hxxps://cdn[.]discordapp[.]com/attachments/1231440804208312402/1231440887524098109/Krampus[.]exe?ex=6636f7b2&is=662482b2&hm=072248e040c57d6f50f4ca9d0edc0521a56014940da22fafd562acef7e2e9afd&

Resubmissions

21/04/2024, 03:24

240421-dx26csaa41 8

21/04/2024, 03:09

240421-dnskkahd76 8

Analysis

max time kernel
9s
max time network
59s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240226-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
21/04/2024, 03:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1231440804208312402/1231440887524098109/Krampus.exe?ex=6636f7b2&is=662482b2&hm=072248e040c57d6f50f4ca9d0edc0521a56014940da22fafd562acef7e2e9afd&

Score

4^/10

antivm

Malware Config

Signatures

Changes its process name 64 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1621	Process not Found
Changes the process name, possibly in an attempt to hide itself	glean.dispatche	1620	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1621	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1621	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1624	Process not Found
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1623	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1622	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1624	Process not Found
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1623	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1625	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1622	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1626	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1625	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1626	Process not Found
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1627	Process not Found
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1627	Process not Found
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1629	Process not Found
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1629	Process not Found
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1631	Process not Found
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1631	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cache2 I/O	1632	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cookie	1633	Process not Found
Changes the process name, possibly in an attempt to hide itself	Cookie	1633	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1634	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1634	Process not Found
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #1	1636	Process not Found
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #0	1635	Process not Found
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1637	Process not Found
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1637	Process not Found
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	1638	Process not Found
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	1638	Process not Found
Changes the process name, possibly in an attempt to hide itself	IndexedDB #1	1639	Process not Found
Changes the process name, possibly in an attempt to hide itself	IndexedDB #1	1639	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC Launch	1642	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC Launch	1642	Process not Found
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	1641	Process not Found
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	1641	Process not Found
Changes the process name, possibly in an attempt to hide itself	Breakpad Server	1640	Process not Found
Changes the process name, possibly in an attempt to hide itself	Sandbox Forked	1643	Process not Found
Changes the process name, possibly in an attempt to hide itself	DOM Worker	1644	Process not Found
Changes the process name, possibly in an attempt to hide itself	DOM Worker	1644	Process not Found
Changes the process name, possibly in an attempt to hide itself	Chroot Helper	1645	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #5	1650	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #5	1650	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #4	1649	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #4	1649	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #3	1648	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #3	1648	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	1647	Process not Found
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	1647	Process not Found
Changes the process name, possibly in an attempt to hide itself	MainThread	1643	firefox
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1651	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1651	Process not Found
Changes the process name, possibly in an attempt to hide itself	IPC I/O Child	1651	Process not Found
Changes the process name, possibly in an attempt to hide itself	FSBroker1643	1652	Process not Found
Changes the process name, possibly in an attempt to hide itself	FSBroker1643	1652	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Process	1643	firefox
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1653	Process not Found
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1653	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1654	Process not Found
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1654	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1656	Process not Found
Changes the process name, possibly in an attempt to hide itself	Timer	1656	Process not Found
Changes the process name, possibly in an attempt to hide itself	ProfilerChild	1655	Process not Found

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened for reading	/proc/cpuinfo	firefox

Reads CPU attributes 1 TTPs 10 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/online	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/size	firefox
File opened for reading	/sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq	firefox
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/size	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox

Enumerates kernel/hardware configuration 1 TTPs 59 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/vendor	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/class	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/vendor	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/irq	firefox
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/uevent	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/irq	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/resource	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/irq	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/class	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/irq	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_vendor	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/vendor	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/device	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/vendor	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/resource	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/resource	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/irq	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/device	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/irq	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/vendor	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/irq	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/vendor	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/device	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/device	firefox
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/class	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/resource	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/irq	firefox
File opened for reading	/sys/bus/pci/devices	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/resource	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/irq	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/resource	firefox
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/vendor	firefox
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/device	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/class	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/vendor	firefox
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_device	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/device	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/resource	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/class	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/device	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/resource	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/class	firefox
File opened for reading	/sys/kernel/security/apparmor/features/dbus/mask	dbus-daemon
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/device	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/vendor	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/vendor	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/class	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/device	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/resource	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/device	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/class	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/class	firefox

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/1526/status	dbus-daemon
File opened for reading	/proc/self/task/1615/stat	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/fd/75	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/task/1788/stat	firefox
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/1613/cmdline	dbus-daemon
File opened for reading	/proc/self/fd/45	firefox
File opened for reading	/proc/self/stat	firefox
File opened for reading	/proc/self/task/1768/stat	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/stat	firefox
File opened for reading	/proc/self/fd	dbus-send
File opened for reading	/proc/self/fd	firefox
File opened for reading	/proc/self/mountinfo	firefox
File opened for reading	/proc/self/fd/44	firefox
File opened for reading	/proc/self/fd/46	firefox
File opened for reading	/proc/filesystems	xdg-document-portal
File opened for reading	/proc/self/stat	firefox
File opened for reading	/proc/self/fd/29	firefox
File opened for reading	/proc/self/fd/42	firefox
File opened for reading	/proc/self/fd/43	firefox
File opened for reading	/proc/1715/statm	firefox
File opened for reading	/proc/self/fd/52	firefox
File opened for reading	/proc/filesystems	dbus-daemon
File opened for reading	/proc/self/fd/50	firefox
File opened for reading	/proc/self/cgroup	firefox
File opened for reading	/proc/self/task/1744/stat	firefox
File opened for reading	/proc/self/fd/111	firefox
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd/36	firefox
File opened for reading	/proc/self/fd/47	firefox
File opened for reading	/proc/1715/smaps	firefox
File opened for reading	/proc/1737/smaps	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/fd	dbus-send
File opened for reading	/proc/1526/attr/current	dbus-daemon
File opened for reading	/proc/self/fd/51	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	xdg-permission-store
File opened for reading	/proc/1686/cmdline	dbus-daemon
File opened for reading	/proc/self/fd/49	firefox
File opened for reading	/proc/self/fd/72	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/1662/cmdline	dbus-daemon
File opened for reading	/proc/1671/cmdline	dbus-daemon
File opened for reading	/proc/filesystems	gvfsd-fuse
File opened for reading	/proc/self/fd/6	firefox
File opened for reading	/proc/1550/cmdline	dbus-daemon
File opened for reading	/proc/self/fd/39	firefox
File opened for reading	/proc/self/stat	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/1737/statm	firefox
File opened for reading	/proc/mounts	dbus-daemon
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd/41	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/1682/cmdline	dbus-daemon
File opened for reading	/proc/filesystems	gvfsd
File opened for reading	/proc/self/fd/40	firefox
File opened for reading	/proc/self/stat	firefox
File opened for reading	/proc/self/task/1719/stat	firefox

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/firefox/.parentlock	firefox

/usr/bin/xdg-open
xdg-open "https://cdn.discordapp.com/attachments/1231440804208312402/1231440887524098109/Krampus.exe?ex=6636f7b2&is=662482b2&hm=072248e040c57d6f50f4ca9d0edc0521a56014940da22fafd562acef7e2e9afd&"
1⤵
PID:1515
- /usr/bin/dbus-send
  dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
  2⤵
  - Reads runtime system information
  PID:1516
- - /usr/bin/dbus-launch
    dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
    3⤵
    PID:1518
  - - /usr/bin/dbus-daemon
      /usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:1522
    - - /usr/libexec/xdg-desktop-portal
        
        /usr/libexec/xdg-desktop-portal
        5⤵
        
        PID:1662
    - - /usr/libexec/xdg-document-portal
        
        /usr/libexec/xdg-document-portal
        5⤵
        Reads runtime system information
        
        PID:1667
    - - /usr/libexec/xdg-permission-store
        
        /usr/libexec/xdg-permission-store
        5⤵
        Reads runtime system information
        
        PID:1671
    - - /usr/libexec/xdg-desktop-portal-gtk
        
        /usr/libexec/xdg-desktop-portal-gtk
        5⤵
        
        PID:1682
    - - /usr/lib/gvfs/gvfsd
        
        /usr/lib/gvfs/gvfsd
        5⤵
        Reads runtime system information
        
        PID:1686
- /usr/bin/xprop
  xprop -root _DT_SAVE_MODE
  2⤵
  PID:1532
- /bin/grep
  grep " = \\\"xfce4\\\"\$"
  2⤵
  PID:1533
- /bin/grep
  grep -i "^xfce_desktop_window"
  2⤵
  PID:1535
- /usr/bin/xprop
  xprop -root
  2⤵
  PID:1534
- /bin/grep
  grep -q "^Enlightenment"
  2⤵
  PID:1540
- /bin/uname
  uname
  2⤵
  PID:1541
- /bin/grep
  grep -q "^file://"
  2⤵
  PID:1543
- /bin/egrep
  egrep -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1545
- /usr/local/sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1545
- /usr/local/bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1545
- /usr/sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1545
- /usr/bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1545
- /sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1545
- /bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1545
- /bin/sed
  sed -n "s/\$^[[:alnum:]+\\.-]*\$:.*\$/\\1/p"
  2⤵
  - Reads runtime system information
  PID:1548
- /usr/bin/xdg-mime
  xdg-mime query default x-scheme-handler/https
  2⤵
  PID:1549
- - /usr/bin/dbus-send
    dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
    3⤵
    - Reads runtime system information
    PID:1550
  - - /usr/bin/dbus-launch
      dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
      4⤵
      PID:1551
- - /bin/grep
    grep " = \\\"xfce4\\\"\$"
    3⤵
    PID:1553
- - /usr/bin/xprop
    xprop -root _DT_SAVE_MODE
    3⤵
    PID:1552
- - /bin/grep
    grep -i "^xfce_desktop_window"
    3⤵
    PID:1555
- - /usr/bin/xprop
    xprop -root
    3⤵
    PID:1554
- - /bin/grep
    grep -q "^Enlightenment"
    3⤵
    PID:1557
- - /bin/uname
    uname
    3⤵
    PID:1558
- - /bin/sed
    sed "s/:/ /g"
    3⤵
    - Reads runtime system information
    PID:1561
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:1566
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:1565
- - /usr/bin/head
    head -n 1
    3⤵
    PID:1564
- - /bin/grep
    grep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
    3⤵
    PID:1563
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:1571
- - /usr/bin/head
    head -n 1
    3⤵
    PID:1569
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:1570
- - /bin/grep
    grep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
    3⤵
    PID:1568
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:1576
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:1575
- - /usr/bin/head
    head -n 1
    3⤵
    PID:1574
- - /bin/grep
    grep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
    3⤵
    PID:1573
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:1581
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:1580
- - /usr/bin/head
    head -n 1
    3⤵
    PID:1579
- - /bin/grep
    grep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
    3⤵
    PID:1578
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:1586
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:1585
- - /usr/bin/head
    head -n 1
    3⤵
    PID:1584
- - /bin/grep
    grep "x-scheme-handler/https=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache
    3⤵
    PID:1583
- /bin/sed
  sed "s/:/ /g"
  2⤵
  PID:1589
- /bin/sed
  sed -e "s|-|/|"
  2⤵
  - Reads runtime system information
  PID:1592
- /bin/sed
  sed -e "s|-|/|"
  2⤵
  - Reads runtime system information
  PID:1595
- /usr/bin/cut
  cut "-d=" -f 2-
  2⤵
  PID:1600
- /usr/bin/which
  which firefox
  2⤵
  PID:1601
- /usr/bin/cut
  cut "-d=" -f 2-
  2⤵
  PID:1604
- /usr/bin/cut
  cut "-d=" -f 2-
  2⤵
  PID:1607
- /usr/bin/cut
  cut "-d=" -f 2-
  2⤵
  PID:1612
- /usr/bin/firefox
  /usr/bin/firefox "https://cdn.discordapp.com/attachments/1231440804208312402/1231440887524098109/Krampus.exe?ex=6636f7b2&is=662482b2&hm=072248e040c57d6f50f4ca9d0edc0521a56014940da22fafd562acef7e2e9afd&"
  2⤵
  PID:1613
- - /usr/bin/which
    which /usr/bin/firefox
    3⤵
    PID:1614
- /usr/lib/firefox/firefox
  /usr/lib/firefox/firefox "https://cdn.discordapp.com/attachments/1231440804208312402/1231440887524098109/Krampus.exe?ex=6636f7b2&is=662482b2&hm=072248e040c57d6f50f4ca9d0edc0521a56014940da22fafd562acef7e2e9afd&"
  2⤵
  - Checks CPU configuration
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1613
- - /usr/bin/dbus-launch
    dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
    3⤵
    PID:1618
- - /usr/bin/lsb_release
    /usr/bin/lsb_release -idrc
    3⤵
    PID:1630
- - /usr/lib/firefox/firefox
    /usr/lib/firefox/firefox -contentproc -parentBuildID 20230522134052 -prefsLen 19257 -prefMapSize 230809 -appDir /usr/lib/firefox/browser "{f957e835-8804-43ca-bfc7-c7d4e2130da4}" 1613 true socket
    3⤵
    - Changes its process name
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:1643
- - /usr/local/sbin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1659
- - /usr/local/bin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1659
- - /usr/sbin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1659
- - /usr/bin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1659
- - /usr/lib/firefox/firefox
    /usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 21750 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{fdbc1bb4-2f26-4d63-91f0-3c2856a95d89}" 1613 true tab
    3⤵
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:1715
- - /usr/lib/firefox/firefox
    /usr/lib/firefox/firefox -contentproc -childID 2 -isForBrowser -prefsLen 21418 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{cde60e20-a6e1-4f11-a8d3-408d6ea88580}" 1613 true tab
    3⤵
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:1737
- - /usr/lib/firefox/firefox
    /usr/lib/firefox/firefox -contentproc -childID 3 -isForBrowser -prefsLen 21767 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{2e09f502-6876-4c0a-9664-7c4f977fe401}" 1613 true tab
    3⤵
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:1765
- - /usr/lib/firefox/firefox
    /usr/lib/firefox/firefox -contentproc -childID 4 -isForBrowser -prefsLen 27824 -prefMapSize 230809 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{dd014e9d-b513-4e1c-a414-2c7bbb17b990}" 1613 true tab
    3⤵
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:1784

/usr/lib/gvfs/gvfsd-fuse
/usr/lib/gvfs/gvfsd-fuse /root/.gvfs -f -o big_writes
1⤵
- Reads runtime system information
PID:1691

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/root/.cache/dconf/user

Filesize
2B

MD5
0084bdb7c521c32d4520c6c2fff14180

SHA1
b40cee778a39bd989d7698f779ccad8015c43eb4

SHA256
db6720693775da968cf808a341b199ebb6826fd3a94c666f3d81273cef90c967

SHA512
5b2c857fc1b47e6fa3031bdf1356e3263cd91c99c7cd22eaeca3bfb5130cb314fe84e389f83ea308b02a0e46891082c3660ff2154acb1770db2b4d097a22c7b0

Download Submit
/root/.cache/mozilla/firefox/k1di5q1s.default-release/cache2/entries/039090029E64BC91E87E77199A6A6BE11FC39B6F

Filesize
142B

MD5
3c4632dcf2859588ee954ded53ace4e8

SHA1
2f6318ce578acf5a499abcfabf83e95b30aa3e43

SHA256
2ed12e405947b628d8c541b224eebbbf91a1c3eefeffbea482be2847767d8a47

SHA512
10277406a16c5fd4d9386abb368c951febd9ebc3b3e77965f6c1ea0e5607d2ba326d24578422ae59f453d5c80088b4f3784c210efcf8fef7d7d5d25f96090f51

Download Submit
/root/.cache/mozilla/firefox/k1di5q1s.default-release/cache2/entries/0EDDF8C091E2FED62E44BEDDDC1723F5BF38FE4F

Filesize
102B

MD5
8e8cf5b00a91ac473d3db7ae1bc895d6

SHA1
4e4a8094e06208a838e53c42cda0825f30d5fdc9

SHA256
f68214175344ab5bcc6fd60e85c54766ee0e53d6823e5ed14a9cb4eae1b77516

SHA512
a17ec64deb9edfca768f77cf841f973e3683a40083cf4b6db61f6e30a2eebfe9dc0a0007142fece9d04b4fc70331d4adccaa2b77e5f20be720e9056cf3d9902a

Download Submit
/root/.cache/mozilla/firefox/k1di5q1s.default-release/cache2/entries/139DBC79CB06880E396AC6D4E77B7E12C45CF215

Filesize
105B

MD5
3c520ba7159774d3793a85c3964e0f21

SHA1
a68637820f81dbfa74d2e7ea2ae090db456fb9eb

SHA256
e4cfcd3fbbf39511772e409b7f13499d0920d2958332b4b8000f06019ece00ce

SHA512
73f3c3cfd5f46c1b6f35c071b8356e2ac2ae38632e10dd01ff0286116f070a5e0df1855200af0c338ec8387142679a4a721c9d2e88ccf72d4e4e267f1827acef

Download Submit
/root/.cache/mozilla/firefox/k1di5q1s.default-release/cache2/entries/3D1E19D09F398691ABF62061591970855193B42F

Filesize
193B

MD5
08aa57f692671638d1a828288b361373

SHA1
0a0b050f988a3ad7707d5c99b193a4e99b953166

SHA256
42d98e6a02618e6e17d074aede7d294ce8657b2c3f9eb25b11c1bbf48a47057b

SHA512
3e66ff1b08cbd79f8fb156f0ed8b838dd2ec5322c8431b26c2138d98a729ac3a2b17e3aded90048dfc97afcc4298a8b09ef62a8d2854cbacdb695a5b52bdf379

Download Submit
/root/.cache/mozilla/firefox/k1di5q1s.default-release/cache2/entries/CB66E5D339E5F3A3185FDC2C22A859043E4090EE

Filesize
288B

MD5
ad10b6afb67abcddfb9e81bfd6b85b33

SHA1
6b3545a5a714804c423bdd7e15a82dca6012c45b

SHA256
35a985066487e27166e75747e9756400d832e6751ce4469d434a2e09762ddcfb

SHA512
4f8946c53b16477d3d89b2e52b4a9e522160f5bc947a2c5138fc3f9cab417273905cb94f6703c83cf54c2ee8e5f8de9b11ac8bb0e71f7416ec4c1cd21354f396

Download Submit
/root/.cache/mozilla/firefox/k1di5q1s.default-release/cache2/entries/EE1AAB872F378C4FA66FBCD193AF217BF20A4E27

Filesize
115B

MD5
92e52e04cac5543d8976cd8fae5cb382

SHA1
0f56c532ffadc0ff0b595f481eecf14a0ba29e7f

SHA256
038042951326c7e360b271e910e670c08af7e0d592e99ad7f94c68269e5583b6

SHA512
fc5ba0d79bfed8c89db6e4f4c5be10480494b7c93b9e0f823ba625fb16b2c74e27f104f9c8dfc542d70ae4d59da17420b9d04117bb05c259bbb1fc9faf1562b8

Download Submit
/root/.dbus/session-bus/11c67417355f45d397f6be11f62e85a6-0

Filesize
466B

MD5
34c6f09f7225fd207b2aa4ac6feca96e

SHA1
5c10aefd03950d6bb396afc61c6486366985c381

SHA256
66dbcaf9f7c2ccdc8fa17259ffa1ca6ed3de407d5a97fd71c0d42a32d9246756

SHA512
6f7deb886b818367481c5fcd5c42ec9b5cbfeac7ae8df8daf68c5c497d554c0f532690ad36bdee0405031b392bc9ac9d3d2947896275d86750ee01f8612614b2

Download Submit
/root/.mozilla/firefox/Crash Reports/InstallTime20230522134052

Filesize
10B

MD5
f306c74b1a8c7f9e0b429e86d1571600

SHA1
cceda5117f2a355b88e078474f321509a4da4a18

SHA256
b2f6d39a32050c2ed8b5db7a9f78119bd970d747758e24e8b30ad4c879d09786

SHA512
303cc890e0dba65367c530d72330bb92e53332afdefa7694f22b44ce93b6c95eedaf65efe81915404c81077c2eb43824187463492ab0bf232361cb0d34c676d3

Download Submit
/root/.mozilla/firefox/installs.ini

Filesize
62B

MD5
50c12003d632141f61c1d6f3fd1a1cb4

SHA1
b2127e434a2d3ad1c09c1de1efe928941c09e1e6

SHA256
f4d1ca2399c360cfa575e172b6deb1b2bf81eeccaab4b5721f2a1890bdd109f8

SHA512
2d7e6cd6e9b761f22bb5ecfc7331adec15fd534aca2f0e40793750a83ee57e89645deefc7e62e01d7438701d710d9daeb69bf4a0b49907c7d3df93199ebf0597

Download Submit
/root/.mozilla/firefox/k1di5q1s.default-release/cert9.db

Filesize
224KB

MD5
b57a70860feee9ed9ed103b0892a4b8f

SHA1
e5013ce79928f305245dbabd94a80948913c85d0

SHA256
38d2a48c8a87fc5caf8fc47edae87479f6d608ba0048d01be86f6267bafe9b0c

SHA512
962e918196cf59457a013a50dd8410bd88427323e352157a82614929f97d0390adba65c2b84774bbe1be1cfd8b32928ec6e171ad04ff6307d870a8b21e810984

Download Submit
/root/.mozilla/firefox/k1di5q1s.default-release/cert9.db

Filesize
224KB

MD5
df8f5781bb99c8af0c46fc1ceed1f5b4

SHA1
b3611706421ea6e12176d6cd655b94cd2667cd9a

SHA256
fd238c996740e1016d468970d69e65438c2dfc0cc547cef81745fbaa273ae3fe

SHA512
9eb5939faa0b68230e860882ab47e643939049462c9b2b67da9c2add7fc4aa71fb1e98c0bb9cf59b87a1622191dc7aa05709a8e7d00046f06bd71d09451cfc58

Download Submit
/root/.mozilla/firefox/k1di5q1s.default-release/compatibility.ini

Filesize
163B

MD5
fe452b7294d5928a9a5863b89ee0a6bd

SHA1
a5d4c245071fa96476ba48b4725bdae7f1b7940f

SHA256
d5bfb07561606a19aa96557ea109b175050dc0eb805cbef9c813503587d77900

SHA512
dc37d8507f08849e3382d2dbafd4a64555dbd57a288c95131e9aefb366630f1585811a9e1456b861bb9d2b816ed88b18ffb7580cd92b41bb9b0227ce1363843e

Download Submit
/root/.mozilla/firefox/k1di5q1s.default-release/cookies.sqlite

Filesize
96KB

MD5
9535f5fe817accc769c2c1d3354db39f

SHA1
6af62cf08717cf3bfa84eb1a7b311acf522ce560

SHA256
c53c15fcfac2bb57fdc88d23f932fc244dbaf4020f0f6eaecf0f77a37c21f8c5

SHA512
dc9c2c32eb42dda0a7a711e143aea58c603c1e9d885c3677e9fe86f525e1b0b32a46e240756263e56510b07e764ba69f2de13b90ec18210678242e10cfe17837

Download Submit
/root/.mozilla/firefox/k1di5q1s.default-release/cookies.sqlite

Filesize
96KB

MD5
5caa766855d5613a999f71b7812d6451

SHA1
ad0d9a52a0d5cc7f11858301dbe47377ed99ee37

SHA256
3a8ce2b07e3e8678a13aa58ef5b942c4dccd8f9c84511bdeb8847ef270797e27

SHA512
17bb0f4c87ec178910795b25ce85e74cf599190c769592472c3e872f42930c93f28faf0ff3e448816a9abcc8af0459852bed52bee08cfe25d068879c6dfd8eba

Download Submit
/root/.mozilla/firefox/k1di5q1s.default-release/key4.db

Filesize
288KB

MD5
415e211e6d303d31a1dbd80555aab7b0

SHA1
b8c0a0f930cc0f96d60aedd2b0f6e7079f917a2a

SHA256
195d049cddc39e881c85e960f4d6d2dac6a6e0e95d07c661ac1d20afbc4eae2f

SHA512
b1b62b5c0d64735aaa0634ab8e4197a717ae4af2ec8bae0e9c11340620238eb7bf13959cde3168c4bc4437821b222f3448d426be8e560b23312f4695447dc71d

Download Submit
/root/.mozilla/firefox/k1di5q1s.default-release/permissions.sqlite

Filesize
96KB

MD5
232fbc22dd03a8ec41edde02bdbea61c

SHA1
6ab4b39bca95418c52f7f861fd39e5fddb9cc7b6

SHA256
d88bf367aaf79efbb2e8fbdb1dc5bde1c1c3a53e0f4d8188027a63ec55d5f5f0

SHA512
055f1595f4a327347671db53cec8d89a310109d3f871c567e3d5b654b956fc0369d12437f7dc6d9327b973008f1327ee0dfdb5504f1b3cbe00da29941b1e5892

Download Submit
/root/.mozilla/firefox/k1di5q1s.default-release/prefs-1.js

Filesize
1KB

MD5
8c3e8872aaff9c3453ae064c76b2ed27

SHA1
aa4579cca27c771aa6044dd04adf4e12a5fe93bb

SHA256
6bd0c740ffddcab95894ec88525c00fb3b70c90a9e9df405e199fbbc42d5e115

SHA512
a8dae3acb21773c6dce1c52e82abe4153650d2ed7ae6a0c87015bfa2844127919db7f024fab6a2aa48ff9e695f4ec64e50c102e37832b0442907a62a8293a4cf

Download Submit
/root/.mozilla/firefox/k1di5q1s.default-release/prefs-1.js

Filesize
2KB

MD5
a713bee08b8ca82e3f9c4194ad5d5bd8

SHA1
f25e38c589185b98d030754f70cf88d952529ba3

SHA256
ecd61dd259c9a60b0dc31f2dbe934c4c87e02eb8ab45226abdbead03004ddd6a

SHA512
2152c8394805fb556abeefa2d49e37587be58756f2ae4b572ebffa8fb49b74783d550630514faeea740ced51118de146adb825a8311557c3b4b24640da771adb

Download Submit
/root/.mozilla/firefox/k1di5q1s.default-release/prefs-1.js

Filesize
2KB

MD5
0099038faa2273fa014f09db838ce177

SHA1
78278699c14d1582b3ee7b1f5da78c4965c202c4

SHA256
570cf360cf75a485ad97813118d2a71706f87a9f381169e286f0f4efac2a714e

SHA512
3383a0e4d4e214ae5de36d3373beec30df7d125ab45e56c6860680f1d6a999fb4bd2650e3e9758a6ba3f99770a606f2c9b7e2319d214584625f05a1755f03665

Download Submit
/root/.mozilla/firefox/k1di5q1s.default-release/prefs-1.js

Filesize
3KB

MD5
aec0ca2e2bb5072219349433aaa3365e

SHA1
76edfa407e324f828c86af0cbb15b4a2b3261dd1

SHA256
642e8ec594e97af57abe26bc8f74eb6456a5c5f5296401be350cf9840cddb9ac

SHA512
872e98aae83c5e25fbf8e9b582358ad96826068c3afc61638d86954274f3283ba4c37315196ae1378e0d26a4dc1abcb41e54ccd9a7600eb199d34089f31436f6

Download Submit
/root/.mozilla/firefox/k1di5q1s.default-release/prefs-1.js

Filesize
3KB

MD5
e867389a9de5f09b799ced3c9d3067ab

SHA1
ad584149a8bfcb7f3dcd5ffc5afe8014b1f79f1b

SHA256
db30989581089b9ea80ae54408a25ff6e9aae88953df06b1e9b8fbf1aa607b11

SHA512
c4c8ffd5623922d5486cddb2af7f3a69d5cb0b82725f70d26fabed1d1fe7fc436c34d1e69caddcc7926dc5307d790c232dceb7063e575f97e00b5cbdf4a7b95b

Download Submit
/root/.mozilla/firefox/k1di5q1s.default-release/prefs-1.js

Filesize
4KB

MD5
89241f896bff57770485c15424f5fa95

SHA1
9f585d7dafc8d8ce5d51633d9ccdb8dd547cd947

SHA256
96ec62070f47d409819b0866c89002bc3486db8d8c0ffcca1fac1b32f3d18239

SHA512
f13ef71c68994680161c1ca2f01ed4804b9d890ed04165b3ea6969416486c28c27af79f288634ff8cd946a78684f7325e66ea6598a46413e8e666b012d851d41

Download Submit
/root/.mozilla/firefox/k1di5q1s.default-release/prefs.js

Filesize
1KB

MD5
c82d03c2156707bd4f6cd85b87823f72

SHA1
887be658a87e614e2da0079e7a48e3b8dd337dca

SHA256
10ee9d2802e320bb355aad5c6c5ce8a635aa18df677a4f7d4a26d109efd6d63f

SHA512
036ce060601d5a3b89cc7de6bcf23884463fe3eb9d7f689b2a6af84d966cb8bbf710b8df9522cc01f4b5fc3667367d42d1ba3af988c61c672c45d0d77c723919

Download Submit
/root/.mozilla/firefox/k1di5q1s.default-release/storage/ls-archive.sqlite

Filesize
96KB

MD5
e0c613bfd69956a19ce2dc5e925aa223

SHA1
14accb230edcd6cb76967cdc6d4e5686db96b5df

SHA256
0d4cb11f6364c46a75f9eaddfca5c660b90dfd515df3afcd5e0baeca28a0f1ab

SHA512
01643c0131a392be92b3f281d7f633c1f502bff19090b0d716f1ac66aefecc3fcf92f393bef66b03089c9b9c6d8aaeb711b6a4f29d5a6729dd188c838f2272d1

Download Submit
/root/.mozilla/firefox/k1di5q1s.default-release/storage/ls-archive.sqlite

Filesize
128KB

MD5
178d71e5529d637ac62f7e75fdd75896

SHA1
339f2b949cc4c207b66aea11137448ba28d36dcb

SHA256
7b0050f1bfaab85c8f9067ae7d7369056ff752c0c852ef1462a96c22169004d4

SHA512
ec0e0105fcfbbae356dd55efbcf92975f35bbe5cb93fcabf4c08443e871957635d14830b27c4e1ddefbbaff8f9b7ec3590bf417a9442e1d7ee3607d14d56f664

Download Submit
/root/.mozilla/firefox/k1di5q1s.default-release/storage/permanent/chrome/.metadata-v2-tmp

Filesize
42B

MD5
6987eb6959e09bbd944bab4023bfbc4c

SHA1
775560ec0b9597f1572fc6c76423727f145d5917

SHA256
d61897cf4d7a78bcec922547d6cbf268d532b71c02af0bd483475398aa23c0ff

SHA512
db7a901d7be0e83595657bbcd7b2081ae8892672b9515b0bd9a11afd1e8665cdc872845eb62e191e70da6cf212227542db8ab04ec16d2aff4ad4ba905e7b99ff

Download Submit
/root/.mozilla/firefox/k1di5q1s.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite

Filesize
44KB

MD5
a8dd7ebaad5528b23f82ccb1534cea18

SHA1
600daceacfb5cf9df0b66ba7dce4516b2ac4df70

SHA256
e5b0d02c18ae36c4a220f41fd97c66060c17aaafcbb324a57ccdc2707c44c4ec

SHA512
67f867a8e2b37fb6bececd5ebc570ca594ea329142badd63d1281d5e735f515a5e329abc6eb9a9d3465aab0a08541b4888018d859964f160a52345ab93532bff

Download Submit
/root/.mozilla/firefox/k1di5q1s.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite

Filesize
12KB

MD5
0aea48b24e4fea7b5e3a9708af442d52

SHA1
f4846b065c7e17863b9fd5bde7aa6c6cc948842b

SHA256
4099c51505a70a6aef7928719b3b22b09c3d55a69c848e611cf78f25db9c81df

SHA512
edd74d4844099d1495091a7aa8904b608daae6de08d32ca00fd01a0f31e39cb994fba8983c9295cc688254a2b63e4147c5ff5385129773166768af843f5b448a

Download Submit
/root/.mozilla/firefox/k1di5q1s.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite

Filesize
44KB

MD5
7352c8848e88edc39b7fb5e663888187

SHA1
8c3dffe25cc56c7aec1b782292d6fceed81e6304

SHA256
7a462086a26978809c719e57a7ea6a25568767fb7532014e8531fda94b660e0a

SHA512
f2a0dbbab5c2c1702b03bce15a47739481f523e127d1372b40534db9a20b2bc99fb53710ee0e5d44176188817cac704cf4f98cdf087e7e89d244281fcfc3b280

Download Submit
/root/.mozilla/firefox/k1di5q1s.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite

Filesize
12KB

MD5
85414b8f9fa8eef8fcbe0d7c79b1bbcb

SHA1
93935dcc1836f48b3d6143a2f27ad627bce7ef59

SHA256
13e8ba6c18abeccf325cd1ad1421c6bc7e78052b3a6803c4d9006a2a8689d13a

SHA512
ba8812ae242925edf1142aa117f479462d56df11c035fca734499defc0a6117562ec9da25d7a91883d1dfb110a90ec83ab3b33b0d4da06a25607d99485321735

Download Submit
/root/.mozilla/firefox/k1di5q1s.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite

Filesize
44KB

MD5
759544297aaa61f5fef8ee42d0ae4393

SHA1
fc2d66f6e60409e3e8d38623ce5f817fc7f571e0

SHA256
1bd2000cd972e80cefaec6e982ba261d224a818f367de0fdf8c51fa5a05d7ab5

SHA512
8aaa2ce66f10d46f7c9200af841ac7bd9f5b55c30308a14f0deda44ac62581c45daae45154487c0073a0d5847d5926cbb4072ca64a702ac6b834ad0bb482804f

Download Submit
/root/.mozilla/firefox/k1di5q1s.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite

Filesize
12KB

MD5
99952a281fd8d1df3c27002f7319210d

SHA1
e26dac86d64897550df0cedccc37d20408b12e8f

SHA256
05b8b8429c1d28de9017142a0cfd61ff79f1d147c621ece012217fd1f7e84ef8

SHA512
1e4619f2f6b19e83dbfa677f624029d4cb965c7917fdb069b44b15b4df73f353cec06f751ca955481c67270bb4d064636b6e3d793d82b6b5d73537065903142b

Download Submit
/root/.mozilla/firefox/k1di5q1s.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite

Filesize
16KB

MD5
c3890375b20d5259e193a0eb575d4330

SHA1
0c82cc82923206341863b3e997a827b7c429156e

SHA256
cbf089c802463a6acad425b24e9185251fb2dad6a45d9bca517520416b809aee

SHA512
195f947748d391b026ea61aeafe5f0167d6303d16177875f260a14849532fc5045be3085751b52ffc753bf3021f253ead993e8bfa7ef46414e08e2e08e5e19a7

Download Submit
/root/.mozilla/firefox/k1di5q1s.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
44KB

MD5
07a412e08825220262ad2890757ff779

SHA1
f46c127dbc070ded87a6078b3c1c761955f96de8

SHA256
da640f8b665841b520d2262a21cc3f82aeaa881cf81a1ddae27ef501d66544e4

SHA512
0134c783bf3293848e479b478ac57a1e0f4202cddfb8b57bc6275aada7345f398cf8a627e9b1c34fd618192c2f0c9737b1da487daf33f9c557ebc1377105582b

Download Submit
/root/.mozilla/firefox/k1di5q1s.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
12KB

MD5
adef7a920cbe9e10038598c64858f079

SHA1
1274ec529434ef7dad5153c4b7048455310fca2a

SHA256
3d5e5ec28d890790b1cc81a0674cb7922b93acacdde82d8e380876b9426e0b71

SHA512
4670b0951922e039c36404465005bd46969f65a8bd85f2e3ada803f6fd679700b04616b4254c28dda9bd6650561d301b4445dc5ac37a3f25dada00ada49bac0a

Download Submit
/root/.mozilla/firefox/k1di5q1s.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
164KB

MD5
7061a13cb26e3285bb3fd08008e72d91

SHA1
c40366031f4632bb39e91cfca6b80b75b9cfe1b5

SHA256
ff060380f06fead751d233ecb33edb219ea7223c2ee301da06cbff44c4545980

SHA512
4f23aee65abefe2806aa29ad69da64d49245f8d5b2fcf8e703c623a28f53be2d00e39c5bad051242e28857302f161505acac540b74adeb780a8eb44ef1432191

Download Submit
/root/.mozilla/firefox/k1di5q1s.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
148KB

MD5
dd3f6ba37c670af5953593535e435d04

SHA1
ecfe4e650a050bce77e8ff7468de04c1b8acc9a4

SHA256
5cc6fa137a1f3a7d0b615b178877f12c460b22f95702eb7534d5732ee6599561

SHA512
86e0482543faae6fb279ca71e1e6d6461d32317e74baebb3973e0fde9800107faeb9c2347be6cf8a47556ae43c8e6c224a595e952f621e40ad2c5eba920df2b3

Download Submit
/root/.mozilla/firefox/k1di5q1s.default-release/times.json

Filesize
50B

MD5
35df2447a7f33eef0efffcaeee5cac33

SHA1
1871ff088a2a54077a0b3e8c76f2d6b21a16c385

SHA256
a3ad05f1de689f42ef0ee1fd5b452fdbfb47975741414e9d643c25f0daae612d

SHA512
67c8365159dc728042ea66ca818f2d6f9516853d1dc4cde3d3fca51149ecbed31a3fae2fb3e1cda8ea46e0e4f42f5520963719a1d6cb2900c017179443e209a7

Download Submit
/root/.mozilla/firefox/k1di5q1s.default-release/times.json

Filesize
47B

MD5
7c588b9ec3078ed603f6f4aed6ca56a8

SHA1
23ecf59d55b767087eb8a9b3804b00382090078c

SHA256
2d499e67ad423b9f7d9ce97a999ff718606fd520e7c0a11194c84262bc024a92

SHA512
d6bf833870d19f4e7926c44a281e0acdbd9af692d84fc61d11f652b956cfb02a44f48589b3b4e47c0f3a3e0c5e180dcf16533c627c79d0d70b7843ec595124f2

Download Submit
/root/.mozilla/firefox/nm1qqqx9.default/times.json

Filesize
47B

MD5
bde60460ddce9e920f6bba8b4dd7d8f1

SHA1
442ae16510cc51c5220775343385908de38648f6

SHA256
e0b5e23565f1ea4f970bf0272d23ef851cc8c162ce93f8d8429100501f30bb47

SHA512
ca0229df2b247f8ab2097b2490e722edc6194b98e7e674c6d14d63bb677cf7d76d65ad9294cab4dd7743d6da0402c6668a9f40c075dc86a32fc339205edc930f

Download Submit
/root/.mozilla/firefox/profiles.ini

Filesize
259B

MD5
ea6701ac02db04730a702345b8c77a80

SHA1
f8ea324a56af65ddf4f2b850e23eab554e13b13d

SHA256
be79111590f638f1b5df09189fd1428a557e5196d824553f315be0bda8a420cc

SHA512
9482802894e369526c9ee55578d5f479934099f57983d4066fd70fa71203c2bf31e9b7223f011a9bf7b5b8d1a63c1af5d0440d03eeb9ffa887ed940836e41f3f

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads