Overview
overview
5Static
static
1URLScan
urlscan
1https://webminer.pag...
windows7-x64
3https://webminer.pag...
windows10-1703-x64
3https://webminer.pag...
windows10-2004-x64
5https://webminer.pag...
windows11-21h2-x64
5https://webminer.pag...
android-10-x64
1https://webminer.pag...
android-11-x64
1https://webminer.pag...
android-13-x64
1https://webminer.pag...
android-9-x86
1https://webminer.pag...
ubuntu-18.04-amd64
3https://webminer.pag...
ubuntu-20.04-amd64
4https://webminer.pag...
ubuntu-22.04-amd64
3https://webminer.pag...
ubuntu-24.04-amd64
4Analysis
-
max time kernel
0s -
max time network
3s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
31-08-2024 15:03
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://webminer.pages.dev?algorithm=yespowerurx&host=yespowerURX.sea.mine.zpool.ca&port=6236&worker=DSvLZDmch7n5X3RwfgXs6pncT2BEToPQxv&password=c%3DDOGE%2Czap%3DURX&workers=1.5
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
https://webminer.pages.dev?algorithm=yespowerurx&host=yespowerURX.sea.mine.zpool.ca&port=6236&worker=DSvLZDmch7n5X3RwfgXs6pncT2BEToPQxv&password=c%3DDOGE%2Czap%3DURX&workers=1.5
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
https://webminer.pages.dev?algorithm=yespowerurx&host=yespowerURX.sea.mine.zpool.ca&port=6236&worker=DSvLZDmch7n5X3RwfgXs6pncT2BEToPQxv&password=c%3DDOGE%2Czap%3DURX&workers=1.5
Resource
win10v2004-20240802-en
Behavioral task
behavioral4
Sample
https://webminer.pages.dev?algorithm=yespowerurx&host=yespowerURX.sea.mine.zpool.ca&port=6236&worker=DSvLZDmch7n5X3RwfgXs6pncT2BEToPQxv&password=c%3DDOGE%2Czap%3DURX&workers=1.5
Resource
win11-20240802-en
Behavioral task
behavioral5
Sample
https://webminer.pages.dev?algorithm=yespowerurx&host=yespowerURX.sea.mine.zpool.ca&port=6236&worker=DSvLZDmch7n5X3RwfgXs6pncT2BEToPQxv&password=c%3DDOGE%2Czap%3DURX&workers=1.5
Resource
android-x64-20240624-en
Behavioral task
behavioral6
Sample
https://webminer.pages.dev?algorithm=yespowerurx&host=yespowerURX.sea.mine.zpool.ca&port=6236&worker=DSvLZDmch7n5X3RwfgXs6pncT2BEToPQxv&password=c%3DDOGE%2Czap%3DURX&workers=1.5
Resource
android-x64-arm64-20240624-en
Behavioral task
behavioral7
Sample
https://webminer.pages.dev?algorithm=yespowerurx&host=yespowerURX.sea.mine.zpool.ca&port=6236&worker=DSvLZDmch7n5X3RwfgXs6pncT2BEToPQxv&password=c%3DDOGE%2Czap%3DURX&workers=1.5
Resource
android-33-x64-arm64-20240624-en
Behavioral task
behavioral8
Sample
https://webminer.pages.dev?algorithm=yespowerurx&host=yespowerURX.sea.mine.zpool.ca&port=6236&worker=DSvLZDmch7n5X3RwfgXs6pncT2BEToPQxv&password=c%3DDOGE%2Czap%3DURX&workers=1.5
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral9
Sample
https://webminer.pages.dev?algorithm=yespowerurx&host=yespowerURX.sea.mine.zpool.ca&port=6236&worker=DSvLZDmch7n5X3RwfgXs6pncT2BEToPQxv&password=c%3DDOGE%2Czap%3DURX&workers=1.5
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral10
Sample
https://webminer.pages.dev?algorithm=yespowerurx&host=yespowerURX.sea.mine.zpool.ca&port=6236&worker=DSvLZDmch7n5X3RwfgXs6pncT2BEToPQxv&password=c%3DDOGE%2Czap%3DURX&workers=1.5
Resource
ubuntu2004-amd64-20240611-en
Behavioral task
behavioral11
Sample
https://webminer.pages.dev?algorithm=yespowerurx&host=yespowerURX.sea.mine.zpool.ca&port=6236&worker=DSvLZDmch7n5X3RwfgXs6pncT2BEToPQxv&password=c%3DDOGE%2Czap%3DURX&workers=1.5
Resource
ubuntu2204-amd64-20240611-en
Behavioral task
behavioral12
Sample
https://webminer.pages.dev?algorithm=yespowerurx&host=yespowerURX.sea.mine.zpool.ca&port=6236&worker=DSvLZDmch7n5X3RwfgXs6pncT2BEToPQxv&password=c%3DDOGE%2Czap%3DURX&workers=1.5
Resource
ubuntu2404-amd64-20240523-en
General
-
Target
https://webminer.pages.dev?algorithm=yespowerurx&host=yespowerURX.sea.mine.zpool.ca&port=6236&worker=DSvLZDmch7n5X3RwfgXs6pncT2BEToPQxv&password=c%3DDOGE%2Czap%3DURX&workers=1.5
Malware Config
Signatures
-
Enumerates kernel/hardware configuration 1 TTPs 2 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/module/apparmor/parameters/enabled dbus-daemon File opened for reading /sys/kernel/security/apparmor/features/dbus/mask dbus-daemon -
Reads runtime system information 27 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/1608/status dbus-daemon File opened for reading /proc/1568/cmdline dbus-daemon File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/filesystems sed File opened for reading /proc/self/fd dbus-send File opened for reading /proc/filesystems sed File opened for reading /proc/self/maps grep File opened for reading /proc/filesystems sed File opened for reading /proc/self/maps grep File opened for reading /proc/1608/attr/apparmor/current dbus-daemon File opened for reading /proc/1631/cmdline dbus-daemon File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/mounts dbus-daemon File opened for reading /proc/self/fd dbus-send File opened for reading /proc/filesystems dbus-daemon File opened for reading /proc/sys/kernel/cap_last_cap dbus-daemon File opened for reading /proc/filesystems sed File opened for reading /proc/filesystems sed
Processes
-
/usr/bin/xdg-openxdg-open "https://webminer.pages.dev?algorithm=yespowerurx&host=yespowerURX.sea.mine.zpool.ca&port=6236&worker=DSvLZDmch7n5X3RwfgXs6pncT2BEToPQxv&password=c%3DDOGE%2Czap%3DURX&workers=1.5"1⤵PID:1565
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager2⤵
- Reads runtime system information
PID:1568 -
/usr/bin/dbus-launchdbus-launch --autolaunch f2de92a803c744e586bd87567a26b68a --binary-syntax --close-stderr3⤵PID:1577
-
/usr/bin/dbus-daemon/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session4⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1585
-
-
-
-
/usr/bin/grepgrep " = \\\"xfce4\\\"\$"2⤵
- Reads runtime system information
PID:1614
-
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE2⤵PID:1613
-
-
/usr/bin/grepgrep -i "^xfce_desktop_window"2⤵
- Reads runtime system information
PID:1619
-
-
/usr/bin/xpropxprop -root2⤵PID:1618
-
-
/usr/bin/grepgrep -q "^Enlightenment"2⤵
- Reads runtime system information
PID:1621
-
-
/usr/bin/unameuname2⤵PID:1622
-
-
/usr/bin/grepgrep -q "^file://"2⤵
- Reads runtime system information
PID:1624
-
-
/usr/bin/egrepegrep -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1626
-
-
/usr/local/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1626
-
-
/usr/local/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1626
-
-
/usr/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1626
-
-
/usr/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
- Reads runtime system information
PID:1626
-
-
/usr/bin/sedsed -n "s/\\(^[[:alnum:]+\\.-]*\\):.*\$/\\1/p"2⤵
- Reads runtime system information
PID:1629
-
-
/usr/bin/xdg-mimexdg-mime query default x-scheme-handler/https2⤵PID:1630
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager3⤵
- Reads runtime system information
PID:1631 -
/usr/bin/dbus-launchdbus-launch --autolaunch f2de92a803c744e586bd87567a26b68a --binary-syntax --close-stderr4⤵PID:1632
-
-
-
/usr/bin/grepgrep " = \\\"xfce4\\\"\$"3⤵
- Reads runtime system information
PID:1634
-
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE3⤵PID:1633
-
-
/usr/bin/grepgrep -i "^xfce_desktop_window"3⤵
- Reads runtime system information
PID:1636
-
-
/usr/bin/xpropxprop -root3⤵PID:1635
-
-
/usr/bin/grepgrep -q "^Enlightenment"3⤵
- Reads runtime system information
PID:1638
-
-
/usr/bin/unameuname3⤵PID:1639
-
-
/usr/bin/sedsed "s/:/ /g"3⤵
- Reads runtime system information
PID:1642
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:1647
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:1646
-
-
/usr/bin/headhead -n 13⤵PID:1645
-
-
/usr/bin/grepgrep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵
- Reads runtime system information
PID:1644
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:1652
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:1651
-
-
/usr/bin/headhead -n 13⤵PID:1650
-
-
/usr/bin/grepgrep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵
- Reads runtime system information
PID:1649
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:1657
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:1656
-
-
/usr/bin/headhead -n 13⤵PID:1655
-
-
/usr/bin/grepgrep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵
- Reads runtime system information
PID:1654
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:1662
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:1661
-
-
/usr/bin/headhead -n 13⤵PID:1660
-
-
/usr/bin/grepgrep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵
- Reads runtime system information
PID:1659
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:1667
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:1666
-
-
/usr/bin/headhead -n 13⤵PID:1665
-
-
/usr/bin/grepgrep "x-scheme-handler/https=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache3⤵
- Reads runtime system information
PID:1664
-
-
-
/usr/bin/sedsed "s/:/ /g"2⤵
- Reads runtime system information
PID:1670
-
-
/usr/bin/sedsed -e "s|-|/|"2⤵
- Reads runtime system information
PID:1673
-
-
/usr/bin/sedsed -e "s|-|/|"2⤵
- Reads runtime system information
PID:1676
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:1681
-
-
/usr/bin/whichwhich firefox2⤵PID:1682
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:1685
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:1688
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:1693
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:1696
-
-
/usr/bin/firefox/usr/bin/firefox "https://webminer.pages.dev?algorithm=yespowerurx&host=yespowerURX.sea.mine.zpool.ca&port=6236&worker=DSvLZDmch7n5X3RwfgXs6pncT2BEToPQxv&password=c%3DDOGE%2Czap%3DURX&workers=1.5"2⤵PID:1697
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
465B
MD552049fc53bb807fe9ee1e1066a1dbd20
SHA1776182cca2685648fcfcb75034fd78b4998c7f39
SHA2567a7be0e974c6701c261e2feab4ad6990c95271059166f0d7a19ee49fce6be44b
SHA51277a08c3c1ba4a557f8fda811b6a4530ba12519e307aa95bc831448e18527d8e753035b23b4472abc79d55bef021bc21dfb800a0143eeea37a5cae4a9d67789d7