Overview
overview
4Static
static
1URLScan
urlscan
1https://google.com/b...
debian-12-armhf
https://google.com/b...
debian-12-mipsel
https://google.com/b...
debian-9-armhf
https://google.com/b...
debian-9-mips
https://google.com/b...
debian-9-mipsel
https://google.com/b...
ubuntu-18.04-amd64
3https://google.com/b...
ubuntu-20.04-amd64
4https://google.com/b...
ubuntu-22.04-amd64
3https://google.com/b...
ubuntu-24.04-amd64
4Resubmissions
09-10-2024 00:43
241009-a249qsvcnl 508-10-2024 20:35
241008-zdbpystflr 108-10-2024 15:53
241008-tbz2wateqp 108-10-2024 15:41
241008-s458xsxbpd 307-10-2024 22:15
241007-158z7szckg 318-08-2024 16:01
240818-tf7bra1frh 430-07-2024 22:18
240730-17zjjswemb 330-07-2024 22:15
240730-16hveasbmm 430-07-2024 22:11
240730-137pcswcpd 430-07-2024 22:08
240730-116paawbpa 3Analysis
-
max time kernel
43s -
max time network
41s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
30-07-2024 22:15
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://google.com/bebra.dod
Resource
debian12-armhf-20240418-en
Behavioral task
behavioral2
Sample
https://google.com/bebra.dod
Resource
debian12-mipsel-20240221-en
Behavioral task
behavioral3
Sample
https://google.com/bebra.dod
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral4
Sample
https://google.com/bebra.dod
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral5
Sample
https://google.com/bebra.dod
Resource
debian9-mipsel-20240729-en
Behavioral task
behavioral6
Sample
https://google.com/bebra.dod
Resource
ubuntu1804-amd64-20240729-en
Behavioral task
behavioral7
Sample
https://google.com/bebra.dod
Resource
ubuntu2004-amd64-20240611-en
Behavioral task
behavioral8
Sample
https://google.com/bebra.dod
Resource
ubuntu2204-amd64-20240611-en
Behavioral task
behavioral9
Sample
https://google.com/bebra.dod
Resource
ubuntu2404-amd64-20240523-en
General
-
Target
https://google.com/bebra.dod
Malware Config
Signatures
-
Enumerates kernel/hardware configuration 1 TTPs 2 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
Processes:
dbus-daemondescription ioc process File opened for reading /sys/module/apparmor/parameters/enabled dbus-daemon File opened for reading /sys/kernel/security/apparmor/features/dbus/mask dbus-daemon -
Reads runtime system information 27 IoCs
Reads data from /proc virtual filesystem.
Processes:
dbus-sendgrepgrepsedseddbus-daemongrepgrepgrepgrepgrepgrepgrepdbus-sendgrepsedgrepgrepgrepsedseddescription ioc process File opened for reading /proc/self/fd dbus-send File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/filesystems sed File opened for reading /proc/filesystems sed File opened for reading /proc/filesystems dbus-daemon File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/sys/kernel/cap_last_cap dbus-daemon File opened for reading /proc/1573/cmdline dbus-daemon File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/mounts dbus-daemon File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/fd dbus-send File opened for reading /proc/1578/attr/apparmor/current dbus-daemon File opened for reading /proc/self/maps grep File opened for reading /proc/filesystems sed File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/filesystems sed File opened for reading /proc/1578/status dbus-daemon File opened for reading /proc/1594/cmdline dbus-daemon File opened for reading /proc/filesystems sed
Processes
-
/usr/bin/xdg-openxdg-open https://google.com/bebra.dod1⤵PID:1572
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager2⤵
- Reads runtime system information
PID:1573 -
/usr/bin/dbus-launchdbus-launch --autolaunch f2de92a803c744e586bd87567a26b68a --binary-syntax --close-stderr3⤵PID:1574
-
/usr/bin/dbus-daemon/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session4⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1576 -
/usr/bin/grepgrep " = \\\"xfce4\\\"\$"2⤵
- Reads runtime system information
PID:1580 -
/usr/bin/xpropxprop -root _DT_SAVE_MODE2⤵PID:1579
-
/usr/bin/grepgrep -i "^xfce_desktop_window"2⤵
- Reads runtime system information
PID:1582 -
/usr/bin/xpropxprop -root2⤵PID:1581
-
/usr/bin/grepgrep -q "^Enlightenment"2⤵
- Reads runtime system information
PID:1584 -
/usr/bin/unameuname2⤵PID:1585
-
/usr/bin/grepgrep -q "^file://"2⤵
- Reads runtime system information
PID:1587 -
/usr/bin/egrepegrep -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1589
-
/usr/local/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1589
-
/usr/local/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1589
-
/usr/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1589
-
/usr/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
- Reads runtime system information
PID:1589 -
/usr/bin/sedsed -n "s/\\(^[[:alnum:]+\\.-]*\\):.*\$/\\1/p"2⤵
- Reads runtime system information
PID:1592 -
/usr/bin/xdg-mimexdg-mime query default x-scheme-handler/https2⤵PID:1593
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager3⤵
- Reads runtime system information
PID:1594 -
/usr/bin/dbus-launchdbus-launch --autolaunch f2de92a803c744e586bd87567a26b68a --binary-syntax --close-stderr4⤵PID:1595
-
/usr/bin/grepgrep " = \\\"xfce4\\\"\$"3⤵
- Reads runtime system information
PID:1597 -
/usr/bin/xpropxprop -root _DT_SAVE_MODE3⤵PID:1596
-
/usr/bin/grepgrep -i "^xfce_desktop_window"3⤵
- Reads runtime system information
PID:1599 -
/usr/bin/xpropxprop -root3⤵PID:1598
-
/usr/bin/grepgrep -q "^Enlightenment"3⤵
- Reads runtime system information
PID:1601 -
/usr/bin/unameuname3⤵PID:1602
-
/usr/bin/sedsed "s/:/ /g"3⤵
- Reads runtime system information
PID:1605 -
/usr/bin/cutcut -d ";" -f 13⤵PID:1610
-
/usr/bin/cutcut -d "=" -f 23⤵PID:1609
-
/usr/bin/headhead -n 13⤵PID:1608
-
/usr/bin/grepgrep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵
- Reads runtime system information
PID:1607 -
/usr/bin/cutcut -d ";" -f 13⤵PID:1615
-
/usr/bin/cutcut -d "=" -f 23⤵PID:1614
-
/usr/bin/headhead -n 13⤵PID:1613
-
/usr/bin/grepgrep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵
- Reads runtime system information
PID:1612 -
/usr/bin/cutcut -d ";" -f 13⤵PID:1620
-
/usr/bin/cutcut -d "=" -f 23⤵PID:1619
-
/usr/bin/headhead -n 13⤵PID:1618
-
/usr/bin/grepgrep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵
- Reads runtime system information
PID:1617 -
/usr/bin/cutcut -d ";" -f 13⤵PID:1625
-
/usr/bin/cutcut -d "=" -f 23⤵PID:1624
-
/usr/bin/headhead -n 13⤵PID:1623
-
/usr/bin/grepgrep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵
- Reads runtime system information
PID:1622 -
/usr/bin/cutcut -d ";" -f 13⤵PID:1630
-
/usr/bin/cutcut -d "=" -f 23⤵PID:1629
-
/usr/bin/headhead -n 13⤵PID:1628
-
/usr/bin/grepgrep "x-scheme-handler/https=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache3⤵
- Reads runtime system information
PID:1627 -
/usr/bin/sedsed "s/:/ /g"2⤵
- Reads runtime system information
PID:1633 -
/usr/bin/sedsed -e "s|-|/|"2⤵
- Reads runtime system information
PID:1636 -
/usr/bin/sedsed -e "s|-|/|"2⤵
- Reads runtime system information
PID:1639 -
/usr/bin/cutcut "-d=" -f 2-2⤵PID:1644
-
/usr/bin/whichwhich firefox2⤵PID:1645
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:1648
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:1651
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:1662
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:1668
-
/usr/bin/firefox/usr/bin/firefox https://google.com/bebra.dod2⤵PID:1669
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
/root/.dbus/session-bus/f2de92a803c744e586bd87567a26b68a-0Filesize
465B
MD5cbdbe639d58223ae957a6e01fd13de46
SHA1901a8c8814f2546b7945baae0ca4174c9de20a81
SHA256935bd8298ee5e7a000d1f0c7b80b721e7f46ff99f0e8960b8f656307a5da00d2
SHA5129663f33ceaf861ec4f698ca8cb54757a84544491bfb49ee72dc24fce41d36013f1066630797fbfdaca46c14f7bad8c29a59171d0e50028316c00abc4acf0d5e0