hxxps://github[.]com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure[.]apk

max time kernel
149s
max time network
150s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240729-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240729-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
18/03/2025, 23:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk

Score

6^/10

antivm discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
80	raw.githubusercontent.com
81	raw.githubusercontent.com
82	raw.githubusercontent.com
83	raw.githubusercontent.com
91	raw.githubusercontent.com

Changes its process name 64 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1647	firefox
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1647	firefox
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	1647	firefox
Changes the process name, possibly in an attempt to hide itself	glean.dispatche	1646	firefox
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1652	firefox
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	1652	firefox
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1651	firefox
Changes the process name, possibly in an attempt to hide itself	IPDL Background	1651	firefox
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1650	firefox
Changes the process name, possibly in an attempt to hide itself	Socket Thread	1650	firefox
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1653	firefox
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	1653	firefox
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1649	firefox
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	1649	firefox
Changes the process name, possibly in an attempt to hide itself	Timer	1648	firefox
Changes the process name, possibly in an attempt to hide itself	Timer	1648	firefox
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1655	firefox
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	1655	firefox
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1657	firefox
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	1657	firefox
Changes the process name, possibly in an attempt to hide itself	Cache2 I/O	1658	firefox
Changes the process name, possibly in an attempt to hide itself	Cookie	1659	firefox
Changes the process name, possibly in an attempt to hide itself	Cookie	1659	firefox
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #1	1662	firefox
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1660	firefox
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	1660	firefox
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #0	1661	firefox
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1663	firefox
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	1663	firefox
Changes the process name, possibly in an attempt to hide itself	Worker Launcher	1664	firefox
Changes the process name, possibly in an attempt to hide itself	Worker Launcher	1664	firefox
Changes the process name, possibly in an attempt to hide itself	gmain	1665	firefox
Changes the process name, possibly in an attempt to hide itself	gdbus	1667	firefox
Changes the process name, possibly in an attempt to hide itself	gmain	1670	xdg-desktop-portal
Changes the process name, possibly in an attempt to hide itself	gdbus	1671	xdg-desktop-portal
Changes the process name, possibly in an attempt to hide itself	pool	1672	xdg-desktop-portal
Changes the process name, possibly in an attempt to hide itself	gdbus	1676	xdg-document-portal
Changes the process name, possibly in an attempt to hide itself	gmain	1675	xdg-document-portal
Changes the process name, possibly in an attempt to hide itself	pool	1680	xdg-permission-store
Changes the process name, possibly in an attempt to hide itself	gmain	1679	xdg-permission-store
Changes the process name, possibly in an attempt to hide itself	gdbus	1681	xdg-permission-store
Changes the process name, possibly in an attempt to hide itself	pool	1682	xdg-document-portal
Changes the process name, possibly in an attempt to hide itself	fuse mainloop	1684	xdg-document-portal
Changes the process name, possibly in an attempt to hide itself	dconf worker	1687	xdg-desktop-portal
Changes the process name, possibly in an attempt to hide itself	gdbus	1691	xdg-desktop-portal-gtk
Changes the process name, possibly in an attempt to hide itself	gmain	1690	xdg-desktop-portal-gtk
Changes the process name, possibly in an attempt to hide itself	gdbus	1695	gvfsd
Changes the process name, possibly in an attempt to hide itself	gmain	1694	gvfsd
Changes the process name, possibly in an attempt to hide itself	pool	1696	gvfsd
Changes the process name, possibly in an attempt to hide itself	gmain	1702	gvfsd-fuse
Changes the process name, possibly in an attempt to hide itself	gdbus	1703	gvfsd-fuse
Changes the process name, possibly in an attempt to hide itself	gvfs-fuse-sub	1704	gvfsd-fuse
Changes the process name, possibly in an attempt to hide itself	pool	1705	xdg-desktop-portal-gtk
Changes the process name, possibly in an attempt to hide itself	pool	1708	xdg-desktop-portal-gtk
Changes the process name, possibly in an attempt to hide itself	pool	1707	xdg-desktop-portal-gtk
Changes the process name, possibly in an attempt to hide itself	pool	1706	xdg-desktop-portal-gtk
Changes the process name, possibly in an attempt to hide itself	Softwar~cThread	1709	firefox
Changes the process name, possibly in an attempt to hide itself	Softwar~cThread	1709	firefox
Changes the process name, possibly in an attempt to hide itself	Softwar~cThread	1709	firefox
Changes the process name, possibly in an attempt to hide itself	Compositor	1714	firefox
Changes the process name, possibly in an attempt to hide itself	Compositor	1714	firefox
Changes the process name, possibly in an attempt to hide itself	WRWorkerLP#0	1713	firefox
Changes the process name, possibly in an attempt to hide itself	WRWorker#0	1712	firefox
Changes the process name, possibly in an attempt to hide itself	Renderer	1711	firefox

Checks CPU configuration 1 TTPs 2 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	firefox
File opened for reading	/proc/cpuinfo	firefox

Reads CPU attributes 1 TTPs 23 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/online	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/online	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/size	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/size	firefox
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/size	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/size	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox
File opened for reading	/sys/devices/system/cpu/present	firefox

Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/resource	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/vendor	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/irq	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/device	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/vendor	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/resource	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/device	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/resource	firefox
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_device	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/vendor	firefox
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/uevent	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/class	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/resource	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/vendor	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/irq	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/device	firefox
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/irq	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/irq	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/irq	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/irq	firefox
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/uevent	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/resource	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/device	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/device	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/irq	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/class	firefox
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/vendor	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/vendor	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/class	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/device	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/irq	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/class	firefox
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_vendor	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/irq	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/vendor	firefox
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_vendor	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/vendor	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/resource	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/device	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/device	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/vendor	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/vendor	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/class	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/devices/system/cpu	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/device	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/vendor	firefox
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/device	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/resource	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/irq	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/device	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/vendor	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/resource	firefox
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/resource	firefox

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/mounts	dbus-daemon
File opened for reading	/proc/self/fd	dbus-send
File opened for reading	/proc/1640/cmdline	dbus-daemon
File opened for reading	/proc/self/mountinfo	firefox
File opened for reading	/proc/self/cgroup	firefox
File opened for reading	/proc/1674/cmdline	dbus-daemon
File opened for reading	/proc/self/task/1751/stat	firefox
File opened for reading	/proc/self/cgroup	firefox
File opened for reading	/proc/self/fd/126	firefox
File opened for reading	/proc/self/task/1837/stat	firefox
File opened for reading	/proc/self/fd/70	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/stat	firefox
File opened for reading	/proc/self/fd/57	firefox
File opened for reading	/proc/self/fd/69	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/fd/113	firefox
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/1698/cmdline	dbus-daemon
File opened for reading	/proc/self/fd/128	firefox
File opened for reading	/proc/self/stat	firefox
File opened for reading	/proc/self/fd/51	firefox
File opened for reading	/proc/self/fd/137	firefox
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/fd/78	firefox
File opened for reading	/proc/self/fd/75	firefox
File opened for reading	/proc/self/task/1726/stat	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/fd/120	firefox
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/fd/78	firefox
File opened for reading	/proc/self/fd/151	firefox
File opened for reading	/proc/filesystems	xdg-document-portal
File opened for reading	/proc/self/fd	firefox
File opened for reading	/proc/sys/kernel/cap_last_cap	dbus-daemon
File opened for reading	/proc/self/task/1642/stat	firefox
File opened for reading	/proc/1669/cmdline	dbus-daemon
File opened for reading	/proc/self/stat	firefox
File opened for reading	/proc/self/stat	firefox
File opened for reading	/proc/self/fd/72	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd/6	firefox
File opened for reading	/proc/self/stat	firefox
File opened for reading	/proc/self/fd/124	firefox
File opened for reading	/proc/self/fd	dbus-send
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/1895/cmdline	dbus-daemon
File opened for reading	/proc/self/fd/64	firefox
File opened for reading	/proc/self/fd/77	firefox
File opened for reading	/proc/meminfo	firefox
File opened for reading	/proc/filesystems	firefox
File opened for reading	/proc/self/fd/57	firefox
File opened for reading	/proc/1558/attr/current	dbus-daemon
File opened for reading	/proc/self/maps	firefox
File opened for reading	/proc/self/fd/10	firefox
File opened for reading	/proc/self/fd/68	firefox
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	xdg-desktop-portal

System Information Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the system, such as OS, hostname, and hardware details.

discovery

System Information Discovery

T1082

pid	Process
1656	lsb_release
2401	lsb_release

System Network Configuration Discovery 1 TTPs 4 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1898	unzip
1898	unzip
1898	unzip
1898	unzip

Writes file to tmp directory 9 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/tmpaddon-1	firefox
File opened for modification	/tmp/toJAaSBl.exe	firefox
File opened for modification	/tmp/tmpaddon-1	firefox
File opened for modification	/tmp/tmpaddon-3	firefox
File opened for modification	/tmp/tmpaddon	firefox
File opened for modification	/tmp/firefox/.parentlock	firefox
File opened for modification	/tmp/tmpaddon	firefox
File opened for modification	/tmp/tmpaddon-2	firefox
File opened for modification	/tmp/firefox/.parentlock	firefox

/usr/bin/xdg-open
xdg-open https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
1⤵
PID:1552
- /usr/bin/dbus-send
  dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
  2⤵
  - Reads runtime system information
  PID:1553
- - /usr/bin/dbus-launch
    dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
    3⤵
    PID:1554
  - - /usr/bin/dbus-daemon
      /usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session
      4⤵
      Reads runtime system information
      PID:1556
    - - /usr/libexec/xdg-desktop-portal
        
        /usr/libexec/xdg-desktop-portal
        5⤵
        Changes its process name
        Reads runtime system information
        
        PID:1669
    - - /usr/libexec/xdg-document-portal
        
        /usr/libexec/xdg-document-portal
        5⤵
        Changes its process name
        Reads runtime system information
        
        PID:1674
    - - /usr/libexec/xdg-permission-store
        
        /usr/libexec/xdg-permission-store
        5⤵
        Changes its process name
        
        PID:1678
    - - /usr/libexec/xdg-desktop-portal-gtk
        
        /usr/libexec/xdg-desktop-portal-gtk
        5⤵
        Changes its process name
        
        PID:1689
    - - /usr/lib/gvfs/gvfsd
        
        /usr/lib/gvfs/gvfsd
        5⤵
        Changes its process name
        
        PID:1693
    - - /usr/lib/dconf/dconf-service
        
        /usr/lib/dconf/dconf-service
        5⤵
        
        PID:1895
- /bin/grep
  grep " = \\\"xfce4\\\"\$"
  2⤵
  PID:1560
- /usr/bin/xprop
  xprop -root _DT_SAVE_MODE
  2⤵
  PID:1559
- /bin/grep
  grep -i "^xfce_desktop_window"
  2⤵
  PID:1562
- /usr/bin/xprop
  xprop -root
  2⤵
  PID:1561
- /bin/grep
  grep -q "^Enlightenment"
  2⤵
  PID:1564
- /bin/uname
  uname
  2⤵
  PID:1565
- /bin/grep
  grep -q "^file://"
  2⤵
  PID:1567
- /bin/egrep
  egrep -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1569
- /usr/local/sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1569
- /usr/local/bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1569
- /usr/sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1569
- /usr/bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1569
- /sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1569
- /bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:1569
- /bin/sed
  sed -n "s/\$^[[:alnum:]+\\.-]*\$:.*\$/\\1/p"
  2⤵
  - Reads runtime system information
  PID:1572
- /usr/bin/xdg-mime
  xdg-mime query default x-scheme-handler/https
  2⤵
  PID:1573
- - /usr/bin/dbus-send
    dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
    3⤵
    - Reads runtime system information
    PID:1574
  - - /usr/bin/dbus-launch
      dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
      4⤵
      PID:1575
- - /bin/grep
    grep " = \\\"xfce4\\\"\$"
    3⤵
    PID:1577
- - /usr/bin/xprop
    xprop -root _DT_SAVE_MODE
    3⤵
    PID:1576
- - /bin/grep
    grep -i "^xfce_desktop_window"
    3⤵
    PID:1579
- - /usr/bin/xprop
    xprop -root
    3⤵
    PID:1578
- - /bin/grep
    grep -q "^Enlightenment"
    3⤵
    PID:1581
- - /bin/uname
    uname
    3⤵
    PID:1582
- - /bin/sed
    sed "s/:/ /g"
    3⤵
    - Reads runtime system information
    PID:1585
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:1590
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:1589
- - /usr/bin/head
    head -n 1
    3⤵
    PID:1588
- - /bin/grep
    grep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
    3⤵
    PID:1587
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:1595
- - /usr/bin/head
    head -n 1
    3⤵
    PID:1593
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:1594
- - /bin/grep
    grep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
    3⤵
    PID:1592
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:1600
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:1599
- - /usr/bin/head
    head -n 1
    3⤵
    PID:1598
- - /bin/grep
    grep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
    3⤵
    PID:1597
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:1605
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:1604
- - /usr/bin/head
    head -n 1
    3⤵
    PID:1603
- - /bin/grep
    grep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
    3⤵
    PID:1602
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:1610
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:1609
- - /usr/bin/head
    head -n 1
    3⤵
    PID:1608
- - /bin/grep
    grep "x-scheme-handler/https=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache
    3⤵
    PID:1607
- /bin/sed
  sed "s/:/ /g"
  2⤵
  PID:1613
- /bin/sed
  sed -e "s|-|/|"
  2⤵
  - Reads runtime system information
  PID:1616
- /bin/sed
  sed -e "s|-|/|"
  2⤵
  - Reads runtime system information
  PID:1619
- /usr/bin/cut
  cut "-d=" -f 2-
  2⤵
  PID:1627
- /usr/bin/which
  which firefox
  2⤵
  PID:1628
- /usr/bin/cut
  cut "-d=" -f 2-
  2⤵
  PID:1631
- /usr/bin/cut
  cut "-d=" -f 2-
  2⤵
  PID:1634
- /usr/bin/cut
  cut "-d=" -f 2-
  2⤵
  PID:1639
- /usr/bin/firefox
  /usr/bin/firefox https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
  2⤵
  PID:1640
- - /usr/bin/which
    which /usr/bin/firefox
    3⤵
    PID:1641
- /usr/lib/firefox/firefox
  /usr/lib/firefox/firefox https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/Mobile_Legends_Adventure.apk
  2⤵
  - Changes its process name
  - Checks CPU configuration
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1640
- - /usr/bin/dbus-launch
    dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
    3⤵
    PID:1645
- - /usr/bin/lsb_release
    /usr/bin/lsb_release -idrc
    3⤵
    - System Information Discovery
    PID:1656
- - /usr/local/sbin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1666
- - /usr/local/bin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1666
- - /usr/sbin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1666
- - /usr/bin/dbus-launch
    dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
    3⤵
    PID:1666
- - /usr/lib/firefox/firefox
    /usr/lib/firefox/firefox -contentproc -parentBuildID 20230522134052 -prefsLen 21460 -prefMapSize 234909 -appDir /usr/lib/firefox/browser "{0ad0d594-0986-4bb9-b6b2-a75508dab3d3}" 1640 true socket
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1724
- - /usr/lib/firefox/firefox
    /usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 19657 -prefMapSize 234909 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{ccb75b6f-2f2c-4525-b53d-84157a59f622}" 1640 true tab
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1741
- - /usr/lib/firefox/firefox
    /usr/lib/firefox/firefox -contentproc -childID 2 -isForBrowser -prefsLen 25980 -prefMapSize 234909 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{4843efb0-0f13-49a3-8137-58e4dd55aeec}" 1640 true tab
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1780
- - /usr/lib/firefox/firefox
    /usr/lib/firefox/firefox -contentproc -childID 3 -isForBrowser -prefsLen 24048 -prefMapSize 234909 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{4a933171-dd86-433f-8053-2205f52d2382}" 1640 true tab
    3⤵
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:1826
- - /usr/lib/firefox/firefox
    /usr/lib/firefox/firefox -contentproc -childID 4 -isForBrowser -prefsLen 24048 -prefMapSize 234909 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{1942f93a-49c1-47bd-8e24-3fa54fc2fd27}" 1640 true tab
    3⤵
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:1828
- - /usr/lib/firefox/firefox
    /usr/lib/firefox/firefox -contentproc -childID 5 -isForBrowser -prefsLen 24048 -prefMapSize 234909 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{e504dc29-60cd-447d-b5e0-23bcced8c444}" 1640 true tab
    3⤵
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:1830
- - /usr/lib/firefox/firefox
    /usr/lib/firefox/firefox -contentproc -childID 6 -isForBrowser -prefsLen 27751 -prefMapSize 234909 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{3377dfad-7b19-4ef8-a840-e272921574bb}" 1640 true tab
    3⤵
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:2360

/usr/lib/gvfs/gvfsd-fuse
/usr/lib/gvfs/gvfsd-fuse /root/.gvfs -f -o big_writes
1⤵
- Changes its process name
PID:1698

/usr/local/sbin/file-roller
file-roller /root/Downloads/Amus.exe
1⤵
PID:1887

/usr/local/bin/file-roller
file-roller /root/Downloads/Amus.exe
1⤵
PID:1887

/usr/sbin/file-roller
file-roller /root/Downloads/Amus.exe
1⤵
PID:1887

/usr/bin/file-roller
file-roller /root/Downloads/Amus.exe
1⤵
PID:1887
- /usr/local/sbin/dbus-launch
  dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
  2⤵
  PID:1891
- /usr/local/bin/dbus-launch
  dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
  2⤵
  PID:1891
- /usr/sbin/dbus-launch
  dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
  2⤵
  PID:1891
- /usr/bin/dbus-launch
  dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
  2⤵
  PID:1891
- /usr/local/sbin/unzip
  unzip -ZTs -- /root/Downloads/Amus.exe
  2⤵
  - System Network Configuration Discovery
  PID:1898
- /usr/local/bin/unzip
  unzip -ZTs -- /root/Downloads/Amus.exe
  2⤵
  - System Network Configuration Discovery
  PID:1898
- /usr/sbin/unzip
  unzip -ZTs -- /root/Downloads/Amus.exe
  2⤵
  - System Network Configuration Discovery
  PID:1898
- /usr/bin/unzip
  unzip -ZTs -- /root/Downloads/Amus.exe
  2⤵
  - System Network Configuration Discovery
  PID:1898

/usr/lib/firefox/firefox
/usr/lib/firefox/firefox
1⤵
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
PID:2384
- /usr/bin/dbus-launch
  dbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr
  2⤵
  PID:2390
- /usr/bin/lsb_release
  /usr/bin/lsb_release -idrc
  2⤵
  - System Information Discovery
  PID:2401
- /usr/local/sbin/dbus-launch
  dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
  2⤵
  PID:2411
- /usr/local/bin/dbus-launch
  dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
  2⤵
  PID:2411
- /usr/sbin/dbus-launch
  dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
  2⤵
  PID:2411
- /usr/bin/dbus-launch
  dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
  2⤵
  PID:2411
- /usr/lib/firefox/firefox
  /usr/lib/firefox/firefox -contentproc -parentBuildID 20230522134052 -prefsLen 18669 -prefMapSize 230797 -appDir /usr/lib/firefox/browser "{312ddaff-7c6b-428d-8a91-7e9c2b63e9bb}" 2384 true socket
  2⤵
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:2421
- /usr/lib/firefox/firefox
  /usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 24774 -prefMapSize 230797 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{0d97078a-0b30-4945-b90b-4f4130b9d8f4}" 2384 true tab
  2⤵
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:2462
- /usr/lib/firefox/firefox
  /usr/lib/firefox/firefox -contentproc -childID 2 -isForBrowser -prefsLen 25973 -prefMapSize 230797 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{a8b35660-2a38-4768-bbf4-57d7244b0d9b}" 2384 true tab
  2⤵
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:2479
- /usr/lib/firefox/firefox
  /usr/lib/firefox/firefox -contentproc -childID 3 -isForBrowser -prefsLen 30907 -prefMapSize 230797 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{186646e1-d83b-494d-b393-631edc20a33b}" 2384 true tab
  2⤵
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  PID:2524
- /usr/lib/firefox/firefox
  /usr/lib/firefox/firefox -contentproc -childID 4 -isForBrowser -prefsLen 30907 -prefMapSize 230797 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{73956c25-efb5-46b0-b827-b260ab3baf0d}" 2384 true tab
  2⤵
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:2529
- /usr/lib/firefox/firefox
  /usr/lib/firefox/firefox -contentproc -childID 5 -isForBrowser -prefsLen 30907 -prefMapSize 230797 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{f9e39d5f-a2d6-46be-933b-3beda0452221}" 2384 true tab
  2⤵
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  PID:2538

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/root/.cache/dconf/user

Filesize
2B

MD5
c4103f122d27677c9db144cae1394a66

SHA1
1489f923c4dca729178b3e3233458550d8dddf29

SHA256
96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

SHA512
5ea71dc6d0b4f57bf39aadd07c208c35f06cd2bac5fde210397f70de11d439c62ec1cdf3183758865fd387fcea0bada2f6c37a4a17851dd1d78fefe6f204ee54

Download Submit
/root/Desktop/Old Firefox Data/gagdcbml.default-release/AlternateServices.txt

Filesize
619B

MD5
53f9d1cd0eb254aa78386af2e1454bc0

SHA1
8e683a68df4ed5beb6e7d27b844ecb9dc2473866

SHA256
40a22b2799fd4700954055f721470aee71e1b55fd3276ff5a7fc19cc7b605150

SHA512
19e2c4ce9467a30f4d6fce6735233c3bc644ff8560c31bfe4acfac706ebc7a8d1a843c4bd5965c56b6af116cd84e6b8c8ad6ff8c5eddaaf785c7ae5d73b78c7a

Download Submit
/root/Desktop/Old Firefox Data/gagdcbml.default-release/SiteSecurityServiceState.txt

Filesize
723B

MD5
210feb6431a7a6e20227d45ede2da1b6

SHA1
1162484c26dd42e2584bd736552d868d38f1b8da

SHA256
20ffbd7d886a3b737bc4200b332038e745c119c0902fa547d5396710d7848a84

SHA512
3eb07f5df95e7a342addfe1f4a8fb449c148890dd5c56f9a6cc46b0fe2d1fcbd5c7553887f88a58d1ae05dd695b6aaab815988b97e75e7ea5a7b139b60eb1a05

Download Submit
/root/Desktop/Old Firefox Data/gagdcbml.default-release/addonStartup.json.lz4

Filesize
6KB

MD5
8e099010314d18178c3ffc8463df6187

SHA1
8af6e1a148c1d10b9ba6597eeadfaeda1a44d2c6

SHA256
a81ec32ddf03c7da4353fe10e743557212c5c4a2888b6626fccc5e6b29aa294f

SHA512
4b5de189e6f66b91ef43cd566045480f72f49f0c1873f280b21fc3842d22f3ace84bf8fe9e6cf5f57af9d3757194898268501c5217b72187c02c4fb84afc8959

Download Submit
/root/Desktop/Old Firefox Data/gagdcbml.default-release/compatibility.ini

Filesize
163B

MD5
fe452b7294d5928a9a5863b89ee0a6bd

SHA1
a5d4c245071fa96476ba48b4725bdae7f1b7940f

SHA256
d5bfb07561606a19aa96557ea109b175050dc0eb805cbef9c813503587d77900

SHA512
dc37d8507f08849e3382d2dbafd4a64555dbd57a288c95131e9aefb366630f1585811a9e1456b861bb9d2b816ed88b18ffb7580cd92b41bb9b0227ce1363843e

Download Submit
/root/Desktop/Old Firefox Data/gagdcbml.default-release/containers.json

Filesize
875B

MD5
26dd091069531a62061de8ca1c56d46b

SHA1
6c9daa73f096174f28f86c9bb245cb8a540f5c2d

SHA256
2cde4e7f9f1c6ab6fcf729370237845c72314a6c6d942fab1989f37e6c610a9a

SHA512
180d42c642f5d1126efbf89af33f1b4d1aa936aa530834b508eabcf3ec845aad91daa871ee6517e1181910f5720edbc3788d6a4b2455f1255d7b52b95de2d66d

Download Submit
/root/Desktop/Old Firefox Data/gagdcbml.default-release/content-prefs.sqlite

Filesize
224KB

MD5
1fc2e7b7fe2c5be305dfa9a2bbb60771

SHA1
4967389dea050001cb1af3ec799edb7805c3abb8

SHA256
1953edcac737d1ad3de6fbf69671163882fdc0be5bd21d00378d8d8c753c757a

SHA512
fba536378ab9b5f04d92f1029b92d255c7da445a29e2527647bc16e57d02c179de1e78a2de11db1b00cc54c24d3715980c84c0cde103f47c6150f2e7bb8f93d5

Download Submit
/root/Desktop/Old Firefox Data/gagdcbml.default-release/crashes/store.json.mozlz4

Filesize
66B

MD5
a6338865eb252d0ef8fcf11fa9af3f0d

SHA1
cecdd4c4dcae10c2ffc8eb938121b6231de48cd3

SHA256
078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965

SHA512
d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c

Download Submit
/root/Desktop/Old Firefox Data/gagdcbml.default-release/datareporting/glean/db/data.safe.bin

Filesize
16KB

MD5
b1d7f3a6cbb9104ed86dcc2bb4aaa9f5

SHA1
73fe03541d0ed63fbc69db17e98757e4ce2caee4

SHA256
a362e760f58106f71a1fe3bce3e09db23561aa00e1381a9d54a3c2692349eb28

SHA512
8ef4dca0dadc4c70fc8b8d3fbb0e3744ae7a6779afd54dd4359381474ea1cf573ae1e947ca23b913d00f4db8bf662025f69d67706fc18716bcdb37030a29f27d

Download Submit
/root/Desktop/Old Firefox Data/gagdcbml.default-release/datareporting/glean/events/pageload

Filesize
184B

MD5
20f4dd3f164dc7def00e2497dd9f4160

SHA1
deef09169246b0e921cd541c9f899306ac9667d8

SHA256
86431be0b8031832c1ea6f71954acb1ebd19f21431c9860524681d896972dae8

SHA512
d73c5606652b1be84099886ddc31c24bd4fb08728000148c3b069fec32dfa7b091f9edb18acd14b56fd1fed0345ac00d30adad863bdc7a00959d6a9d6283ff53

Download Submit
/root/Desktop/Old Firefox Data/gagdcbml.default-release/datareporting/state.json

Filesize
51B

MD5
00f8bc4ec3e9f9756dd68d3b6473b458

SHA1
059cdc634fb5cdd67fc5cff8414717803142a3ac

SHA256
fadb13338bcf3e25ae33893183beddd8456d2dea330b42636a2eccde401ce291

SHA512
5aff717b3c9f15a5aef8dce7979a44f2a718a15008fa3d17591890ef2dc9e87facada78f71eb2a8ff4ee724a7001b2133a0f40f42b4a39542c1dae959338f3aa

Download Submit
/root/Desktop/Old Firefox Data/gagdcbml.default-release/extension-preferences.json

Filesize
1KB

MD5
b05edbe89f08df03e3e86370ae3cc163

SHA1
250834a8708f073ca74eb7b44fee2014f54f26df

SHA256
e24bc493866f048d51d274bd7f674dc56d4875435a1ef6eec35224f9b99626fd

SHA512
bb29f3a3ed7cafbdde1464f8bedfe110afe63f58f682dac82bee8f588474f9abbdb257daf68506f694bf918105d633076dcf7996fa9891e94f767bd44fd00d90

Download Submit
/root/Desktop/Old Firefox Data/gagdcbml.default-release/extensions.json

Filesize
46KB

MD5
74c2e606bdeb23f928dc837ce5fd7022

SHA1
a588b07bfcc254bb52bd0ef7a0dbf01db015a7fb

SHA256
4a75af5e39a8b64ec0ff905b54d2f962a6b82d718d9ac2b1f1b5b203e618bdd0

SHA512
9eb490a9eccd8b80d6b7a143c091831a9dace746ca76272393a54a8a303dac929114998f8fc8544df3c6007eee2a300dfd7156b6525b61afb72059c16a39fe55

Download Submit
/root/Desktop/Old Firefox Data/gagdcbml.default-release/favicons.sqlite

Filesize
5.0MB

MD5
3ed79f01b04a0bda8364f422d90dbb4c

SHA1
29dbfda738b369c8f81918d318d97b36be4cd4e9

SHA256
d6b10198decee2c0f89ec1045cce8d40f938c30a67de744482f3c950b9872344

SHA512
4b57bf5adcb04d9c02ccccf317a6a1e15f66c582f0f43cf8e9dc8fc8f0ede794864be380b12054fb5caef2407d7fc8ded6391bae74d536a55a49565ff8b9ce27

Download Submit
/root/Desktop/Old Firefox Data/gagdcbml.default-release/gmp-gmpopenh264/1.8.1.2/gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
/root/Desktop/Old Firefox Data/gagdcbml.default-release/gmp-gmpopenh264/1.8.1.2/libgmpopenh264.so

Filesize
1.3MB

MD5
b2c1253e8a09cfe03b3d7f37de12dff7

SHA1
31835791d3f838d7b7b63e3f6d8a463388dd6b41

SHA256
990004dc8be970eb133c7bb9220c380ffbc19be991476bef446801e2c510640c

SHA512
121f154427c1176f5ab3b1b30b720a8dcc6345517f30e30c8b5598f297a744be0750b75bea6255e1eb653bc6ae2941eb1330d36b3150584caa93db76b2b76f5f

Download Submit
/root/Desktop/Old Firefox Data/gagdcbml.default-release/handlers.json

Filesize
410B

MD5
e7a65c5ead519a7b802f991353c26d3d

SHA1
34cc3c1cf9bd4912dba5fa422010934e46419fa3

SHA256
0e5ce92485da953757f615bad034a43032b220da18f8165dd85347851b56b2d2

SHA512
2a6034449ba6f5da8a77870ae665064047cea2460aeb4c8c0b62b308a403fdd30648150209aecc31ab1e50b6d9d94a1f51d3d7d50bbf35ec1b742bff2dbe788d

Download Submit
/root/Desktop/Old Firefox Data/gagdcbml.default-release/key4.db

Filesize
288KB

MD5
f565cba20d22a532d70cd26cb2de4ade

SHA1
b113e921557c7c42dacbf31c49f93b1a6ce86f64

SHA256
6bba8b0e3498a520664b4879f415e941d0e896fd5d67ca43f4ebf3446781b25e

SHA512
0fce343058a051beb648f093141889022f060903359448ef82e931541045b942eae1328813f84dfce70a0eab17f4210eed93e95d10f89a4d4facc99aa998ea31

Download Submit
/root/Desktop/Old Firefox Data/gagdcbml.default-release/permissions.sqlite

Filesize
96KB

MD5
fc3112910ced17dbf509bbfd65b87f7e

SHA1
728a81991079f307fd18b1537e8fe5282b1c6cb8

SHA256
50610ff5e02dc3a6dd14d8d99bb754b21ccadc461070d44f1a7777be585c0cdd

SHA512
b13b615cfffd619fde7fe23e8f2706618a1bbc9d23c0c3c68b9fbe2cd28b8d91462928013848c9fa1722770ebb0b8b9f974f8b16d8b9e71dcc45fda8272583f6

Download Submit
/root/Desktop/Old Firefox Data/gagdcbml.default-release/pkcs11.txt

Filesize
471B

MD5
725b15c46c71cd363975d18c5e3667fd

SHA1
5a501d274dfa4f228de6a557a45e1d5223245997

SHA256
734bbcfcdc96b7967cb4bf4dfd235a0f08a62cd0b598ce07dd1ba90a1071d2ee

SHA512
9866cb0d9a05947dad6c53c7a9e4f1e2fc3106ab1d9a60061217d4a799192e6b23d15e1d5d7abcd4ed24d26779f4ac2cb647d5a61ae38652a2ab73bd52791aa2

Download Submit
/root/Desktop/Old Firefox Data/gagdcbml.default-release/places.sqlite

Filesize
4.3MB

MD5
83f9b2ad2b4dfac77d5d0730f9190957

SHA1
49fb5c1c58697af23a55190597916afaf5ae5c22

SHA256
43edb6dbffd28305ae792afcd9d9d47b171ca6d7566e398f9ccfb12ffbca6e93

SHA512
fd6d046d3c1d59065dbc3395b19f3e32859eb454e1631d9f515ba1fdf3b74e6ba8a5b7dc8d8da587bbf59ccaf73d30c301f047f73040f838258e6f807b5aaa5d

Download Submit
/root/Desktop/Old Firefox Data/gagdcbml.default-release/prefs.js

Filesize
7KB

MD5
f8320cbe3779fa9fd83c0d2c76ef309c

SHA1
ed6ce667e55ce5a2f2bc94e6db2b0b83049aec34

SHA256
21765cd1c61a4e06493c08e51d476cd88f7e689077086bcf696a2b90fa60ce3a

SHA512
5a545e2dd701562925ef9340edb2cc0d2d28ee82e722e7551236f4315a79a4a03c9a8abc0198ecab83f001f98358b00942c30571037ca8299ee1e36116b57c55

Download Submit
/root/Desktop/Old Firefox Data/gagdcbml.default-release/protections.sqlite

Filesize
64KB

MD5
c7cc11494c34e02565df83d17beb33b3

SHA1
f379ad7c0fa73476d3828d8a89ef843046332c12

SHA256
7ca17bb171e22b4ec498c1d20587b30d62d773b114d0e66bb00ec874506eb85f

SHA512
0cfcb15a985a35e917c9652721b516e2d1c358c6db3dca4452e866d250b6269c4cc69773277f5ddd5a0c5a338f95d9f6134224f0097df194985161cd3d47cfd6

Download Submit
/root/Desktop/Old Firefox Data/gagdcbml.default-release/search.json.mozlz4

Filesize
417B

MD5
bc4f7d1944d9c43d92c73515a7fbf6a1

SHA1
9307799897301c454019ee80ed4e3d72effe9b3b

SHA256
7750da4fc49f0bb0433f0d8d2d03a8966e970d27f7341b0e3f7ec0925bcb97fb

SHA512
63066459186242a9969c280ee0b5edeaaaff0d1bdf24cf08b68cce1c01ce0d9f012c728170063128792ff791fad895400a0ba9c68417a6a44a9781798d1fb8bd

Download Submit
/root/Desktop/Old Firefox Data/gagdcbml.default-release/sessionCheckpoints.json

Filesize
288B

MD5
948a7403e323297c6bb8a5c791b42866

SHA1
88a555717e8a4a33eccfb7d47a2a4aa31038f9c0

SHA256
2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e

SHA512
17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a

Download Submit
/root/Desktop/Old Firefox Data/gagdcbml.default-release/sessionstore-backups/recovery.jsonlz4

Filesize
3KB

MD5
924a0811ab07790023dd75833ad2fe22

SHA1
c749b95d72046f98445b4a31dbf12d9c8ec32d87

SHA256
a71c5bf5c4f910bb3c74845da630afcd91af7d6d0e4c5873ee64ae8149c0b58f

SHA512
63c55899317f276ca5b31c4a051058f5a58f4a689271d00ed716c0db557fbc562f50bd08cf1a457c27f732b1391328a7b15673f626fdbe0356da24850a4a3d92

Download Submit
/root/Desktop/Old Firefox Data/gagdcbml.default-release/settings/data.safe.bin

Filesize
190B

MD5
f9f4374daaba493ee6255177f48a6566

SHA1
932e03f289bca216073e59d822b600ce7ca74ac8

SHA256
6ba10b8c0ebd939742af26d95df2c468153453ff79f73c3ca23216320e5b0bb0

SHA512
f78a5c429420334058afee490c4716d9f70b4ab9fe7297f0264c5d0c67094ddff5b6385ef8bc70757e8397a30e66d315509d147c938551951a1ba97ea7a80aeb

Download Submit
/root/Desktop/Old Firefox Data/gagdcbml.default-release/shield-preference-experiments.json

Filesize
18B

MD5
285cdefb3f582c224291f7a2530f3c4e

SHA1
f816c3e87aa007b6e6d31eb6a4618695a7d83439

SHA256
704d28223a4320a853df4a19d48c7015cf79d56a5317cc3475b6305fa43dcc05

SHA512
8f1decf1e4b5755fce8f165daae115f45d6890985c9c4bbb33a6f724cbfd26db75f6da06f9ef675de20fe755da9b7f55e5ee37124296a12a520a393da159bd58

Download Submit
/root/Desktop/Old Firefox Data/gagdcbml.default-release/storage/default/https+++github.com/.metadata-v2

Filesize
58B

MD5
77e5dde8b56f596312f4e3f89690c8ae

SHA1
928891e3f594f38caf443af4c16a75cee7dc79ec

SHA256
afb34a06e98f3e93a54305a6c4d0d66eba7eb190151e479d9e297693fdb09fbf

SHA512
258ab186d517b261e295b2bbf71b2a3cbba83a05d6317c29cd309532510798cb51f707ad7bf4a3c6379e6f902b244be9d65c82096da48396a118ed0f249f97af

Download Submit
/root/Desktop/Old Firefox Data/gagdcbml.default-release/storage/default/https+++github.com/ls/data.sqlite

Filesize
8KB

MD5
e67ea122db20e1181e0524293b2d1f17

SHA1
040b9143d9fc5f0227d1d5ca025e1e1aa525fd68

SHA256
a2014d4acc1debc18fe49b4a74c6b7c8cdd3b0af118addd91de2ce69fc0a1d75

SHA512
405420c30d0626ae1586ea323aaa003adb9bedcb733004bf8ab4dcbfd357853f7ab66cf9cd21d17481311e844a3abdc3c59092385d0753ad06a5e724fbaa4c9a

Download Submit
/root/Desktop/Old Firefox Data/gagdcbml.default-release/storage/default/https+++github.com/ls/usage

Filesize
12B

MD5
f33a379b3554748af96c24dfe2a0da39

SHA1
5f17e8c062400b0152d6f9c82b52b31592ef3e32

SHA256
29b3a6c070f3dcc16e4ddf80f0301b3a19418760bbbc4ff648df5819ea09a0b1

SHA512
057dc81cfb54d3ae0b1b00b399b47e8901916ab1f6446cc3c21faa31479ebc98a2965fb7d621acdfaee6ed462788ce70dec2db7a610368e214a5badf99369c2f

Download Submit
/root/Desktop/Old Firefox Data/gagdcbml.default-release/storage/ls-archive.sqlite

Filesize
128KB

MD5
d277f533f1d77e26d09bb66764bbeea6

SHA1
082920ebe7dfb870cf94a99fc601fd5ae8b456ee

SHA256
3c957f8d69ccfe73b66c28d378bf301bb1bcb0ceb5c59ac0dafeb5787b24f3c3

SHA512
510c78685b20a68160d9041d5a55a022a281fc0fd5777f978dc422d132961bf52ac23a0a95ca47b15715641ecb7a39b359da8d00d305c8543d553c00db54747d

Download Submit
/root/Desktop/Old Firefox Data/gagdcbml.default-release/storage/permanent/chrome/.metadata-v2

Filesize
42B

MD5
4422f06e831c3bcef5b966d939b61fe9

SHA1
c25b77960d1d8d82d3d0293dcbda39e15548a4f2

SHA256
fd928e770919b56bc1fcd932b5c498fa975941c35ccedbc50c7834b93c67e1db

SHA512
6205c3ce8881e2cb688cadae3cc7f8b1404082d0e33689e6796d5c4009a7bfb087ad54513f4b9e3d46eb937ba114d271c51562ef116a5b6cca2f453d164ad7d4

Download Submit
/root/Desktop/Old Firefox Data/gagdcbml.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite

Filesize
48KB

MD5
91e898b703c2aa468904c4c108160ec9

SHA1
65ab1f6a5f04fe15d05fae20fffcdde191ba944e

SHA256
b035f5a95ec185aa9646237c2103d1a0a601bb108be346933c0a27d74e0b58a3

SHA512
36b7e5d52f3513515db99b559cb888820039202f5b5bba0deae8dbacc1fa9bca9642ee34e45c0f87dda86bdabce63e08427a8c19a331d86dbb865c0e15c8fde0

Download Submit
/root/Desktop/Old Firefox Data/gagdcbml.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite

Filesize
48KB

MD5
cb51b83b3c4a50606216cb00519a4aca

SHA1
39e4dddcc2bbb28a9ab156eb178872883711da8b

SHA256
18f17cf4043f1dcf674f8b25619021ebe06a79bc3756c4f01f660e3b15b8034e

SHA512
7a7d496529ae0aafcd3a46aa9bd2323c057c9979d4be1ddc3b1bc74511f5c5828983118f539f4f140df520e0a57c7847b2fdb7588c5f925ddee4173222aefb42

Download Submit
/root/Desktop/Old Firefox Data/gagdcbml.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite

Filesize
48KB

MD5
5ae4ecf5cc42759e6a1c24f003ddc099

SHA1
d73d2af66728eb20722365d5983a9b12cf77d8ce

SHA256
866749a6ab8bea9715b3f5ebc583d6289fce215fb816ee67fd55d26f103eceb4

SHA512
f6f3d4c1fd0a57163322302903af52b7ff93f05c8687ec5b0c12153d4670536c9d57b8c8089acdcfb4410d3c81649acf0c0601b4ce91fc9c74ba5907cff2f892

Download Submit
/root/Desktop/Old Firefox Data/gagdcbml.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite

Filesize
1.1MB

MD5
b608f9944460c5c71a5e1765de5f8bcc

SHA1
184ab429f656259c61e4ef612c1c02d0f3cbf526

SHA256
8bef586533ef615db75b2601a33b6319bf0a7b953c7f97991e6049416749ea68

SHA512
bc656e5efecb403a6ec9d31817daea5ba3d56e4b3ad2d3f8d2c4598f1a87fe1fcb30b25e9ea1bfe667b81c9d36eb8a485fed1f65ba2a5d00e8e54fdbc20bd0d1

Download Submit
/root/Desktop/Old Firefox Data/gagdcbml.default-release/times.json

Filesize
50B

MD5
3719fb2facf5a6866e4f4a209c30737a

SHA1
520d69bef3133225c532084d10560a5fa7fc8589

SHA256
602dc570af9eb815882f872117785b45799c1e12aac61ed65a178d54d8ab17e3

SHA512
77434e04d55bc1441f7d14391ca7731195d5dde29408284f341bd375f95b53b8b88c3a24d67a11c28889bc0e2b9077e152cc4c048aba37a493815a716510ac80

Download Submit
/root/Desktop/Old Firefox Data/gagdcbml.default-release/webappsstore.sqlite

Filesize
96KB

MD5
41c22c9f81a84b1b0e5ee7ec2ff7c545

SHA1
d12424cba9e4e9124bf3f15e556c562b95c9b6a3

SHA256
4ffdc78433817da79ad2e84b26a2ffaf62d8c1baf80421751d752c3d8723328f

SHA512
8b690c55ae0b25aeede62a09dea1ef6b7daa9880ca63c6d4ce192160daded05fe0dc44b115216ce10523e2ec45991873c249f159fe8608712818f5ead327897b

Download Submit
/root/Desktop/Old Firefox Data/gagdcbml.default-release/xulstore.json

Filesize
159B

MD5
d4d1fc5db782c042800c7c3e85ac26be

SHA1
d8d789be8e4e8ca82c67524bfbcdc2e6a70f2395

SHA256
8e918fcd700aa5d5265dfac426164969ed458c1eeacc328a7218dd17f698df31

SHA512
e52164e0ab0d3afee6d333248491539c42722ea69388711bfece1d5cbeb1399f50561b4d45f37c8a8d8e547a7e2d6c89fcb3b3d214dba616ddf31fe24adc4dd1

Download Submit
/root/Downloads/toJAaSBl.exe.part

Filesize
50KB

MD5
47abd68080eee0ea1b95ae31968a3069

SHA1
ffbdf4b2224b92bd78779a7c5ac366ccb007c14d

SHA256
b5fc4fd50e4ba69f0c8c8e5c402813c107c605cab659960ac31b3c8356c4e0ec

SHA512
c9dfabffe582b29e810db8866f8997af1bd3339fa30e79575377bde970fcad3e3b6e9036b3a88d0c5f4fa3545eea8904d9faabf00142d5775ea5508adcd4dc0a

Download Submit
/tmp/tmpaddon

Filesize
12KB

MD5
7daae609c23338d7a4ce1e540261e3e1

SHA1
4ca4f2c0ea54d1ad23fa559d8637ca9c0bd3d320

SHA256
b7d8bfe084b451a9b81660abdcef732fc9d1e96236142525d731f03d15f6a238

SHA512
32fd8b81ea5932227d8e017905238f52c82730d6c13e40511f7448d5f11c54a0af55caa615c771cffc7e83d6b5dd4e606e797c4fd49a691c6cb9c6152a70ae4a

Download Submit
/tmp/tmpaddon-1

Filesize
499KB

MD5
152eda253e242e18443ef3282495bc7c

SHA1
ff0fa85565f21ec4931baad4573b4c0bd08c4019

SHA256
8e03090fee16f6e0ee2e436af8e51d0c3deed6d9f0db80dec048e668fc009a48

SHA512
94531e267314de661b2205c606283fb066d781e5c11027578f2a3c3aa353437c2289544074a28101b6b6f0179f0fe6bd890a0ae2bb6e1cf9053650472576366c

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads