Analysis
-
max time kernel
442s -
max time network
441s -
platform
ubuntu-20.04_amd64 -
resource
ubuntu2004-amd64-20240508-en -
resource tags
arch:amd64arch:i386image:ubuntu2004-amd64-20240508-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system -
submitted
21-05-2024 15:36
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://192.227.232.151:81/
Resource
ubuntu2004-amd64-20240508-en
General
-
Target
http://192.227.232.151:81/
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
install-latest-yak.shinstall-latest-yak.shioc pid process /root/Downloads/install-latest-yak.sh 1975 install-latest-yak.sh /root/Downloads/install-latest-yak.sh 1985 install-latest-yak.sh -
Changes its process name 64 IoCs
Processes:
description ioc pid Changes the process name, possibly in an attempt to hide itself gmain 1531 Changes the process name, possibly in an attempt to hide itself gdbus 1533 Changes the process name, possibly in an attempt to hide itself glean.dispatche 1534 Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 1536 Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 1536 Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 1536 Changes the process name, possibly in an attempt to hide itself IPDL Background 1540 Changes the process name, possibly in an attempt to hide itself Socket Thread 1539 Changes the process name, possibly in an attempt to hide itself IPDL Background 1540 Changes the process name, possibly in an attempt to hide itself Socket Thread 1539 Changes the process name, possibly in an attempt to hide itself Backgro~Pool #1 1541 Changes the process name, possibly in an attempt to hide itself Netlink Monitor 1538 Changes the process name, possibly in an attempt to hide itself Netlink Monitor 1538 Changes the process name, possibly in an attempt to hide itself Backgro~Pool #1 1541 Changes the process name, possibly in an attempt to hide itself Timer 1537 Changes the process name, possibly in an attempt to hide itself Timer 1537 Changes the process name, possibly in an attempt to hide itself HTML5 Parser 1542 Changes the process name, possibly in an attempt to hide itself HTML5 Parser 1542 Changes the process name, possibly in an attempt to hide itself pool-firefox 1544 Changes the process name, possibly in an attempt to hide itself pool-firefox 1543 Changes the process name, possibly in an attempt to hide itself JS Watchdog 1546 Changes the process name, possibly in an attempt to hide itself JS Watchdog 1546 Changes the process name, possibly in an attempt to hide itself BGReadURLs 1548 Changes the process name, possibly in an attempt to hide itself BGReadURLs 1548 Changes the process name, possibly in an attempt to hide itself glxtest:disk$0 1549 Changes the process name, possibly in an attempt to hide itself Cache2 I/O 1550 Changes the process name, possibly in an attempt to hide itself Cookie 1551 Changes the process name, possibly in an attempt to hide itself Cookie 1551 Changes the process name, possibly in an attempt to hide itself StreamTrans #1 1552 Changes the process name, possibly in an attempt to hide itself StreamTrans #1 1552 Changes the process name, possibly in an attempt to hide itself TaskCon~ller #1 1554 Changes the process name, possibly in an attempt to hide itself TaskCon~ller #0 1553 Changes the process name, possibly in an attempt to hide itself Worker Launcher 1555 Changes the process name, possibly in an attempt to hide itself Worker Launcher 1555 Changes the process name, possibly in an attempt to hide itself BgIOThr~Pool #1 1556 Changes the process name, possibly in an attempt to hide itself BgIOThr~Pool #1 1556 Changes the process name, possibly in an attempt to hide itself Softwar~cThread 1558 Changes the process name, possibly in an attempt to hide itself Softwar~cThread 1558 Changes the process name, possibly in an attempt to hide itself Softwar~cThread 1558 Changes the process name, possibly in an attempt to hide itself CanvasRenderer 1563 Changes the process name, possibly in an attempt to hide itself Compositor 1562 Changes the process name, possibly in an attempt to hide itself CanvasRenderer 1563 Changes the process name, possibly in an attempt to hide itself Compositor 1562 Changes the process name, possibly in an attempt to hide itself WRWorkerLP#0 1561 Changes the process name, possibly in an attempt to hide itself WRWorker#0 1560 Changes the process name, possibly in an attempt to hide itself WRWorkerLP#0 1561 Changes the process name, possibly in an attempt to hide itself Renderer 1559 Changes the process name, possibly in an attempt to hide itself Renderer 1559 Changes the process name, possibly in an attempt to hide itself WRWorker#0 1560 Changes the process name, possibly in an attempt to hide itself ImageIO 1564 Changes the process name, possibly in an attempt to hide itself ImageIO 1564 Changes the process name, possibly in an attempt to hide itself Permission 1565 Changes the process name, possibly in an attempt to hide itself Permission 1565 Changes the process name, possibly in an attempt to hide itself IPC Launch 1568 Changes the process name, possibly in an attempt to hide itself IPC Launch 1568 Changes the process name, possibly in an attempt to hide itself SandboxReporter 1567 Changes the process name, possibly in an attempt to hide itself SandboxReporter 1567 Changes the process name, possibly in an attempt to hide itself Breakpad Server 1566 Changes the process name, possibly in an attempt to hide itself Sandbox Forked 1569 Changes the process name, possibly in an attempt to hide itself Chroot Helper 1572 Changes the process name, possibly in an attempt to hide itself gmain 1573 Changes the process name, possibly in an attempt to hide itself gdbus 1574 Changes the process name, possibly in an attempt to hide itself pool-/usr/libex 1575 Changes the process name, possibly in an attempt to hide itself gmain 1579 -
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
Processes:
firefoxdescription ioc process File opened for reading /proc/cpuinfo firefox -
Reads CPU attributes 1 TTPs 20 IoCs
Processes:
firefoxfirefoxfirefoxnautilusfirefoxfirefoxfirefoxfirefoxfirefoxfirefoxfirefoxnautilusfirefoxfirefoxfirefoxfirefoxfirefoxdescription ioc process File opened for reading /sys/devices/system/cpu/present firefox File opened for reading /sys/devices/system/cpu/present firefox File opened for reading /sys/devices/system/cpu/present firefox File opened for reading /sys/devices/system/cpu/online nautilus File opened for reading /sys/devices/system/cpu/present firefox File opened for reading /sys/devices/system/cpu/present firefox File opened for reading /sys/devices/system/cpu/present firefox File opened for reading /sys/devices/system/cpu/present firefox File opened for reading /sys/devices/system/cpu/present firefox File opened for reading /sys/devices/system/cpu/present firefox File opened for reading /sys/devices/system/cpu/present firefox File opened for reading /sys/devices/system/cpu/online nautilus File opened for reading /sys/devices/system/cpu/present firefox File opened for reading /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq firefox File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/size firefox File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/size firefox File opened for reading /sys/devices/system/cpu/present firefox File opened for reading /sys/devices/system/cpu/present firefox File opened for reading /sys/devices/system/cpu/present firefox File opened for reading /sys/devices/system/cpu/present firefox -
Enumerates kernel/hardware configuration 1 TTPs 64 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
Processes:
glxtestfirefoxfirefoxfirefoxfirefoxfirefoxfirefoxgvfs-mtp-volume-monitorgvfs-gphoto2-volume-monitorfirefoxfirefoxfirefoxfirefoxfirefoxfirefoxdescription ioc process File opened for reading /sys/devices/pci0000:00/0000:00:02.0/vendor glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0/device glxtest File opened for reading /sys/devices/system/cpu firefox File opened for reading /sys/devices/system/cpu firefox File opened for reading /sys/devices/system/cpu firefox File opened for reading /sys/bus/pci/devices glxtest File opened for reading /sys/bus/pci/devices/0000:00:06.0/irq glxtest File opened for reading /sys/devices/system/cpu firefox File opened for reading /sys/bus/pci/devices/0000:00:04.0/resource glxtest File opened for reading /sys/devices/system/cpu firefox File opened for reading /sys/bus/pci/devices/0000:00:06.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:05.0/class glxtest File opened for reading /sys/devices/system/cpu firefox File opened for reading /sys/bus/pci/devices/0000:00:01.3/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.1/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:05.0/resource glxtest File opened for reading /sys/devices/pci0000:00/0000:00:05.0/usb1/1-0:1.0/uevent gvfs-mtp-volume-monitor File opened for reading /sys/devices/pci0000:00/0000:00:05.0/usb1/1-1/1-1:1.0/uevent gvfs-gphoto2-volume-monitor File opened for reading /sys/bus/pci/devices/0000:00:01.0/irq glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.0/vendor glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0/subsystem_vendor glxtest File opened for reading /sys/devices/system/cpu firefox File opened for reading /sys/bus/pci/devices/0000:00:04.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.1/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:03.0/resource glxtest File opened for reading /sys/bus/pci/devices/0000:00:03.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:03.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:06.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:02.0/irq glxtest File opened for reading /sys/bus/pci/devices/0000:00:02.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:00.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.3/device glxtest File opened for reading /sys/devices/pci0000:00/0000:00:05.0/usb1/1-1/uevent gvfs-gphoto2-volume-monitor File opened for reading /sys/devices/pci0000:00/0000:00:05.0/usb1/1-0:1.0/uevent gvfs-gphoto2-volume-monitor File opened for reading /sys/bus gvfs-mtp-volume-monitor File opened for reading /sys/class gvfs-mtp-volume-monitor File opened for reading /sys/devices/system/cpu firefox File opened for reading /sys/devices/system/cpu firefox File opened for reading /sys/devices/system/cpu firefox File opened for reading /sys/devices/pci0000:00/0000:00:05.0/usb1/1-1/uevent gvfs-mtp-volume-monitor File opened for reading /sys/devices/pci0000:00/0000:00:05.0/usb1/1-1/1-1:1.0/uevent gvfs-mtp-volume-monitor File opened for reading /sys/class gvfs-gphoto2-volume-monitor File opened for reading /sys/bus/pci/devices/0000:00:01.0/resource glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.1/resource glxtest File opened for reading /sys/bus/pci/devices/0000:00:02.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:05.0/device glxtest File opened for reading /sys/devices/system/cpu firefox File opened for reading /sys/bus/pci/devices/0000:00:01.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:03.0/class glxtest File opened for reading /sys/bus gvfs-gphoto2-volume-monitor File opened for reading /sys/bus/pci/devices/0000:00:00.0/irq glxtest File opened for reading /sys/devices/system/cpu glxtest File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us firefox File opened for reading /sys/devices/system/cpu firefox File opened for reading /sys/devices/pci0000:00/0000:00:05.0/usb1/uevent gvfs-mtp-volume-monitor File opened for reading /sys/bus/usb/devices gvfs-gphoto2-volume-monitor File opened for reading /sys/bus/pci/devices/0000:00:04.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:00.0/resource glxtest File opened for reading /sys/bus/pci/devices/0000:00:00.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.3/irq glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0/subsystem_device glxtest File opened for reading /sys/bus/pci/devices/0000:00:04.0/irq glxtest File opened for reading /sys/bus/pci/devices/0000:00:04.0/device glxtest -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes:
firefoxgnome-keyring-daemonfirefoxgvfs-goa-volume-monitorfirefoxfirefoxfirefoxfirefoxdbus-daemonfirefoxfirefoxsudosudofirefoxfirefoxfirefoxgvfsd-metadatagnome-terminal-servergvfsd-trashsudoxdg-document-portalsudoxdg-desktop-portalsudobwrapxdg-desktop-portal-gtkfirefoxgvfs-udisks2-volume-monitorgvfs-mtp-volume-monitornautilusdbus-sendgeditdescription ioc process File opened for reading /proc/self/task/1769/stat firefox File opened for reading /proc/1824/status gnome-keyring-daemon File opened for reading /proc/self/fd/121 firefox File opened for reading /proc/meminfo firefox File opened for reading /proc/filesystems gvfs-goa-volume-monitor File opened for reading /proc/self/maps firefox File opened for reading /proc/self/maps firefox File opened for reading /proc/self/stat firefox File opened for reading /proc/self/maps firefox File opened for reading /proc/self/stat firefox File opened for reading /proc/1824/cmdline dbus-daemon File opened for reading /proc/1412/attr/current dbus-daemon File opened for reading /proc/filesystems firefox File opened for reading /proc/self/fd/35 firefox File opened for reading /proc/self/task/1723/stat firefox File opened for reading /proc/sys/kernel/ngroups_max sudo File opened for reading /proc/filesystems sudo File opened for reading /proc/1398/cmdline dbus-daemon File opened for reading /proc/self/fd firefox File opened for reading /proc/self/fd/125 firefox File opened for reading /proc/self/stat firefox File opened for reading /proc/filesystems gnome-keyring-daemon File opened for reading /proc/1610/cmdline dbus-daemon File opened for reading /proc/self/fd/81 firefox File opened for reading /proc/self/maps firefox File opened for reading /proc/self/fd/104 firefox File opened for reading /proc/filesystems firefox File opened for reading /proc/self/mountinfo firefox File opened for reading /proc/self/fd/116 firefox File opened for reading /proc/filesystems gvfsd-metadata File opened for reading /proc/self/task/2273/stat firefox File opened for reading /proc/self/stat firefox File opened for reading /proc/1922/cmdline dbus-daemon File opened for reading /proc/1958/cgroup gnome-terminal-server File opened for reading /proc/self/mountinfo gvfsd-trash File opened for reading /proc/self/mountinfo firefox File opened for reading /proc/sys/kernel/ngroups_max sudo File opened for reading /proc/filesystems xdg-document-portal File opened for reading /proc/self/fd/53 firefox File opened for reading /proc/self/fd/96 firefox File opened for reading /proc/sys/kernel/ngroups_max sudo File opened for reading /proc/self/fd/58 firefox File opened for reading /proc/1527/root xdg-desktop-portal File opened for reading /proc/1867/cmdline dbus-daemon File opened for reading /proc/sys/kernel/ngroups_max sudo File opened for reading /proc/1582/cmdline dbus-daemon File opened for reading /proc/self/fd/79 firefox File opened for reading /proc/1844/cmdline dbus-daemon File opened for reading /proc/sys/kernel/overflowgid bwrap File opened for reading /proc/filesystems xdg-desktop-portal-gtk File opened for reading /proc/self/cgroup firefox File opened for reading /proc/filesystems firefox File opened for reading /proc/self/mountinfo gvfs-udisks2-volume-monitor File opened for reading /proc/filesystems gvfs-mtp-volume-monitor File opened for reading /proc/filesystems nautilus File opened for reading /proc/self/fd dbus-send File opened for reading /proc/1860/cmdline dbus-daemon File opened for reading /proc/self/stat sudo File opened for reading /proc/self/fd/36 firefox File opened for reading /proc/self/stat sudo File opened for reading /proc/filesystems firefox File opened for reading /proc/self/maps firefox File opened for reading /proc/self/maps firefox File opened for reading /proc/filesystems gedit -
Writes file to tmp directory 5 IoCs
Malware often drops required files in the /tmp directory.
Processes:
firefoxnautilusdescription ioc process File opened for modification /tmp/firefox/.parentlock firefox File opened for modification /tmp/Nyr55Q3N.sh firefox File opened for modification /tmp/2NFIBGho.bmp firefox File opened for modification /tmp/tmpaddon firefox File opened for modification /tmp/flatpak-seccomp-Y5JTN2 nautilus
Processes
-
/usr/bin/xdg-openxdg-open http://192.227.232.151:81/1⤵
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager2⤵
-
/usr/bin/dbus-launchdbus-launch --autolaunch 4816dd152e8c48ff97e9117d197c13d8 --binary-syntax --close-stderr3⤵
-
/usr/bin/dbus-daemon/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session4⤵
- Reads runtime system information
-
/usr/libexec/xdg-desktop-portal/usr/libexec/xdg-desktop-portal5⤵
- Reads runtime system information
-
/usr/libexec/xdg-document-portal/usr/libexec/xdg-document-portal5⤵
- Reads runtime system information
-
/usr/libexec/xdg-permission-store/usr/libexec/xdg-permission-store5⤵
-
/usr/libexec/xdg-desktop-portal-gtk/usr/libexec/xdg-desktop-portal-gtk5⤵
- Reads runtime system information
-
/usr/libexec/gvfsd/usr/libexec/gvfsd5⤵
-
/usr/libexec/gvfsd-trash/usr/libexec/gvfsd-trash --spawner :1.8 /org/gtk/gvfs/exec_spaw/06⤵
- Reads runtime system information
-
/usr/libexec/dconf-service/usr/libexec/dconf-service5⤵
-
/usr/bin/nautilus/usr/bin/nautilus --gapplication-service5⤵
- Reads CPU attributes
-
/usr/bin/gnome-keyring-daemon/usr/bin/gnome-keyring-daemon --start --foreground "--components=secrets"5⤵
- Reads runtime system information
-
/usr/libexec/gvfs-udisks2-volume-monitor/usr/libexec/gvfs-udisks2-volume-monitor5⤵
- Reads runtime system information
-
/usr/libexec/gvfs-afc-volume-monitor/usr/libexec/gvfs-afc-volume-monitor5⤵
-
/usr/libexec/gvfs-mtp-volume-monitor/usr/libexec/gvfs-mtp-volume-monitor5⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/libexec/gvfs-gphoto2-volume-monitor/usr/libexec/gvfs-gphoto2-volume-monitor5⤵
- Enumerates kernel/hardware configuration
-
/usr/libexec/gvfs-goa-volume-monitor/usr/libexec/gvfs-goa-volume-monitor5⤵
- Reads runtime system information
-
/usr/libexec/goa-daemon/usr/libexec/goa-daemon5⤵
-
/usr/libexec/goa-identity-service/usr/libexec/goa-identity-service5⤵
-
/usr/bin/nautilus/usr/bin/nautilus --gapplication-service5⤵
- Reads CPU attributes
- Reads runtime system information
- Writes file to tmp directory
-
/usr/local/sbin/bwrapbwrap --ro-bind /usr /usr --ro-bind /etc/ld.so.cache /etc/ld.so.cache --symlink /usr//bin /bin --symlink /usr//lib64 /lib64 --symlink /usr//lib /lib --symlink /usr//sbin /sbin --ro-bind-try /var/cache/fontconfig /var/cache/fontconfig --ro-bind-try /etc/alternatives /etc/alternatives --proc /proc --dev /dev --chdir / --setenv GIO_USE_VFS local --unshare-all --die-with-parent --bind /tmp/gnome-desktop-thumbnailer-3NJTN2 /tmp --ro-bind /root/Downloads/resZZTyRQ.bmp /tmp/resZZTyRQ.bmp --seccomp 26 /usr/bin/gdk-pixbuf-thumbnailer -s 256 file:///tmp/resZZTyRQ.bmp /tmp/gnome-desktop-thumbnailer.png6⤵
-
/usr/local/bin/bwrapbwrap --ro-bind /usr /usr --ro-bind /etc/ld.so.cache /etc/ld.so.cache --symlink /usr//bin /bin --symlink /usr//lib64 /lib64 --symlink /usr//lib /lib --symlink /usr//sbin /sbin --ro-bind-try /var/cache/fontconfig /var/cache/fontconfig --ro-bind-try /etc/alternatives /etc/alternatives --proc /proc --dev /dev --chdir / --setenv GIO_USE_VFS local --unshare-all --die-with-parent --bind /tmp/gnome-desktop-thumbnailer-3NJTN2 /tmp --ro-bind /root/Downloads/resZZTyRQ.bmp /tmp/resZZTyRQ.bmp --seccomp 26 /usr/bin/gdk-pixbuf-thumbnailer -s 256 file:///tmp/resZZTyRQ.bmp /tmp/gnome-desktop-thumbnailer.png6⤵
-
/usr/sbin/bwrapbwrap --ro-bind /usr /usr --ro-bind /etc/ld.so.cache /etc/ld.so.cache --symlink /usr//bin /bin --symlink /usr//lib64 /lib64 --symlink /usr//lib /lib --symlink /usr//sbin /sbin --ro-bind-try /var/cache/fontconfig /var/cache/fontconfig --ro-bind-try /etc/alternatives /etc/alternatives --proc /proc --dev /dev --chdir / --setenv GIO_USE_VFS local --unshare-all --die-with-parent --bind /tmp/gnome-desktop-thumbnailer-3NJTN2 /tmp --ro-bind /root/Downloads/resZZTyRQ.bmp /tmp/resZZTyRQ.bmp --seccomp 26 /usr/bin/gdk-pixbuf-thumbnailer -s 256 file:///tmp/resZZTyRQ.bmp /tmp/gnome-desktop-thumbnailer.png6⤵
-
/usr/bin/bwrapbwrap --ro-bind /usr /usr --ro-bind /etc/ld.so.cache /etc/ld.so.cache --symlink /usr//bin /bin --symlink /usr//lib64 /lib64 --symlink /usr//lib /lib --symlink /usr//sbin /sbin --ro-bind-try /var/cache/fontconfig /var/cache/fontconfig --ro-bind-try /etc/alternatives /etc/alternatives --proc /proc --dev /dev --chdir / --setenv GIO_USE_VFS local --unshare-all --die-with-parent --bind /tmp/gnome-desktop-thumbnailer-3NJTN2 /tmp --ro-bind /root/Downloads/resZZTyRQ.bmp /tmp/resZZTyRQ.bmp --seccomp 26 /usr/bin/gdk-pixbuf-thumbnailer -s 256 file:///tmp/resZZTyRQ.bmp /tmp/gnome-desktop-thumbnailer.png6⤵
- Reads runtime system information
-
/usr/bin/gdk-pixbuf-thumbnailer/usr/bin/gdk-pixbuf-thumbnailer -s 256 file:///tmp/resZZTyRQ.bmp /tmp/gnome-desktop-thumbnailer.png7⤵
-
/usr/bin/gedit/usr/bin/gedit --gapplication-service5⤵
-
/usr/libexec/gvfsd-metadata/usr/libexec/gvfsd-metadata5⤵
- Reads runtime system information
-
/usr/bin/gedit/usr/bin/gedit --gapplication-service5⤵
- Reads runtime system information
-
/usr/libexec/gnome-terminal-server/usr/libexec/gnome-terminal-server5⤵
- Reads runtime system information
-
/bin/bashbash6⤵
-
/usr/bin/groupsgroups7⤵
-
/usr/bin/lesspipelesspipe7⤵
-
/usr/bin/basenamebasename /usr/bin/lesspipe8⤵
-
/usr/bin/dirnamedirname /usr/bin/lesspipe8⤵
-
/usr/bin/dircolorsdircolors -b7⤵
-
/usr/bin/lsls "--color=auto"7⤵
-
/root/Downloads/install-latest-yak.sh./install-latest-yak.sh7⤵
- Executes dropped EXE
-
/usr/bin/sudosudo ./install-latest-yak.sh7⤵
- Reads runtime system information
-
/usr/bin/sudosudo install-latest-yak.sh7⤵
- Reads runtime system information
-
/usr/bin/sudosudo execinstall-latest-yak.sh7⤵
- Reads runtime system information
-
/usr/bin/sudosudo exec install-latest-yak.sh7⤵
-
/usr/bin/sudosudo .install-latest-yak.sh7⤵
- Reads runtime system information
-
/root/Downloads/install-latest-yak.sh/root/Downloads/install-latest-yak.sh7⤵
- Executes dropped EXE
-
/usr/bin/sudosudo /root/Downloads/install-latest-yak.sh7⤵
- Reads runtime system information
-
/usr/bin/grepgrep " = \\\"xfce4\\\"\$"2⤵
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE2⤵
-
/usr/bin/grepgrep -i "^xfce_desktop_window"2⤵
-
/usr/bin/xpropxprop -root2⤵
-
/usr/bin/grepgrep -q "^Enlightenment"2⤵
-
/usr/bin/unameuname2⤵
-
/usr/bin/grepgrep -q "^file://"2⤵
-
/usr/bin/egrepegrep -q "^[[:alpha:]+\\.\\-]+:"2⤵
-
/usr/local/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
-
/usr/local/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
-
/usr/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
-
/usr/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
-
/usr/bin/sedsed -n "s/\\(^[[:alnum:]+\\.-]*\\):.*\$/\\1/p"2⤵
-
/usr/bin/xdg-mimexdg-mime query default x-scheme-handler/http2⤵
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager3⤵
- Reads runtime system information
-
/usr/bin/dbus-launchdbus-launch --autolaunch 4816dd152e8c48ff97e9117d197c13d8 --binary-syntax --close-stderr4⤵
-
/usr/bin/grepgrep " = \\\"xfce4\\\"\$"3⤵
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE3⤵
-
/usr/bin/grepgrep -i "^xfce_desktop_window"3⤵
-
/usr/bin/xpropxprop -root3⤵
-
/usr/bin/grepgrep -q "^Enlightenment"3⤵
-
/usr/bin/unameuname3⤵
-
/usr/bin/sedsed "s/:/ /g"3⤵
-
/usr/bin/cutcut -d ";" -f 13⤵
-
/usr/bin/cutcut -d "=" -f 23⤵
-
/usr/bin/headhead -n 13⤵
-
/usr/bin/grepgrep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵
-
/usr/bin/cutcut -d ";" -f 13⤵
-
/usr/bin/cutcut -d "=" -f 23⤵
-
/usr/bin/headhead -n 13⤵
-
/usr/bin/grepgrep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵
-
/usr/bin/cutcut -d ";" -f 13⤵
-
/usr/bin/cutcut -d "=" -f 23⤵
-
/usr/bin/headhead -n 13⤵
-
/usr/bin/grepgrep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵
-
/usr/bin/cutcut -d ";" -f 13⤵
-
/usr/bin/cutcut -d "=" -f 23⤵
-
/usr/bin/headhead -n 13⤵
-
/usr/bin/grepgrep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵
-
/usr/bin/cutcut -d ";" -f 13⤵
-
/usr/bin/cutcut -d "=" -f 23⤵
-
/usr/bin/headhead -n 13⤵
-
/usr/bin/grepgrep "x-scheme-handler/http=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache3⤵
-
/usr/bin/sedsed "s/:/ /g"2⤵
-
/usr/bin/sedsed -e "s|-|/|"2⤵
-
/usr/bin/sedsed -e "s|-|/|"2⤵
-
/usr/bin/cutcut "-d=" -f 2-2⤵
-
/usr/bin/whichwhich firefox2⤵
-
/usr/bin/cutcut "-d=" -f 2-2⤵
-
/usr/bin/cutcut "-d=" -f 2-2⤵
-
/usr/bin/cutcut "-d=" -f 2-2⤵
-
/usr/bin/firefox/usr/bin/firefox http://192.227.232.151:81/2⤵
-
/usr/bin/whichwhich /usr/bin/firefox3⤵
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox http://192.227.232.151:81/2⤵
- Checks CPU configuration
- Reads CPU attributes
- Reads runtime system information
- Writes file to tmp directory
-
/usr/local/sbin/dbus-launchdbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr3⤵
-
/usr/local/bin/dbus-launchdbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr3⤵
-
/usr/sbin/dbus-launchdbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr3⤵
-
/usr/bin/dbus-launchdbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr3⤵
-
/usr/lib/firefox/glxtest/usr/lib/firefox/glxtest -f 133⤵
- Enumerates kernel/hardware configuration
-
/usr/bin/lsb_release/usr/bin/lsb_release -idrc3⤵
-
/usr/local/sbin/dbus-launchdbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr3⤵
-
/usr/local/bin/dbus-launchdbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr3⤵
-
/usr/sbin/dbus-launchdbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr3⤵
-
/usr/bin/dbus-launchdbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr3⤵
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -parentBuildID 20240108143603 -prefsLen 20597 -prefMapSize 234708 -appDir /usr/lib/firefox/browser "{0eea513c-10ae-4310-9352-9f41ebc0e65d}" 1527 true socket3⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 20206 -prefMapSize 234708 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{51e0787f-d77f-40f0-b1aa-fb4cb621c96c}" 1527 true tab3⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 2 -isForBrowser -prefsLen 28644 -prefMapSize 234708 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{20196e2a-f447-4fa3-b20e-055743945bd5}" 1527 true tab3⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -parentBuildID 20240108143603 -sandboxingKind 0 -prefsLen 29335 -prefMapSize 234708 -appDir /usr/lib/firefox/browser "{acebcedb-c0a2-4577-8eef-bcfed62c4f54}" 1527 true utility3⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 3 -isForBrowser -prefsLen 25826 -prefMapSize 234708 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{f5c1c81d-aa42-459b-8a9e-72821738dbcf}" 1527 true tab3⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 4 -isForBrowser -prefsLen 25826 -prefMapSize 234708 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{0b70ad3f-2435-4318-b2b2-1a05b6481257}" 1527 true tab3⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 5 -isForBrowser -prefsLen 25969 -prefMapSize 234708 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{f5b3e52f-da4b-4cc3-bb7c-9c92cce655ae}" 1527 true tab3⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 6 -isForBrowser -prefsLen 25969 -prefMapSize 234708 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{f8cd8792-32ca-4f2b-96a7-e2640a0e7ca3}" 1527 true tab3⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 7 -isForBrowser -prefsLen 25969 -prefMapSize 234708 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{691d00be-b56e-44c3-9bc3-90c10188d425}" 1527 true tab3⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 8 -isForBrowser -prefsLen 28813 -prefMapSize 234708 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{55cfcb02-b27b-4aa8-a30e-b72a6c167d47}" 1527 true tab3⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 9 -isForBrowser -prefsLen 28813 -prefMapSize 234708 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{8fe820c5-1bb3-41cd-a8b4-8ae08dfe83ce}" 1527 true tab3⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 10 -isForBrowser -prefsLen 28813 -prefMapSize 234708 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{9ff60a0e-2b84-4230-8d21-2dfac5a4b146}" 1527 true tab3⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 11 -isForBrowser -prefsLen 28937 -prefMapSize 234708 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{cc081c7b-fd69-4740-8766-80a2dc71891e}" 1527 true tab3⤵
- Reads CPU attributes
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 12 -isForBrowser -prefsLen 33139 -prefMapSize 234708 -jsInitLen 229864 -parentBuildID 20240108143603 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser "{367631a6-99f0-4426-a07c-2d6ac4ac2bbe}" 1527 true tab3⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/libexec/gvfsd-fuse/usr/libexec/gvfsd-fuse /root/.cache/gvfs -f -o big_writes1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
/root/.bash_historyFilesize
262B
MD543022a0fa34d1c6b89c0d15c23a55d5b
SHA15ae241415286275b6780c28ef50a69f445ea7e13
SHA256fad8f24c896129923a07881a124cb6c909e24d4bc73952d423ea1cdb55cbdc8d
SHA512341771f3532c7bfb0ab0eb8558cdb98713fd055eb18f1ef5ae1355f0b136b538508f78cbffea0cad68cb29cfd3b83e4dd02f920f28c92794d9eb180eed7b0069
-
/root/.cache/dconf/userFilesize
2B
MD5c4103f122d27677c9db144cae1394a66
SHA11489f923c4dca729178b3e3233458550d8dddf29
SHA25696a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
SHA5125ea71dc6d0b4f57bf39aadd07c208c35f06cd2bac5fde210397f70de11d439c62ec1cdf3183758865fd387fcea0bada2f6c37a4a17851dd1d78fefe6f204ee54
-
/root/.cache/thumbnails/fail/gnome-thumbnail-factory/ae72ca3b3a5e25dee949419147dcbbbb.png.U69UN2Filesize
222B
MD5645f7acacaa3539ec0e3a7a94967e56f
SHA1bf4f67e6c4d198d245168bae282d882ccf785293
SHA2566ab4da284a54130ceb376decc249e47db13c39cf036b2fdbe0892d660f951ba2
SHA51257fb5416c21484967288337fe19dbf874ddae98754dff352b407b24918eda776c00303d8e0b115fb7f3fa00f943b883b3817830950be47788896c9d91a4ab90c
-
/root/.config/gedit/accelsFilesize
102B
MD544ca9eff853cd7a8f9c1ba0bcf0c9064
SHA1f09dcf877fcf2329996584d6b07b062c383283de
SHA2566a1e573c0068dc87d4f0fbe6782d0a253dd60b9f37b7f6c5c4d6c72547f16c05
SHA5123e7ccb1086dbaf64b48a389fd247981f4e20c577f8466b75c84484ef8aa5befb4f71f87f05c5ade91b89f8a860a83144bc36eed6fbe0fa91d47cbbb2d2beeea6
-
/root/.local/share/gvfs-metadata/home-56821165.log.SZXZN2Filesize
32KB
MD54d63038c59ddaa416050237ec5a228ab
SHA19ec4530499df320591c01f0d50469ef65672f312
SHA2567b7e5b5ae8e5ea5f6c14ae12c2440e88d5579af731ad6f4fee239fd623f6abdb
SHA51298a1ee02605c9722e36ec09f09246354fbc055d4009e0074dd4beb9eb63839ed5e4b76d3143e48ce0e7b484d2a0ded0f2fabcd5da5849c3e124e231c05af2c23
-
/root/Downloads/2NFIBGho.bmp.partFilesize
1.8MB
MD5ff37343c299dc8d5530b7407dd594c8d
SHA17e526e35ffdeeb91e1b646f8d49c9a0a4f80885d
SHA256b0200b9f7c9f9fb9eab97717c091a0fd53a608d559050088fcaa18f7d7b1bb78
SHA512d88871af5c7d952b42f5f22d455d551bcef316ded16b66026d54c2b0795db5a8de2ca512a906a63e01461d35e9b4d8e74cce33a4ebbc6702ccfa49448c255fce
-
/root/Downloads/Nyr55Q3N.sh.partFilesize
1KB
MD56fdc025141c235838e396e1f3274a138
SHA1d32ffb9d701fea25469b9cbaf14f04f1e89fc27c
SHA2569c4b111ef0c0ccb23bbd1afc2c0620783ddc932e9ec3d6696c505b1ce4f25994
SHA512e526c2453f55096e32ac9e0f496618bfb4393352cfe909937b75f601e237f6bc8c5074c2d2c3d851bd8fdab77394b8a5d0c4c73b5f66c86c2bce43ed89f12195
-
/root/Downloads/resZZTyRQ.F1nOT4KO.bmp.partFilesize
3.1MB
MD5101801960856b49c4428123011952c9d
SHA1e695874e3f36de610348def91431ce9d40013b84
SHA25623be596bc7d1832621fda9f5804a6c022ad436acb01c2e172cd3b98338734dfb
SHA512f9f0eed9a79fc9ae643452ac1680f8c6cb209e7ded21fde7aca1adabb573ec67e12ced3529e4b61fa6bb54778c8714f4691af1ded4711be5842c7e9e38f15e9d
-
/tmp/flatpak-seccomp-Y5JTN2Filesize
496B
MD56329a7d4e4361fa39ed514f8be2ff9ec
SHA1fbcd9019ea592fafb28961c384b8847e0f64d6e8
SHA256eb2fd18f927deec1fad9452265e5085689f24e925e71ee933aa46d8a57546c46
SHA5122fa5728ba700f350e2c44151b489febfab157aba4d75cb4d3c808c383c071cada82d75b16402237d8c158a019dc45ada56c2471313ebd97a253f7bbb655eafea
-
/tmp/tmpaddonFilesize
569KB
MD530082ae40dc48af6343db2fd22cfc645
SHA13eb577555ee638e8beb01173e8f29e172747a728
SHA25685d4b95f9b2075daee9b0e64bce8d9d7343d0dda10e6072d7f9485a68472ee76
SHA51253a58bfb4c8124ad4f7655b99bfdea290033a085e0796b19245b33b91c0948fdac9f0c3e817130b352493a65d9a7a0fc8a7c1eedc618cdaa2b4580734a11cd9c