hxxps://github[.]com/Cobalt-Strike/community_kit

Analysis

max time kernel
599s
max time network
484s
platform
ubuntu-24.04_amd64
resource
ubuntu2404-amd64-20250307-en
resource tags

arch:amd64arch:i386image:ubuntu2404-amd64-20250307-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
submitted
26/03/2025, 14:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Cobalt-Strike/community_kit

Score

6^/10

antivm discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
63	raw.githubusercontent.com
64	raw.githubusercontent.com
65	raw.githubusercontent.com
66	raw.githubusercontent.com
67	raw.githubusercontent.com
68	raw.githubusercontent.com

Changes its process name 64 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	AsyncSi~lThread	2598	firefox-bin
Changes the process name, possibly in an attempt to hide itself	pool-spawner	2599	firefox-bin
Changes the process name, possibly in an attempt to hide itself	gmain	2600	firefox-bin
Changes the process name, possibly in an attempt to hide itself	gdbus	2602	firefox-bin
Changes the process name, possibly in an attempt to hide itself	glean.dispatche	2604	firefox-bin
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	2606	firefox-bin
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	2606	firefox-bin
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	2606	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Timer	2607	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Timer	2607	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	2608	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	2608	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Socket Thread	2609	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Socket Thread	2609	firefox-bin
Changes the process name, possibly in an attempt to hide itself	IPDL Background	2610	firefox-bin
Changes the process name, possibly in an attempt to hide itself	IPDL Background	2610	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	2611	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	2611	firefox-bin
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	2612	firefox-bin
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	2612	firefox-bin
Changes the process name, possibly in an attempt to hide itself	pool-firefox	2613	firefox-bin
Changes the process name, possibly in an attempt to hide itself	pool-firefox	2614	firefox-bin
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	2616	firefox-bin
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	2616	firefox-bin
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	2617	firefox-bin
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	2617	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Cache2 I/O	2618	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Cookie	2619	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Cookie	2619	firefox-bin
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #0	2620	firefox-bin
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #1	2621	firefox-bin
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	2622	firefox-bin
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	2622	firefox-bin
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	2623	firefox-bin
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	2623	firefox-bin
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #2	2624	firefox-bin
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #2	2624	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Worker Launcher	2625	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Worker Launcher	2625	firefox-bin
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	2626	firefox-bin
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	2626	firefox-bin
Changes the process name, possibly in an attempt to hide itself	glxtest:disk$0	2629	glxtest
Changes the process name, possibly in an attempt to hide itself	Softwar~cThread	2631	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Softwar~cThread	2631	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Softwar~cThread	2631	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Renderer	2632	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Renderer	2632	firefox-bin
Changes the process name, possibly in an attempt to hide itself	WRWorker#0	2633	firefox-bin
Changes the process name, possibly in an attempt to hide itself	WRWorkerLP#0	2634	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Glyph rasterize	2635	firefox-bin
Changes the process name, possibly in an attempt to hide itself	WrGlyph~terizer	2635	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Compositor	2636	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Compositor	2636	firefox-bin
Changes the process name, possibly in an attempt to hide itself	CanvasRenderer	2637	firefox-bin
Changes the process name, possibly in an attempt to hide itself	WRWorker#0	2633	firefox-bin
Changes the process name, possibly in an attempt to hide itself	CanvasRenderer	2637	firefox-bin
Changes the process name, possibly in an attempt to hide itself	WRWorkerLP#0	2634	firefox-bin
Changes the process name, possibly in an attempt to hide itself	ImageIO	2638	firefox-bin
Changes the process name, possibly in an attempt to hide itself	ImageIO	2638	firefox-bin
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	2640	firefox-bin
Changes the process name, possibly in an attempt to hide itself	IPC Launch	2641	firefox-bin
Changes the process name, possibly in an attempt to hide itself	IPC Launch	2641	firefox-bin
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	2640	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Permission	2643	firefox-bin

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	firefox-bin

Reads CPU attributes 1 TTPs 10 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/cpu0/topology/core_cpus	firefox-bin
File opened for reading	/sys/devices/system/cpu/possible	firefox-bin
File opened for reading	/sys/devices/system/cpu/present	firefox-bin
File opened for reading	/sys/devices/system/cpu/present	firefox-bin
File opened for reading	/sys/devices/system/cpu/possible	glxtest
File opened for reading	/sys/devices/system/cpu/cpu0/cpu_capacity	glxtest
File opened for reading	/sys/devices/system/cpu/possible	firefox-bin
File opened for reading	/sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq	firefox-bin
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/size	firefox-bin
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/size	firefox-bin

Enumerates kernel/hardware configuration 1 TTPs 42 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/vendor	glxtest
File opened for reading	/sys/fs/cgroup/system.slice/agent.service/cpu.max	firefox-bin
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_vendor	glxtest
File opened for reading	/sys/kernel/security/apparmor/features/dbus/mask	dbus-daemon
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/class	glxtest
File opened for reading	/sys/bus/pci/devices	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/class	glxtest
File opened for reading	/sys/class/drm/card0/device/boot_vga	glxtest
File opened for reading	/sys/devices/system/node	firefox-bin
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/device	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/vendor	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0	firefox-bin
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/drm/card1	firefox-bin
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/device	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_device	glxtest
File opened for reading	/sys/fs/cgroup/system.slice/agent.service/cpu.max	firefox-bin
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/device	glxtest
File opened for reading	/sys/module/apparmor/parameters/enabled	dbus-daemon
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/class	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/uevent	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/class	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/drm/renderD128	firefox-bin

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/maps	firefox-bin
File opened for reading	/proc/filesystems	at-spi-bus-launcher
File opened for reading	/proc/self/task/2744/stat	firefox-bin
File opened for reading	/proc/self/mountinfo	firefox-bin
File opened for reading	/proc/self/fd/79	firefox-bin
File opened for reading	/proc/mounts	dbus-daemon
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/stat	firefox-bin
File opened for reading	/proc/2689/cmdline	dbus-daemon
File opened for reading	/proc/filesystems	gvfsd
File opened for reading	/proc/2694/cmdline	dbus-daemon
File opened for reading	/proc/filesystems	gvfsd-fuse
File opened for reading	/proc/self/status	firefox-bin
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/filesystems	xdg-desktop-portal-gtk
File opened for reading	/proc/self/fd/66	firefox-bin
File opened for reading	/proc/self/task/2860/stat	firefox-bin
File opened for reading	/proc/self/fd/140	firefox-bin
File opened for reading	/proc/meminfo	firefox-bin
File opened for reading	/proc/self/fd/107	firefox-bin
File opened for reading	/proc/2644/stat	firefox-bin
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/fd/15	firefox-bin
File opened for reading	/proc/self/maps	firefox-bin
File opened for reading	/proc/self/task/2764/stat	firefox-bin
File opened for reading	/proc/self/fd/88	firefox-bin
File opened for reading	/proc/self/fd/122	firefox-bin
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/2647/cmdline	dbus-daemon
File opened for reading	/proc/self/fd/63	firefox-bin
File opened for reading	/proc/self/cgroup	firefox-bin
File opened for reading	/proc/self/task/2834/stat	firefox-bin
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd/132	firefox-bin
File opened for reading	/proc/self/fd/110	firefox-bin
File opened for reading	/proc/filesystems	dbus-daemon
File opened for reading	/proc/2526/cmdline	dbus-daemon
File opened for reading	/proc/filesystems	glxtest
File opened for reading	/proc/2670/cmdline	dbus-daemon
File opened for reading	/proc/self/task/2713/comm	xdg-desktop-portal
File opened for reading	/proc/self/task/2596/stat	firefox-bin
File opened for reading	/proc/2677/cmdline	dbus-daemon
File opened for reading	/proc/self/fd/117	firefox-bin
File opened for reading	/proc/self/fd/58	firefox-bin
File opened for reading	/proc/2729/stat	firefox-bin
File opened for reading	/proc/2510/status	dbus-daemon
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	firefox-bin
File opened for reading	/proc/self/fd/33	firefox-bin
File opened for reading	/proc/self/fd/46	firefox-bin
File opened for reading	/proc/self/stat	firefox-bin
File opened for reading	/proc/2650/cmdline	dbus-daemon
File opened for reading	/proc/filesystems	xdg-document-portal
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/sys/kernel/cap_last_cap	dbus-daemon
File opened for reading	/proc/2505/cmdline	dbus-daemon
File opened for reading	/proc/self/fd	dbus-send
File opened for reading	/proc/2700/cmdline	dbus-daemon
File opened for reading	/proc/self/fd/35	firefox-bin
File opened for reading	/proc/self/task/2734/stat	firefox-bin
File opened for reading	/proc/2762/stat	firefox-bin

Writes file to tmp directory 4 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/firefox/.parentlock	firefox-bin
File opened for modification	/tmp/tmpaddon	firefox-bin
File opened for modification	/tmp/tmpaddon-1	firefox-bin
File opened for modification	/tmp/tmpaddon-2	firefox-bin

/usr/bin/xdg-open
xdg-open https://github.com/Cobalt-Strike/community_kit
1⤵
PID:2503
- /usr/bin/dbus-send
  dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
  2⤵
  PID:2505
- - /usr/bin/dbus-launch
    dbus-launch --autolaunch 36e6eb39a6fa405996e79cad2731865d --binary-syntax --close-stderr
    3⤵
    PID:2506
  - - /usr/bin/dbus-daemon
      /usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:2508
    - - /usr/libexec/xdg-desktop-portal
        
        /usr/libexec/xdg-desktop-portal
        5⤵
        Reads runtime system information
        
        PID:2647
    - - /usr/libexec/at-spi-bus-launcher
        
        /usr/libexec/at-spi-bus-launcher
        5⤵
        Reads runtime system information
        
        PID:2650
    - - /usr/libexec/xdg-document-portal
        
        /usr/libexec/xdg-document-portal
        5⤵
        Reads runtime system information
        
        PID:2670
      - /usr/bin/fusermount3
        
        fusermount3 -o "rw,nosuid,nodev,fsname=portal,auto_unmount,subtype=portal" -- /root/.cache/doc
        6⤵
        
        PID:2684
    - - /usr/libexec/xdg-permission-store
        
        /usr/libexec/xdg-permission-store
        5⤵
        
        PID:2677
    - - /usr/libexec/xdg-desktop-portal-gtk
        
        /usr/libexec/xdg-desktop-portal-gtk
        5⤵
        Reads runtime system information
        
        PID:2689
    - - /usr/libexec/gvfsd
        
        /usr/libexec/gvfsd
        5⤵
        Reads runtime system information
        
        PID:2694
- /usr/bin/grep
  grep " = \\\"xfce4\\\"\$"
  2⤵
  PID:2512
- /usr/bin/xprop
  xprop -root _DT_SAVE_MODE
  2⤵
  PID:2511
- /usr/bin/xprop
  xprop -root
  2⤵
  PID:2513
- /usr/bin/grep
  grep -i "^xfce_desktop_window"
  2⤵
  PID:2514
- /usr/bin/grep
  grep -q "^Enlightenment"
  2⤵
  PID:2516
- /usr/bin/uname
  uname
  2⤵
  PID:2517
- /usr/bin/grep
  grep -q "^file://"
  2⤵
  - Reads runtime system information
  PID:2519
- /usr/bin/egrep
  egrep -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:2521
- /usr/local/sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:2521
- /usr/local/bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:2521
- /usr/sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:2521
- /usr/bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  - Reads runtime system information
  PID:2521
- /usr/bin/sed
  sed -n "s/\$^[[:alnum:]+\\.-]*\$:.*\$/\\1/p"
  2⤵
  - Reads runtime system information
  PID:2524
- /usr/bin/xdg-mime
  xdg-mime query default x-scheme-handler/https
  2⤵
  PID:2525
- - /usr/bin/dbus-send
    dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
    3⤵
    - Reads runtime system information
    PID:2526
  - - /usr/bin/dbus-launch
      dbus-launch --autolaunch 36e6eb39a6fa405996e79cad2731865d --binary-syntax --close-stderr
      4⤵
      PID:2527
- - /usr/bin/xprop
    xprop -root _DT_SAVE_MODE
    3⤵
    PID:2528
- - /usr/bin/grep
    grep " = \\\"xfce4\\\"\$"
    3⤵
    - Reads runtime system information
    PID:2529
- - /usr/bin/xprop
    xprop -root
    3⤵
    PID:2530
- - /usr/bin/grep
    grep -i "^xfce_desktop_window"
    3⤵
    - Reads runtime system information
    PID:2531
- - /usr/bin/grep
    grep -q "^Enlightenment"
    3⤵
    PID:2533
- - /usr/bin/uname
    uname
    3⤵
    PID:2534
- - /usr/bin/sed
    sed "s/:/ /g"
    3⤵
    - Reads runtime system information
    PID:2537
- - /usr/bin/grep
    grep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
    3⤵
    - Reads runtime system information
    PID:2539
- - /usr/bin/head
    head -n 1
    3⤵
    PID:2540
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:2542
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:2541
- - /usr/bin/grep
    grep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
    3⤵
    PID:2544
- - /usr/bin/head
    head -n 1
    3⤵
    PID:2545
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:2547
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:2546
- - /usr/bin/grep
    grep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
    3⤵
    PID:2549
- - /usr/bin/head
    head -n 1
    3⤵
    PID:2550
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:2552
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:2551
- - /usr/bin/grep
    grep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
    3⤵
    PID:2554
- - /usr/bin/head
    head -n 1
    3⤵
    PID:2555
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:2556
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:2557
- - /usr/bin/grep
    grep "x-scheme-handler/https=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache
    3⤵
    - Reads runtime system information
    PID:2559
- - /usr/bin/head
    head -n 1
    3⤵
    PID:2560
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:2561
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:2562
- /usr/bin/sed
  sed "s/:/ /g"
  2⤵
  PID:2565
- /usr/bin/sed
  sed -e "s|-|/|"
  2⤵
  - Reads runtime system information
  PID:2568
- /usr/bin/sed
  sed -e "s|-|/|"
  2⤵
  - Reads runtime system information
  PID:2571
- /usr/bin/cut
  cut "-d=" -f 2-
  2⤵
  PID:2576
- /usr/bin/which
  which firefox
  2⤵
  PID:2580
- /usr/bin/cut
  cut "-d=" -f 2-
  2⤵
  PID:2583
- /usr/bin/cut
  cut "-d=" -f 2-
  2⤵
  PID:2586
- /usr/bin/cut
  cut "-d=" -f 2-
  2⤵
  PID:2591
- /usr/bin/cut
  cut "-d=" -f 2-
  2⤵
  PID:2594
- /usr/bin/firefox
  /usr/bin/firefox https://github.com/Cobalt-Strike/community_kit
  2⤵
  PID:2595
- /usr/lib/firefox/firefox-bin
  /usr/bin/firefox https://github.com/Cobalt-Strike/community_kit
  2⤵
  - Changes its process name
  - Checks CPU configuration
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:2595
- - /usr/local/sbin/dbus-launch
    dbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr
    3⤵
    PID:2601
- - /usr/local/bin/dbus-launch
    dbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr
    3⤵
    PID:2601
- - /usr/sbin/dbus-launch
    dbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr
    3⤵
    PID:2601
- - /usr/bin/dbus-launch
    dbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr
    3⤵
    PID:2601
- - /usr/local/sbin/dbus-launch
    dbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr
    3⤵
    PID:2603
- - /usr/local/bin/dbus-launch
    dbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr
    3⤵
    PID:2603
- - /usr/sbin/dbus-launch
    dbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr
    3⤵
    PID:2603
- - /usr/bin/dbus-launch
    dbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr
    3⤵
    PID:2603
- - /usr/lib/firefox/glxtest
    /usr/lib/firefox/glxtest -f 16
    3⤵
    - Changes its process name
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:2605
- - /usr/local/sbin/dbus-launch
    dbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr
    3⤵
    PID:2627
- - /usr/local/bin/dbus-launch
    dbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr
    3⤵
    PID:2627
- - /usr/sbin/dbus-launch
    dbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr
    3⤵
    PID:2627
- - /usr/bin/dbus-launch
    dbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr
    3⤵
    PID:2627
- - /usr/lib/firefox/firefox-bin
    /usr/lib/firefox/firefox-bin -contentproc -ipcHandle 0 -sandboxReporter 1 -initialChannelId "{4c98afe2-dead-4ff7-8d0f-e8e30595cb15}" -parentPid 2595 -crashReporter 2 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser 1 forkserver
    3⤵
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:2642

/usr/libexec/gvfsd-fuse
/usr/libexec/gvfsd-fuse /root/.gvfs -f
1⤵
- Reads runtime system information
PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/tmpaddon

Filesize
11KB

MD5
25e8156b7f7ca8dad999ee2b93a32b71

SHA1
db587e9e9559b433cee57435cb97a83963659430

SHA256
ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986

SHA512
1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56

Download Submit
/tmp/tmpaddon-1

Filesize
235KB

MD5
325fe4969a79462d008b0542144852a3

SHA1
cd1341a3226077eb965ad69e063bc74598ee97ed

SHA256
823877ae154b493f842372ba9faa2ea0037ccd2bab8e0946cd80d4d508375f7f

SHA512
5e7b8c2527d7b1133be6696b71888e01a628e17013274b3124f1bf7e1607e4a0e67387f10a4f71aa508a0bc0855414cce79497e342c29e9b4d27a828e696a7a1

Download Submit
/tmp/tmpaddon-2

Filesize
575KB

MD5
2aa72a97657774b1eefabe0490b3c088

SHA1
17f12db36fc49b9cf38d61ed2dbde55e71b81b85

SHA256
997b6e1c0e07307de3adf5d0d7a3ddc5d81cd522afe675dfdb43154f73f5b0d0

SHA512
f5246bf14d038adf4ce0c4360262ab722bc3de4220f047c3d542b4c564074b4877dc8659e3125c5171c749e7ce93f20cc63777eb5e1539e960670cbc5f30ac85

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads