hxxps://www[.]kinitopet[.]com

Analysis

max time kernel
99s
max time network
111s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240226-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
18-04-2024 13:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.kinitopet.com

Score

7^/10

antivm spyware stealer

Malware Config

Signatures

Changes its process name 64 IoCs

Processes:

firefox

description	ioc	pid
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1662
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1662
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1662
Changes the process name, possibly in an attempt to hide itself	glean.dispatche	1661
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1665
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1667
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1666
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1667
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1665
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1666
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1664
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1664
Changes the process name, possibly in an attempt to hide itself	Timer	1663
Changes the process name, possibly in an attempt to hide itself	Timer	1663
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1668
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1668
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1670
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1670
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1672
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1672
Changes the process name, possibly in an attempt to hide itself	Cache2 I/O	1673
Changes the process name, possibly in an attempt to hide itself	Cookie	1674
Changes the process name, possibly in an attempt to hide itself	Cookie	1674
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1675
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1675
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #1	1677
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #0	1676
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1678
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1678
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	1679
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	1679
Changes the process name, possibly in an attempt to hide itself	IPC Launch	1699
Changes the process name, possibly in an attempt to hide itself	IPC Launch	1699
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	1698
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	1698
Changes the process name, possibly in an attempt to hide itself	Breakpad Server	1697
Changes the process name, possibly in an attempt to hide itself	Sandbox Forked	1700
Changes the process name, possibly in an attempt to hide itself	Chroot Helper	1701
Changes the process name, possibly in an attempt to hide itself	MainThread	1700	firefox
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1703
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1703
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1703
Changes the process name, possibly in an attempt to hide itself	Socket Process	1700	firefox
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1705
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1705
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1704
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1704
Changes the process name, possibly in an attempt to hide itself	Timer	1706
Changes the process name, possibly in an attempt to hide itself	Timer	1706
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	1707
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	1707
Changes the process name, possibly in an attempt to hide itself	dconf worker	1708
Changes the process name, possibly in an attempt to hide itself	gmain	1709
Changes the process name, possibly in an attempt to hide itself	ProfilerChild	1712
Changes the process name, possibly in an attempt to hide itself	ProfilerChild	1712
Changes the process name, possibly in an attempt to hide itself	FSBroker1700	1711
Changes the process name, possibly in an attempt to hide itself	FSBroker1700	1711
Changes the process name, possibly in an attempt to hide itself	DNS Resolver #1	1714
Changes the process name, possibly in an attempt to hide itself	DNS Resolver #1	1714
Changes the process name, possibly in an attempt to hide itself	TRR Background	1713
Changes the process name, possibly in an attempt to hide itself	TRR Background	1713
Changes the process name, possibly in an attempt to hide itself	gdbus	1715
Changes the process name, possibly in an attempt to hide itself	DNS Resolver #3	1717
Changes the process name, possibly in an attempt to hide itself	DNS Resolver #3	1717

Reads user data of web browsers 56 IoCs

Reads stored browser data which can include saved credentials.

spyware stealer

Processes:

firefox

description	ioc
File opened for reading	/root/.mozilla/firefox/00yfqa4o.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite
File opened for reading	/root/.mozilla/firefox/00yfqa4o.default-release/AlternateServices.txt
File opened for reading	/root/.mozilla/firefox/00yfqa4o.default-release/sessionstore.jsonlz4
File opened for reading	/root/.mozilla/firefox/00yfqa4o.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite-journal
File opened for reading	/root/.mozilla/firefox/00yfqa4o.default-release/content-prefs.sqlite-journal
File opened for reading	/root/.mozilla/firefox/00yfqa4o.default-release/extensions.json
File opened for reading	/root/.mozilla/firefox/00yfqa4o.default-release/cookies.sqlite	firefox
File opened for reading	/root/.mozilla/firefox/00yfqa4o.default-release	firefox
File opened for reading	/root/.mozilla/firefox/00yfqa4o.default-release/sessionstore.js
File opened for reading	/root/.mozilla/firefox/00yfqa4o.default-release/content-prefs.sqlite
File opened for reading	/root/.mozilla/firefox/00yfqa4o.default-release/compatibility.ini	firefox
File opened for reading	/root/.mozilla/firefox/00yfqa4o.default-release/cookies.sqlite-journal
File opened for reading	/root/.mozilla/firefox/00yfqa4o.default-release/SiteSecurityServiceState.txt
File opened for reading	/root/.mozilla/firefox/00yfqa4o.default-release/ClientAuthRememberList.txt
File opened for reading	/root/.mozilla/firefox/00yfqa4o.default-release/cert9.db-journal
File opened for reading	/root/.mozilla/firefox/00yfqa4o.default-release/system-extensions	firefox
File opened for reading	/root/.mozilla/firefox/00yfqa4o.default-release/extension-preferences.json
File opened for reading	/root/.mozilla/firefox/00yfqa4o.default-release/pkcs11.txt	firefox
File opened for reading	/root/.mozilla/firefox/00yfqa4o.default-release/cert9.db-journal	firefox
File opened for reading	/root/.mozilla/firefox/00yfqa4o.default-release/sessionCheckpoints.json
File opened for reading	/root/.mozilla/firefox/00yfqa4o.default-release/prefs.js	firefox
File opened for reading	/root/.mozilla/firefox/00yfqa4o.default-release/permissions.sqlite-journal
File opened for reading	/root/.mozilla/firefox/00yfqa4o.default-release/key4.db
File opened for reading	/root/.mozilla/firefox/00yfqa4o.default-release/sessionstore-backups/recovery.baklz4
File opened for reading	/root/.mozilla/firefox/00yfqa4o.default-release/key4.db-journal	firefox
File opened for reading	/root/.mozilla/firefox/00yfqa4o.default-release/storage/permanent/chrome/idb
File opened for reading	/root/.mozilla/firefox/00yfqa4o.default-release/permissions.sqlite
File opened for reading	/root/.mozilla/firefox/00yfqa4o.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite-journal
File opened for reading	/root/.mozilla/firefox/00yfqa4o.default-release/sessionstore-backups/recovery.jsonlz4
File opened for reading	/root/.mozilla/firefox/00yfqa4o.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite
File opened for reading	/root/.mozilla/firefox/00yfqa4o.default-release
File opened for reading	/root/.mozilla/firefox/00yfqa4o.default-release/storage/ls-archive.sqlite-journal
File opened for reading	/root/.mozilla/firefox/00yfqa4o.default-release/key4.db	firefox
File opened for reading	/root/.mozilla/firefox/00yfqa4o.default-release/cookies.sqlite
File opened for reading	/root/.mozilla/firefox/00yfqa4o.default-release/storage/ls-archive.sqlite
File opened for reading	/root/.mozilla/firefox/00yfqa4o.default-release/storage
File opened for reading	/root/.mozilla/firefox/00yfqa4o.default-release/extensions	firefox
File opened for reading	/root/.mozilla/firefox/00yfqa4o.default-release/sessionstore-backups/previous.jsonlz4
File opened for reading	/root/.mozilla/firefox/00yfqa4o.default-release/sessionstore-backups/recovery.bak
File opened for reading	/root/.mozilla/firefox/00yfqa4o.default-release/xulstore.json	firefox
File opened for reading	/root/.mozilla/firefox/00yfqa4o.default-release/addonStartup.json.lz4	firefox
File opened for reading	/root/.mozilla/firefox/00yfqa4o.default-release/cert9.db	firefox
File opened for reading	/root/.mozilla/firefox/00yfqa4o.default-release/handlers.json	firefox
File opened for reading	/root/.mozilla/firefox/00yfqa4o.default-release/cert9.db
File opened for reading	/root/.mozilla/firefox/00yfqa4o.default-release/storage.sqlite
File opened for reading	/root/.mozilla/firefox/00yfqa4o.default-release/cookies.sqlite-journal	firefox
File opened for reading	/root/.mozilla/firefox/00yfqa4o.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite-wal
File opened for reading	/root/.mozilla/firefox/00yfqa4o.default-release/times.json
File opened for reading	/root/.mozilla/firefox/00yfqa4o.default-release/search.json.mozlz4
File opened for reading	/root/.mozilla/firefox/00yfqa4o.default-release/user.js	firefox
File opened for reading	/root/.mozilla/firefox/00yfqa4o.default-release/storage.sqlite-journal
File opened for reading	/root/.mozilla/firefox/00yfqa4o.default-release/addons.json
File opened for reading	/root/.mozilla/firefox/00yfqa4o.default-release/sessionstore-backups/previous.js
File opened for reading	/root/.mozilla/firefox/00yfqa4o.default-release/storage/permanent/chrome
File opened for reading	/root/.mozilla/firefox/00yfqa4o.default-release/cert_override.txt	firefox
File opened for reading	/root/.mozilla/firefox/00yfqa4o.default-release/sessionstore-backups/recovery.js

Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
antivm

Virtualization/Sandbox Evasion
T1497

Processes:

description ioc

File opened for reading /proc/cpuinfo

description	ioc
File opened for reading	/proc/cpuinfo

Reads CPU attributes 1 TTPs 11 IoCs

System Information Discovery

T1082

Processes:

firefoxfirefoxfirefoxfirefoxfirefoxfirefox

description	ioc
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/size
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/online
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/size
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
File opened for reading	/sys/devices/system/cpu/present
File opened for reading	/sys/devices/system/cpu/present	firefox

Enumerates kernel/hardware configuration 1 TTPs 60 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

Processes:

firefoxfirefoxfirefoxdbus-daemonfirefoxfirefoxfirefox

description	ioc
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/device
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/resource
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/resource
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/irq
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/device
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/resource
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/vendor
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/vendor
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_vendor
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/class
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/resource
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/class
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/device
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/vendor
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_device
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/resource
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/class
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/irq
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/vendor
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/vendor
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/device
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/irq
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/irq
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/class
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/irq
File opened for reading	/sys/kernel/security/apparmor/features/dbus/mask	dbus-daemon
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/irq
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/resource
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/class
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/vendor
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/device
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/class
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/device
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/irq
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/resource
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/vendor
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/uevent
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/vendor
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/device
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/resource
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/class
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/irq
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/vendor
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/device
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/class
File opened for reading	/sys/devices/system/cpu
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/irq
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/device
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/vendor
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/class
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/resource
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/device

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

gvfsdfirefoxsedfirefoxfirefoxxdg-document-portalfirefoxxdg-desktop-portalfirefoxsedfirefoxsedsedxdg-permission-storedbus-daemonsed

description	ioc
File opened for reading	/proc/1573/attr/current
File opened for reading	/proc/1735/cmdline
File opened for reading	/proc/filesystems	gvfsd
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/sys/kernel/cap_last_cap
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/1655/cmdline
File opened for reading	/proc/self/task/1702/stat
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/1739/cmdline
File opened for reading	/proc/1750/cmdline
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/stat
File opened for reading	/proc/self/fd/34	firefox
File opened for reading	/proc/self/fd/39	firefox
File opened for reading	/proc/filesystems	xdg-document-portal
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/task/1831/stat
File opened for reading	/proc/self/fd/29	firefox
File opened for reading	/proc/self/fd/41	firefox
File opened for reading	/proc/self/fd/50	firefox
File opened for reading	/proc/self/fd/38	firefox
File opened for reading	/proc/filesystems	xdg-desktop-portal
File opened for reading	/proc/self/task/1785/stat
File opened for reading	/proc/self/fd/82	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/fd/49	firefox
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/mountinfo
File opened for reading	/proc/self/fd/40	firefox
File opened for reading	/proc/self/fd/43	firefox
File opened for reading	/proc/self/fd/44	firefox
File opened for reading	/proc/self/fd/47	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/fd/6	firefox
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/task/1657/stat
File opened for reading	/proc/self/fd/42	firefox
File opened for reading	/proc/self/fd/45	firefox
File opened for reading	/proc/self/mountinfo	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/task/1808/stat
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/1779/smaps
File opened for reading	/proc/1589/cmdline
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/1754/cmdline
File opened for reading	/proc/self/fd/96	firefox
File opened for reading	/proc/self/task/1849/stat
File opened for reading	/proc/1573/status
File opened for reading	/proc/self/fd/46	firefox
File opened for reading	/proc/self/fd/48	firefox
File opened for reading	/proc/self/fd/35	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/fd/80	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/fd/31	firefox
File opened for reading	/proc/filesystems	xdg-permission-store
File opened for reading	/proc/self/fd/79	firefox
File opened for reading	/proc/1779/statm
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/filesystems	dbus-daemon
File opened for reading	/proc/mounts	dbus-daemon
File opened for reading	/proc/filesystems	sed

Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.

Processes:

firefox

description ioc process

File opened for modification /tmp/firefox/.parentlock firefox

description	ioc	process
File opened for modification	/tmp/firefox/.parentlock	firefox

/usr/bin/xdg-open
xdg-open https://www.kinitopet.com
1⤵
PID:1567

/usr/bin/dbus-send
dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
2⤵
PID:1568

/usr/bin/dbus-launch
dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
3⤵
PID:1569

/bin/grep
grep " = \\\"xfce4\\\"\$"
2⤵
PID:1575

/usr/bin/xprop
xprop -root _DT_SAVE_MODE
2⤵
PID:1574

/bin/grep
grep -i "^xfce_desktop_window"
2⤵
PID:1577

/usr/bin/xprop
xprop -root
2⤵
PID:1576

/bin/grep
grep -q "^Enlightenment"
2⤵
PID:1579

/bin/uname
uname
2⤵
PID:1580

/bin/grep
grep -q "^file://"
2⤵
PID:1582

/bin/egrep
egrep -q "^[[:alpha:]+\\.\\-]+:"
2⤵
PID:1584

/usr/local/sbin/grep
grep -E -q "^[[:alpha:]+\\.\\-]+:"
2⤵
PID:1584

/usr/local/bin/grep
grep -E -q "^[[:alpha:]+\\.\\-]+:"
2⤵
PID:1584

/usr/sbin/grep
grep -E -q "^[[:alpha:]+\\.\\-]+:"
2⤵
PID:1584

/usr/bin/grep
grep -E -q "^[[:alpha:]+\\.\\-]+:"
2⤵
PID:1584

/sbin/grep
grep -E -q "^[[:alpha:]+\\.\\-]+:"
2⤵
PID:1584

/bin/grep
grep -E -q "^[[:alpha:]+\\.\\-]+:"
2⤵
PID:1584

/usr/bin/xdg-mime
xdg-mime query default x-scheme-handler/https
2⤵
PID:1588

/usr/bin/dbus-send
dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
3⤵
PID:1589

/usr/bin/dbus-launch
dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
4⤵
PID:1590

/bin/grep
grep " = \\\"xfce4\\\"\$"
3⤵
PID:1592

/usr/bin/xprop
xprop -root _DT_SAVE_MODE
3⤵
PID:1591

/bin/grep
grep -i "^xfce_desktop_window"
3⤵
PID:1594

/usr/bin/xprop
xprop -root
3⤵
PID:1593

/bin/grep
grep -q "^Enlightenment"
3⤵
PID:1596

/bin/uname
uname
3⤵
PID:1600

/usr/bin/which
which firefox
2⤵
PID:1643

/usr/bin/firefox
/usr/bin/firefox https://www.kinitopet.com
2⤵
PID:1655

/usr/bin/which
which /usr/bin/firefox
3⤵
PID:1656

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox https://www.kinitopet.com
2⤵
- Reads user data of web browsers
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
PID:1655

/usr/bin/dbus-launch
dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
3⤵
PID:1660

/usr/bin/dbus-daemon
/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1571

/bin/sed
sed -n "s/\$^[[:alnum:]+\\.-]*\$:.*\$/\\1/p"
1⤵
- Reads runtime system information
PID:1587

/bin/sed
sed "s/:/ /g"
1⤵
- Reads runtime system information
PID:1603

/usr/bin/head
head -n 1
1⤵
PID:1606

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1607

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1608

/bin/grep
grep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
1⤵
PID:1605

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1613

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1612

/usr/bin/head
head -n 1
1⤵
PID:1611

/bin/grep
grep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
1⤵
PID:1610

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1618

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1617

/usr/bin/head
head -n 1
1⤵
PID:1616

/bin/grep
grep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
1⤵
PID:1615

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1623

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1622

/usr/bin/head
head -n 1
1⤵
PID:1621

/bin/grep
grep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
1⤵
PID:1620

/usr/bin/cut
cut -d ";" -f 1
1⤵
PID:1628

/usr/bin/cut
cut -d "=" -f 2
1⤵
PID:1627

/usr/bin/head
head -n 1
1⤵
PID:1626

/bin/grep
grep "x-scheme-handler/https=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache
1⤵
PID:1625

/bin/sed
sed "s/:/ /g"
1⤵
- Reads runtime system information
PID:1631

/bin/sed
sed -e "s|-|/|"
1⤵
- Reads runtime system information
PID:1634

/bin/sed
sed -e "s|-|/|"
1⤵
- Reads runtime system information
PID:1637

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1642

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1646

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1649

/usr/bin/cut
cut "-d=" -f 2-
1⤵
PID:1654

/usr/bin/lsb_release
/usr/bin/lsb_release -idrc
1⤵
PID:1671

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -parentBuildID 20230522134052 -prefsLen 19257 -prefMapSize 230809 -appDir /usr/lib/firefox/browser "{bc29a24a-173c-4c51-a329-5d4880b95868}" 1655 true socket
1⤵
- Changes its process name
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1700

/usr/local/sbin/dbus-launch
dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
1⤵
PID:1710

/usr/local/bin/dbus-launch
dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
1⤵
PID:1710

/usr/sbin/dbus-launch
dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
1⤵
PID:1710

/usr/bin/dbus-launch
dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
1⤵
PID:1710

/usr/libexec/xdg-desktop-portal
/usr/libexec/xdg-desktop-portal
1⤵
- Reads runtime system information
PID:1730

/usr/libexec/xdg-document-portal
/usr/libexec/xdg-document-portal
1⤵
- Reads runtime system information
PID:1735

/usr/libexec/xdg-permission-store
/usr/libexec/xdg-permission-store
1⤵
- Reads runtime system information
PID:1739

/usr/libexec/xdg-desktop-portal-gtk
/usr/libexec/xdg-desktop-portal-gtk
1⤵
PID:1750

/usr/lib/gvfs/gvfsd
/usr/lib/gvfs/gvfsd
1⤵
- Reads runtime system information
PID:1754

/usr/lib/gvfs/gvfsd-fuse
/usr/lib/gvfs/gvfsd-fuse /root/.gvfs -f -o big_writes
1⤵
PID:1759

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 21684 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{d0971fa5-c327-41a4-a441-29eccfa7bd8e}" 1655 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1779

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 2 -isForBrowser -prefsLen 21352 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{10bc4515-991f-4ba3-8995-abadd34716da}" 1655 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1801

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 3 -isForBrowser -prefsLen 21701 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{fa04a668-2968-42bd-a779-ec659619522e}" 1655 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1828

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox -contentproc -childID 4 -isForBrowser -prefsLen 27758 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{092a303c-b85d-47be-bbfc-ca2c3916c79e}" 1655 true tab
1⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1845

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

/root/.cache/dconf/user
Filesize
2B

MD5
a885273c8732bd3ba5dbed43bc254411

SHA1
852e83bba4675ebebf92e4ecdefca6efe9fa9712

SHA256
8c0e4ed1d0667f60c52c3cdc43e01aec868b140e8c3485e2aada52b5e40859fc

SHA512
e4085ac3c32c3484be3061a78b480ffcad18ef6bdddf1d95147664055b849b07a9a901edc024fe41ca8fc01134ddee1f37d74b54de48b03c1cfd327045d51b1d

Download Submit
/root/.dbus/session-bus/11c67417355f45d397f6be11f62e85a6-0
Filesize
466B

MD5
d9838e57c691abdc0ceaed0611484086

SHA1
36143a561ce80731f1c292dd2222ed103acabbd2

SHA256
5a5867e0190813aebcc40d64f1de44d69ec106d4e87179c9073189ab887b5b95

SHA512
b8fafd1c0e3cb222fa193b03a644394cc430c0b72c4776ce4b92c2ece2116d316264491c87dbea97a9a0620268ed9fdee05dc790659dabd0e07ddfae203de587

Download Submit
/root/.mozilla/firefox/00yfqa4o.default-release/cert9.db
Filesize
224KB

MD5
3cb9773be6d81859a41fdcb18f628d99

SHA1
76a986c20052b6a9bb8ca49380aa2315192efd95

SHA256
09dc5906db9aa2245db97925bd4f645301523f311b7366fcfd3386bb15bc4507

SHA512
5d9b104300d55638eb4dbee85768cc7aef442ceec3b833caf23bdbbb5738837c9151f54bbbffca2c24df750ded6bd62a7b05c63e6adc05bcf9e0472d6e473d07

Download Submit
/root/.mozilla/firefox/00yfqa4o.default-release/compatibility.ini
Filesize
163B

MD5
fe452b7294d5928a9a5863b89ee0a6bd

SHA1
a5d4c245071fa96476ba48b4725bdae7f1b7940f

SHA256
d5bfb07561606a19aa96557ea109b175050dc0eb805cbef9c813503587d77900

SHA512
dc37d8507f08849e3382d2dbafd4a64555dbd57a288c95131e9aefb366630f1585811a9e1456b861bb9d2b816ed88b18ffb7580cd92b41bb9b0227ce1363843e

Download Submit
/root/.mozilla/firefox/00yfqa4o.default-release/cookies.sqlite
Filesize
96KB

MD5
9535f5fe817accc769c2c1d3354db39f

SHA1
6af62cf08717cf3bfa84eb1a7b311acf522ce560

SHA256
c53c15fcfac2bb57fdc88d23f932fc244dbaf4020f0f6eaecf0f77a37c21f8c5

SHA512
dc9c2c32eb42dda0a7a711e143aea58c603c1e9d885c3677e9fe86f525e1b0b32a46e240756263e56510b07e764ba69f2de13b90ec18210678242e10cfe17837

Download Submit
/root/.mozilla/firefox/00yfqa4o.default-release/cookies.sqlite
Filesize
96KB

MD5
5caa766855d5613a999f71b7812d6451

SHA1
ad0d9a52a0d5cc7f11858301dbe47377ed99ee37

SHA256
3a8ce2b07e3e8678a13aa58ef5b942c4dccd8f9c84511bdeb8847ef270797e27

SHA512
17bb0f4c87ec178910795b25ce85e74cf599190c769592472c3e872f42930c93f28faf0ff3e448816a9abcc8af0459852bed52bee08cfe25d068879c6dfd8eba

Download Submit
/root/.mozilla/firefox/00yfqa4o.default-release/key4.db
Filesize
288KB

MD5
96b8093750877844911ea85673b9b07f

SHA1
5620b1a4e46766421170bed2da72ab0361da7c27

SHA256
50094fe156430710ac2541f14bcd0216b9fe0f2846872e91db907ad17675e2a3

SHA512
891c05c874be897a13b165952d1aa7de0fe2b31e81ed55dedeb215730bd859a06c4e22eea8d90f3ed02ccd1d326a975d20becf8c2c52f3ae8cdaf4885cf184d2

Download Submit
/root/.mozilla/firefox/00yfqa4o.default-release/permissions.sqlite
Filesize
96KB

MD5
232fbc22dd03a8ec41edde02bdbea61c

SHA1
6ab4b39bca95418c52f7f861fd39e5fddb9cc7b6

SHA256
d88bf367aaf79efbb2e8fbdb1dc5bde1c1c3a53e0f4d8188027a63ec55d5f5f0

SHA512
055f1595f4a327347671db53cec8d89a310109d3f871c567e3d5b654b956fc0369d12437f7dc6d9327b973008f1327ee0dfdb5504f1b3cbe00da29941b1e5892

Download Submit
/root/.mozilla/firefox/00yfqa4o.default-release/prefs-1.js
Filesize
1KB

MD5
2285b28d74c331340a5e395c8534aa22

SHA1
540e8d7321015ae9e5898950e9d53b2e7f5f9b81

SHA256
3fe8045415c4f06510fab9d5e26680c432a20e07637463cd7a6eeea2c4cf740f

SHA512
59e2cb3b106b0b037b6ad1f5ff1a77a159d9ec3093dc0f1c91838de9b5928d0c25e110fc728c3332e11f9370de45df3d228bd01a4309ff7dbc77b3ce02aacf31

Download Submit
/root/.mozilla/firefox/00yfqa4o.default-release/prefs-1.js
Filesize
2KB

MD5
1cb10ec2c6e7a1d09ea71bc5b4fa3196

SHA1
7153c26154e6ce63655bfe96f879bccd94d20add

SHA256
e1bd71a931e5cd20ab8789531c22e23f1c80079aae268f10e34114395c0e5083

SHA512
afb45d46d61b17c9b61bbfb3ed26586baed8298fc42a28930ccf9c451cf5b730e8a8df18632ea8b70669f02a3629517a56cf126e354787430b7e67b74948b94c

Download Submit
/root/.mozilla/firefox/00yfqa4o.default-release/prefs-1.js
Filesize
3KB

MD5
d72ff30514752af0ac2ea5e103dde708

SHA1
93eea3cd7dfbabf5c6f929c3f3bc3654327adf5e

SHA256
03fd967e70309d3b9d5fe125ab01cc6987586b5c816c72f25130f10da709b7a0

SHA512
e2c614a6a193d0c14ab2b473f8d2ce05917a123eeb51d99262b9d6db4f4f8096e1a3f162a98e63dfcc6f2e9fa4ce1a2088877aa1a0877b05e56c0cd2bea66d27

Download Submit
/root/.mozilla/firefox/00yfqa4o.default-release/prefs.js
Filesize
1KB

MD5
9360f7a002748bacc3ac1fe0da138ace

SHA1
f3ab9fe222236d13a4d1b927db5be6051f52cc1a

SHA256
c16c3ec822b4ed9d14a854cc80f0803bf4f5b006d5c8aa7232a8aa1c4723ca43

SHA512
8ad1b9059bb83fcba5a0e940a772a5eda2ed9e8d55aec8acd8f4d155afe5a1a77974225ce8f421c15fb60f45b8c855c13b676245ce995febe9122242726ee998

Download Submit
/root/.mozilla/firefox/00yfqa4o.default-release/storage/ls-archive.sqlite
Filesize
96KB

MD5
e0c613bfd69956a19ce2dc5e925aa223

SHA1
14accb230edcd6cb76967cdc6d4e5686db96b5df

SHA256
0d4cb11f6364c46a75f9eaddfca5c660b90dfd515df3afcd5e0baeca28a0f1ab

SHA512
01643c0131a392be92b3f281d7f633c1f502bff19090b0d716f1ac66aefecc3fcf92f393bef66b03089c9b9c6d8aaeb711b6a4f29d5a6729dd188c838f2272d1

Download Submit
/root/.mozilla/firefox/00yfqa4o.default-release/storage/ls-archive.sqlite
Filesize
128KB

MD5
178d71e5529d637ac62f7e75fdd75896

SHA1
339f2b949cc4c207b66aea11137448ba28d36dcb

SHA256
7b0050f1bfaab85c8f9067ae7d7369056ff752c0c852ef1462a96c22169004d4

SHA512
ec0e0105fcfbbae356dd55efbcf92975f35bbe5cb93fcabf4c08443e871957635d14830b27c4e1ddefbbaff8f9b7ec3590bf417a9442e1d7ee3607d14d56f664

Download Submit
/root/.mozilla/firefox/00yfqa4o.default-release/storage/permanent/chrome/.metadata-v2-tmp
Filesize
42B

MD5
fceb4f2ff7d53140ed2494a6872b54a1

SHA1
ee5bc81c5ec6e6748091f23c2b7930505237fe73

SHA256
e2a4665308079e734ae9989bb1bb53ff48d1b8465905cde4883d7a3ba1e1fb26

SHA512
1517c56570354d2fc59a72016c2fe7ded774e5f8057ba55a563b4dbc98d7dcb0b929251d2463979ddf4e02c21792a13e4183763fcdff6a31e11dd3023f044875

Download Submit
/root/.mozilla/firefox/00yfqa4o.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite
Filesize
44KB

MD5
07a412e08825220262ad2890757ff779

SHA1
f46c127dbc070ded87a6078b3c1c761955f96de8

SHA256
da640f8b665841b520d2262a21cc3f82aeaa881cf81a1ddae27ef501d66544e4

SHA512
0134c783bf3293848e479b478ac57a1e0f4202cddfb8b57bc6275aada7345f398cf8a627e9b1c34fd618192c2f0c9737b1da487daf33f9c557ebc1377105582b

Download Submit
/root/.mozilla/firefox/00yfqa4o.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite
Filesize
12KB

MD5
2b741a3325d66de4f177ce0eb030644c

SHA1
c9d459b4ab657c6f31fcc332923dd72230f64677

SHA256
5bb3032c0c7fda7c8153246b1f743777b28f6c28fd4b39ab29949fa58e883d0f

SHA512
6a08f388872203e4cd25dbe9608b5fc9c0cb2085c5e05611d71b6284381454d8aa1a54c7abb92a45ec1bae117fdf6742637ee9f5a41005738ef1d8de9b9a25b0

Download Submit
/root/.mozilla/firefox/00yfqa4o.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite
Filesize
164KB

MD5
2740e90fd6c8cbc3c2eabb43c7da5c56

SHA1
f577fff3598a72faad86b8eeaa0e6a43c4af77af

SHA256
c2d9a1f07df91beb9bb05bb1af53d0456a072b4075ab4ed40a6df986df89046a

SHA512
45e8f3cdc5b6cbaef73204bb9853866f5a16df3f0819e315b231708ad3c42e93a63e5b44b12508759e69093044904f9737a117d1158d1e7fc9fab74424c10c7d

Download Submit
/root/.mozilla/firefox/00yfqa4o.default-release/times.json
Filesize
50B

MD5
031bac755bd552416b655ad55da13e5c

SHA1
ac5443b7fa9359dcef43723be8ad33b4a8e327b5

SHA256
757119d0b7e3597bc1d6511fd4caa742c09029ad138b54dd8a44f72af932ad33

SHA512
4d93a682682a44b56b58ab5ed886ccc264350d59ee53b51b464b914dc3ab11edd6f86a9a34e36eee6cc378f4a21684976570169beebc3e0e3c63e48581918a23

Download Submit
/root/.mozilla/firefox/00yfqa4o.default-release/times.json
Filesize
47B

MD5
946b7cb5ab4c0c971c7d00d69b3e7487

SHA1
0a8ac13d0bdcf944678f1fcc5280467f1f64f81a

SHA256
b75a004bb7e28c8ff617efa754095efed78d8b5bf2b78b7aee5a32bbb3344a5c

SHA512
c211e254938f584b3d78a6f3484e00cc8967305f42df7d5412e512da11c4d1d9b96114df84bba7521c53fe81023d5a24c188357c435432ed3449d64cdd7d8b82

Download Submit
/root/.mozilla/firefox/0vhnh9s4.default/times.json
Filesize
47B

MD5
db2645905154753a852b07f373edb7d0

SHA1
a1c29899ed260bdc87e82d07b9484d5de8e4b75e

SHA256
dafc53ba2f1f66dc64837ba7a2e0b97b82fc03eac95e1585987f4b0298b84299

SHA512
38625aad6e3d222b474f45f7b3d4fc29f1b8132bfd726745389de7a5343613c1b38b39f7cdf771dffbcc3dd19dc1f808ebcd3534fd85ae0bde9f4da76491ccad

Download Submit
/root/.mozilla/firefox/Crash Reports/InstallTime20230522134052
Filesize
10B

MD5
931700f554cfaae928a6e11c3a9d44ad

SHA1
cf946a78b294061703e719f34019147d884dc301

SHA256
86583e7821bedbcae268ec800528291bfa6d3bd96c922015091e82a5c7b3a918

SHA512
97d0662551384964d676728ea166c1ec266bb96bc51286ffe95bd284e8abfe714538ec3a1bb33cda214fc3fb333dc5d5f722b740708b45255f2ed356d7c3d4a1

Download Submit
/root/.mozilla/firefox/installs.ini
Filesize
62B

MD5
c3262ea41c9c2a230cae390004f42446

SHA1
6e230754e0028599fe4ac667a9db61e10e15ed26

SHA256
792ac253db0453d6278569bac8b0c6b90689fe370aab56261ea959ad85bd38cb

SHA512
96c74730e09e4bd2b14944b3d7926d6bd8d228afec0e82d6cc88ac9c9a09ee5081db491ef77d86b5369b1c1547028bf3dbfd523c33d1f5f398680af18d6eaad2

Download Submit
/root/.mozilla/firefox/profiles.ini
Filesize
259B

MD5
c36003411f420e9ad7e177ad7f7535c9

SHA1
0311c031bc948de86a6718297acf20f0e9353df4

SHA256
cd47755db45fe95e69145ca5b180005fc76069091398dd92cfe8fc903d838fb1

SHA512
19687ba29e991e4b6834a853faa392540547e7bbce6a9988a2d07c6376475810e70e80da9e4721991f3769d3dd0d1acc16c7c1493295cea3e99c958953b6835a

Download Submit