilla/firefox/fznj3xoi.default-release/storage/ls-archive.sqlite

Filesize
96KB

MD5
e0c613bfd69956a19ce2dc5e925aa223

SHA1
14accb230edcd6cb76967cdc6d4e5686db96b5df

SHA256
0d4cb11f6364c46a75f9eaddfca5c660b90dfd515df3afcd5e0baeca28a0f1ab

SHA512
01643c0131a392be92b3f281d7f633c1f502bff19090b0d716f1ac66aefecc3fcf92f393bef66b03089c9b9c6d8aaeb711b6a4f29d5a6729dd188c838f2272d1

Download Submit
/root/.mozilla/firefox/fznj3xoi.default-release/storage/ls-archive.sqlite

Filesize
128KB

MD5
178d71e5529d637ac62f7e75fdd75896

SHA1
339f2b949cc4c207b66aea11137448ba28d36dcb

SHA256
7b0050f1bfaab85c8f9067ae7d7369056ff752c0c852ef1462a96c22169004d4

SHA512
ec0e0105fcfbbae356dd55efbcf92975f35bbe5cb93fcabf4c08443e871957635d14830b27c4e1ddefbbaff8f9b7ec3590bf417a9442e1d7ee3607d14d56f664

Download Submit
/root/.mozilla/firefox/fznj3xoi.default-release/storage/permanent/chrome/.metadata-v2-tmp

Filesize
42B

MD5
bc4cf079c8de817827280ba3a0ac24dd

SHA1
537629c72137db7196ce02a6f2cbd96e2212a8d5

SHA256
45d23abe74e0a708dc57c70aeb82add0a47b03e1cad478b2104a557655f186e3

SHA512
eef38fbd6cd2d2c2a7ad53d7f87ad8054100824b2cbd43af8e7e71345f3cc399a97c4d48c2542c548cfd6d0e0ac30778af46142b9b82d72dc14c1d22152abb11

Download Submit
/root/.mozilla/firefox/fznj3xoi.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite

Filesize
44KB

MD5
a8dd7ebaad5528b23f82ccb1534cea18

SHA1
600daceacfb5cf9df0b66ba7dce4516b2ac4df70

SHA256
e5b0d02c18ae36c4a220f41fd97c66060c17aaafcbb324a57ccdc2707c44c4ec

SHA512
67f867a8e2b37fb6bececd5ebc570ca594ea329142badd63d1281d5e735f515a5e329abc6eb9a9d3465aab0a08541b4888018d859964f160a52345ab93532bff

Download Submit
/root/.mozilla/firefox/fznj3xoi.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite

Filesize
12KB

MD5
f616952590c6fa8607c69d22340abbde

SHA1
32b9eb9de398dcfee5cebb4403793401511eb120

SHA256
6af27ef8320300604a1a419561886fdd65db640adc41dbcbaa7077fa24a1c62b

SHA512
5d9d85587b90d3a774ea2bab93c08ceb1a1f500645ded0ddfcbd6ff5651c5c33c268745bd805b922eb1d09731a4b7494815de4daacc9d14d2bd25c5220bcac37

Download Submit
/root/.mozilla/firefox/fznj3xoi.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite

Filesize
44KB

MD5
7352c8848e88edc39b7fb5e663888187

SHA1
8c3dffe25cc56c7aec1b782292d6fceed81e6304

SHA256
7a462086a26978809c719e57a7ea6a25568767fb7532014e8531fda94b660e0a

SHA512
f2a0dbbab5c2c1702b03bce15a47739481f523e127d1372b40534db9a20b2bc99fb53710ee0e5d44176188817cac704cf4f98cdf087e7e89d244281fcfc3b280

Download Submit
/root/.mozilla/firefox/fznj3xoi.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite

Filesize
12KB

MD5
2f88d4d01396160a61b9898c7d3ea52a

SHA1
cef881e691ec9bfa2679d9180818cea43d2050e2

SHA256
33db3481e710f9bb1fe5312303c701808d6004cba08b6fbbbb17755fcc1cc7d3

SHA512
bd0923782cc62b9d22ab3a82751495746c9f154cba2695c7ca01d7f05840dba81afac12a6bec16f4b17d3e3b9c5710d707e75795f17ba7f49dc5c599c486e8c9

Download Submit
/root/.mozilla/firefox/fznj3xoi.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite

Filesize
44KB

MD5
759544297aaa61f5fef8ee42d0ae4393

SHA1
fc2d66f6e60409e3e8d38623ce5f817fc7f571e0

SHA256
1bd2000cd972e80cefaec6e982ba261d224a818f367de0fdf8c51fa5a05d7ab5

SHA512
8aaa2ce66f10d46f7c9200af841ac7bd9f5b55c30308a14f0deda44ac62581c45daae45154487c0073a0d5847d5926cbb4072ca64a702ac6b834ad0bb482804f

Download Submit
/root/.mozilla/firefox/fznj3xoi.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite

Filesize
12KB

MD5
f1afc24de84292b02c655c8583a6bba0

SHA1
3ffde001249f914267a71713b34fd9b1e7dfa44d

SHA256
06894e2a22757afc41970d19e2fe666ea1b7a2f613c67fb25f0f4a7eecc9fbee

SHA512
46978b1a7bc9f5c2fefd684eafef88f010a3e75e96fb7a64774ea02483736abc1dcbb1d98b81758cd2efcf20083119ab96ca4c5dc861fe666435620fb5440dc7

Download Submit
/root/.mozilla/firefox/fznj3xoi.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite

Filesize
16KB

MD5
fa8a7b5e6ce741f94e4c4b355de68c0b

SHA1
40d2b68fd90d51d8d1df55b6f6a53855c0880904

SHA256
0c31c8097630615e2275938ca87416f8dfb92e0113b163118be467d8dc3e73ef

SHA512
7610504aa67413aa367e6c9b8ec3180cf0efa9b1b72e00c50ebe4e711d31709617ed0ae6bf3826860a50f2862383dbab36f1ee6d7773a97e1662bf4423f8afaa

Download Submit
/root/.mozilla/firefox/fznj3xoi.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
44KB

MD5
07a412e08825220262ad2890757ff779

SHA1
f46c127dbc070ded87a6078b3c1c761955f96de8

SHA256
da640f8b665841b520d2262a21cc3f82aeaa881cf81a1ddae27ef501d66544e4

SHA512
0134c783bf3293848e479b478ac57a1e0f4202cddfb8b57bc6275aada7345f398cf8a627e9b1c34fd618192c2f0c9737b1da487daf33f9c557ebc1377105582b

Download Submit
/root/.mozilla/firefox/fznj3xoi.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
12KB

MD5
254abe692f6be34943da98d8702cb5ae

SHA1
92efd47d931c7de5f3b7bbcc9db6d065534daa94

SHA256
03e7c646bc2e947a041270d6d203feebc76c742b5a4243cf51e945ea5b41d238

SHA512
41fa8948e05e6014e1f0d7e130cd6f3b85a4569352a30a6e14bce162b635085634aad6bc3d87d498a7003f41d83460de33b696a748ae4e7579eee9b146e22341

Download Submit
/root/.mozilla/firefox/fznj3xoi.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
164KB

MD5
59ad8de86805516e028af943967420fb

SHA1
1bce8741eea6b5634c8813106b927e4db4c79f12

SHA256
6cbbd330da56cc28b57676184ee1894656ee1ffc4405cb8878ba1dbb81b679a8

SHA512
63b6ec788c688ffc5573b47766a7e1bb2a0467976d790be802563b42af35a4b9aa4dafc536bad9afbf3b032c8e348738178d021cd3a2067849940773ac3a180d

Download Submit
/root/.mozilla/firefox/fznj3xoi.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
148KB

MD5
dd3f6ba37c670af5953593535e435d04

SHA1
ecfe4e650a050bce77e8ff7468de04c1b8acc9a4

SHA256
5cc6fa137a1f3a7d0b615b178877f12c460b22f95702eb7534d5732ee6599561

SHA512
86e0482543faae6fb279ca71e1e6d6461d32317e74baebb3973e0fde9800107faeb9c2347be6cf8a47556ae43c8e6c224a595e952f621e40ad2c5eba920df2b3

Download Submit
/root/.mozilla/firefox/fznj3xoi.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
168KB

MD5
e87498f20e6ffb24c100b389c9186fd6

SHA1
919ac3ffd22845e2ed3bf53ff974ab495d0a7c73

SHA256
98fb2b81377690e84819f72cb58f02505856485830b2bb98c5f1e3b4804013d0

SHA512
706619b456d5beba0308ca27ff3e011c844aea05ad99ae3a572748c8dbb20e9992be624609ca1cb56ff82f29181c9b1e95b9ce7032601db4c24d2e13e5d454e7

Download Submit
/root/.mozilla/firefox/fznj3xoi.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
232KB

MD5
acf01119af3ee0d161b6e1049e26f195

SHA1
8bc33819ec10dae13e2ff134ad511eab20b6c1cd

SHA256
e1998c974705b8d904597e177b52c35f5d66b635fe71441941000bc7cfc675f2

SHA512
cb015e43fb40912970f77491b51c56099fb889e4eea4920e758081e207589a13c7c65ef556735ad7ca5fd90fef9ed3e86907f7f12570d07f8fc83f313fbef2dc

Download Submit
/root/.mozilla/firefox/fznj3xoi.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
252KB

MD5
56e7a9a20990b1ce4dfed4c13066be9a

SHA1
0e3ef0f1eb524ed438abd2b4af4d346c317ed6f4

SHA256
e7962ecd81e45e341a2faa802a1165735bae352102aa4ffb7ac584555d602632

SHA512
e987dbcac52e6175f581543b94823e51effb4eaf795a94d83b54f457f63083f0c8adfff1ab749e30b71ef7bcc6b807c465a039e5980e2019e772968807164475

Download Submit
/root/.mozilla/firefox/fznj3xoi.default-release/times.json

Filesize
50B

MD5
31192deeae5b817f1009ea91c80e804e

SHA1
585fa9370263924a5bd6da124ee5915a95e7bdd8

SHA256
291ef63672f4580b30bd61090ed8497578ffa1bb8559aacfdc70e10932354350

SHA512
98175eb283c46a517f51ba4749a27f2c38c11756bcf28ec623eb51064c2d2e0c0a80d9959ab4beb9c7545ca59fceebf74b59e2526ffe14a6d864add135b9a440

Download Submit
/root/.mozilla/firefox/fznj3xoi.default-release/times.json

Filesize
47B

MD5
28506895eceabf0cc4510312edd0f4e6

SHA1
6822ec30ed77d21f7e2f86ac7b673afbae427b3d

SHA256
ac4d2b8609e895837ba8e2c640051c09ff97e76acd3153f01f2d278027f0c131

SHA512
7d2586a7b65af5194944f3e3f855df23fb8410816e4d14e3317a3ce2b2d8abf94f14932e7aea0aa8d6f31ddd11bf976ce3b4c7cd12166870fd5d6c551a72f2cc

Download Submit
/root/.mozilla/firefox/installs.ini

Filesize
62B

MD5
114e2078a3cb72af5f2c646dfa1458fe

SHA1
9c5391d095c6763e835a55c30048645a3cba6b50

SHA256
5e051ee561548feec3f8c8b857ee953801548a3518f0420e239ca45e06d0c5cb

SHA512
277908878f50b726d4696ab8d88586a7652f3e2fc769fe2688042265faeb5a1eb3b3c06b30267549614ad85872c02ac70a96c308cc9a02af8babbeb499970f34

Download Submit
/root/.mozilla/firefox/profiles.ini

Filesize
259B

MD5
9c250023ac644e3096f3c2e9144a3e71

SHA1
5a979780abc2eedfc9e25ff5837c445a645fe545

SHA256
b935c6ef14b748f9fe5a69a77be370df4279dc7c8a7d834d2c698e55d4c5d488

SHA512
d8ff5366bc548ddd9640d566fa01f81c4f15d103079318316f3e7d50bc8f33e869504e6df71abda33f00d7edc4ff782cd1b9ce28203947ebd2e94005c1458378

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads