hxxp://google[.]com

Analysis

max time kernel
896s
max time network
902s
platform
ubuntu-24.04_amd64
resource
ubuntu2404-amd64-20250307-en
resource tags

arch:amd64arch:i386image:ubuntu2404-amd64-20250307-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
submitted
27/03/2025, 11:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://google.com

Score

6^/10

antivm discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs

Web Service

T1102

flow	ioc
79	raw.githubusercontent.com
80	raw.githubusercontent.com
81	raw.githubusercontent.com
104	raw.githubusercontent.com
105	raw.githubusercontent.com
106	raw.githubusercontent.com
107	raw.githubusercontent.com
78	raw.githubusercontent.com

Changes its process name 64 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	AsyncSi~lThread	7410	firefox-bin
Changes the process name, possibly in an attempt to hide itself	pool-spawner	7411	firefox-bin
Changes the process name, possibly in an attempt to hide itself	gmain	7412	firefox-bin
Changes the process name, possibly in an attempt to hide itself	gdbus	7414	firefox-bin
Changes the process name, possibly in an attempt to hide itself	glean.dispatche	7416	firefox-bin
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	7418	firefox-bin
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	7418	firefox-bin
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	7418	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Timer	7419	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Timer	7419	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	7420	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Socket Thread	7421	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	7420	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Socket Thread	7421	firefox-bin
Changes the process name, possibly in an attempt to hide itself	IPDL Background	7422	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	7423	firefox-bin
Changes the process name, possibly in an attempt to hide itself	IPDL Background	7422	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	7423	firefox-bin
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	7424	firefox-bin
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	7424	firefox-bin
Changes the process name, possibly in an attempt to hide itself	pool-firefox	7425	firefox-bin
Changes the process name, possibly in an attempt to hide itself	pool-firefox	7426	firefox-bin
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	7428	firefox-bin
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	7428	firefox-bin
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	7429	firefox-bin
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	7429	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Cache2 I/O	7430	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Cookie	7431	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Cookie	7431	firefox-bin
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #0	7432	firefox-bin
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #1	7433	firefox-bin
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	7434	firefox-bin
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	7434	firefox-bin
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	7435	firefox-bin
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	7435	firefox-bin
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #2	7436	firefox-bin
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #2	7436	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Worker Launcher	7437	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Worker Launcher	7437	firefox-bin
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	7438	firefox-bin
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	7438	firefox-bin
Changes the process name, possibly in an attempt to hide itself	pool-firefox	7441	firefox-bin
Changes the process name, possibly in an attempt to hide itself	pool-firefox	7443	firefox-bin
Changes the process name, possibly in an attempt to hide itself	glxtest:disk$0	7444	glxtest
Changes the process name, possibly in an attempt to hide itself	Softwar~cThread	7445	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Softwar~cThread	7445	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Softwar~cThread	7445	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Renderer	7446	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Renderer	7446	firefox-bin
Changes the process name, possibly in an attempt to hide itself	WRWorker#0	7447	firefox-bin
Changes the process name, possibly in an attempt to hide itself	WRWorkerLP#0	7448	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Glyph rasterize	7449	firefox-bin
Changes the process name, possibly in an attempt to hide itself	WrGlyph~terizer	7449	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Compositor	7450	firefox-bin
Changes the process name, possibly in an attempt to hide itself	WRWorkerLP#0	7448	firefox-bin
Changes the process name, possibly in an attempt to hide itself	CanvasRenderer	7451	firefox-bin
Changes the process name, possibly in an attempt to hide itself	CanvasRenderer	7451	firefox-bin
Changes the process name, possibly in an attempt to hide itself	WRWorker#0	7447	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Compositor	7450	firefox-bin
Changes the process name, possibly in an attempt to hide itself	ImageIO	7452	firefox-bin
Changes the process name, possibly in an attempt to hide itself	ImageIO	7452	firefox-bin
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	7454	firefox-bin
Changes the process name, possibly in an attempt to hide itself	IPC Launch	7455	firefox-bin
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	7454	firefox-bin

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	firefox-bin

Reads CPU attributes 1 TTPs 10 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq	firefox-bin
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/size	firefox-bin
File opened for reading	/sys/devices/system/cpu/cpu0/topology/core_cpus	firefox-bin
File opened for reading	/sys/devices/system/cpu/possible	firefox-bin
File opened for reading	/sys/devices/system/cpu/possible	glxtest
File opened for reading	/sys/devices/system/cpu/possible	firefox-bin
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/size	firefox-bin
File opened for reading	/sys/devices/system/cpu/present	firefox-bin
File opened for reading	/sys/devices/system/cpu/cpu0/cpu_capacity	glxtest
File opened for reading	/sys/devices/system/cpu/present	firefox-bin

Enumerates kernel/hardware configuration 1 TTPs 42 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/device	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/device	glxtest
File opened for reading	/sys/fs/cgroup/system.slice/agent.service/cpu.max	firefox-bin
File opened for reading	/sys/class/drm/card0/device/boot_vga	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/drm/renderD128	firefox-bin
File opened for reading	/sys/devices/system/node	firefox-bin
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/device	glxtest
File opened for reading	/sys/kernel/security/apparmor/features/dbus/mask	dbus-daemon
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/device	glxtest
File opened for reading	/sys/bus/pci/devices	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/class	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/uevent	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/device	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/vendor	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0	firefox-bin
File opened for reading	/sys/module/apparmor/parameters/enabled	dbus-daemon
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/vendor	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/drm/card1	firefox-bin
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/class	glxtest
File opened for reading	/sys/fs/cgroup/system.slice/agent.service/cpu.max	firefox-bin
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/vendor	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/device	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/vendor	glxtest

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/maps	firefox-bin
File opened for reading	/proc/self/mountinfo	firefox-bin
File opened for reading	/proc/self/fd/130	firefox-bin
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/7407/cmdline	dbus-daemon
File opened for reading	/proc/self/fd/55	firefox-bin
File opened for reading	/proc/self/task/7460/stat	firefox-bin
File opened for reading	/proc/7503/cmdline	dbus-daemon
File opened for reading	/proc/self/task/7568/stat	firefox-bin
File opened for reading	/proc/self/fd/112	firefox-bin
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/filesystems	xdg-document-portal
File opened for reading	/proc/self/fd/90	firefox-bin
File opened for reading	/proc/self/task/7644/stat	firefox-bin
File opened for reading	/proc/7310/cmdline	dbus-daemon
File opened for reading	/proc/self/fd/84	firefox-bin
File opened for reading	/proc/7331/cmdline	dbus-daemon
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/stat	firefox-bin
File opened for reading	/proc/self/fd/110	firefox-bin
File opened for reading	/proc/self/fd/87	firefox-bin
File opened for reading	/proc/self/task/7408/stat	firefox-bin
File opened for reading	/proc/7508/cmdline	dbus-daemon
File opened for reading	/proc/self/fd/80	firefox-bin
File opened for reading	/proc/self/task/7660/stat	firefox-bin
File opened for reading	/proc/mounts	dbus-daemon
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/mountinfo	firefox-bin
File opened for reading	/proc/filesystems	firefox-bin
File opened for reading	/proc/7462/cmdline	dbus-daemon
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/fd/31	firefox-bin
File opened for reading	/proc/self/fd/15	firefox-bin
File opened for reading	/proc/filesystems	xdg-permission-store
File opened for reading	/proc/filesystems	gvfsd-fuse
File opened for reading	/proc/self/task/7526/comm	xdg-desktop-portal
File opened for reading	/proc/self/fd/66	firefox-bin
File opened for reading	/proc/self/task/7653/stat	firefox-bin
File opened for reading	/proc/self/fd	dbus-launch
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/filesystems	firefox-bin
File opened for reading	/proc/self/cgroup	firefox-bin
File opened for reading	/proc/self/task/7673/stat	firefox-bin
File opened for reading	/proc/self/fd/117	firefox-bin
File opened for reading	/proc/self/fd/104	firefox-bin
File opened for reading	/proc/self/fd	dbus-send
File opened for reading	/proc/sys/kernel/cap_last_cap	dbus-daemon
File opened for reading	/proc/7315/attr/apparmor/current	dbus-daemon
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/fd	dbus-send
File opened for reading	/proc/7490/cmdline	dbus-daemon
File opened for reading	/proc/self/fd/65	firefox-bin
File opened for reading	/proc/7315/status	dbus-daemon
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/7466/cmdline	dbus-daemon

Writes file to tmp directory 6 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/remote-settings-startup-bundle-.tmp	firefox-bin
File opened for modification	/tmp/firefox/.parentlock	firefox-bin
File opened for modification	/tmp/tmpaddon	firefox-bin
File opened for modification	/tmp/tmpaddon-1	firefox-bin
File opened for modification	/tmp/tmpaddon-2	firefox-bin
File opened for modification	/tmp/remote-settings-startup-bundle-	firefox-bin

/usr/bin/xdg-open
xdg-open http://google.com
1⤵
PID:7308
- /usr/bin/dbus-send
  dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
  2⤵
  - Reads runtime system information
  PID:7310
- - /usr/bin/dbus-launch
    dbus-launch --autolaunch 36e6eb39a6fa405996e79cad2731865d --binary-syntax --close-stderr
    3⤵
    - Reads runtime system information
    PID:7311
  - - /usr/bin/dbus-daemon
      /usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:7313
    - - /usr/libexec/xdg-desktop-portal
        
        /usr/libexec/xdg-desktop-portal
        5⤵
        Reads runtime system information
        
        PID:7462
    - - /usr/libexec/at-spi-bus-launcher
        
        /usr/libexec/at-spi-bus-launcher
        5⤵
        
        PID:7466
    - - /usr/libexec/xdg-document-portal
        
        /usr/libexec/xdg-document-portal
        5⤵
        Reads runtime system information
        
        PID:7482
      - /usr/bin/fusermount3
        
        fusermount3 -o "rw,nosuid,nodev,fsname=portal,auto_unmount,subtype=portal" -- /root/.cache/doc
        6⤵
        
        PID:7497
    - - /usr/libexec/xdg-permission-store
        
        /usr/libexec/xdg-permission-store
        5⤵
        Reads runtime system information
        
        PID:7490
    - - /usr/libexec/xdg-desktop-portal-gtk
        
        /usr/libexec/xdg-desktop-portal-gtk
        5⤵
        
        PID:7503
    - - /usr/libexec/gvfsd
        
        /usr/libexec/gvfsd
        5⤵
        
        PID:7508
- /usr/bin/grep
  grep " = \\\"xfce4\\\"\$"
  2⤵
  - Reads runtime system information
  PID:7317
- /usr/bin/xprop
  xprop -root _DT_SAVE_MODE
  2⤵
  PID:7316
- /usr/bin/xprop
  xprop -root
  2⤵
  PID:7318
- /usr/bin/grep
  grep -i "^xfce_desktop_window"
  2⤵
  - Reads runtime system information
  PID:7319
- /usr/bin/grep
  grep -q "^Enlightenment"
  2⤵
  - Reads runtime system information
  PID:7321
- /usr/bin/uname
  uname
  2⤵
  PID:7322
- /usr/bin/grep
  grep -q "^file://"
  2⤵
  - Reads runtime system information
  PID:7324
- /usr/bin/egrep
  egrep -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:7326
- /usr/local/sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:7326
- /usr/local/bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:7326
- /usr/sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:7326
- /usr/bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  - Reads runtime system information
  PID:7326
- /usr/bin/sed
  sed -n "s/\$^[[:alnum:]+\\.-]*\$:.*\$/\\1/p"
  2⤵
  - Reads runtime system information
  PID:7329
- /usr/bin/xdg-mime
  xdg-mime query default x-scheme-handler/http
  2⤵
  PID:7330
- - /usr/bin/dbus-send
    dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
    3⤵
    - Reads runtime system information
    PID:7331
  - - /usr/bin/dbus-launch
      dbus-launch --autolaunch 36e6eb39a6fa405996e79cad2731865d --binary-syntax --close-stderr
      4⤵
      PID:7333
- - /usr/bin/xprop
    xprop -root _DT_SAVE_MODE
    3⤵
    PID:7336
- - /usr/bin/grep
    grep " = \\\"xfce4\\\"\$"
    3⤵
    - Reads runtime system information
    PID:7337
- - /usr/bin/xprop
    xprop -root
    3⤵
    PID:7338
- - /usr/bin/grep
    grep -i "^xfce_desktop_window"
    3⤵
    - Reads runtime system information
    PID:7339
- - /usr/bin/grep
    grep -q "^Enlightenment"
    3⤵
    PID:7341
- - /usr/bin/uname
    uname
    3⤵
    PID:7342
- - /usr/bin/sed
    sed "s/:/ /g"
    3⤵
    - Reads runtime system information
    PID:7345
- - /usr/bin/grep
    grep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
    3⤵
    - Reads runtime system information
    PID:7347
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:7350
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:7349
- - /usr/bin/head
    head -n 1
    3⤵
    PID:7348
- - /usr/bin/head
    head -n 1
    3⤵
    PID:7353
- - /usr/bin/grep
    grep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
    3⤵
    - Reads runtime system information
    PID:7352
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:7354
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:7355
- - /usr/bin/head
    head -n 1
    3⤵
    PID:7358
- - /usr/bin/grep
    grep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
    3⤵
    - Reads runtime system information
    PID:7357
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:7359
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:7360
- - /usr/bin/grep
    grep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
    3⤵
    - Reads runtime system information
    PID:7362
- - /usr/bin/head
    head -n 1
    3⤵
    PID:7363
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:7364
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:7365
- - /usr/bin/grep
    grep "x-scheme-handler/http=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache
    3⤵
    - Reads runtime system information
    PID:7367
- - /usr/bin/head
    head -n 1
    3⤵
    PID:7368
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:7370
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:7369
- /usr/bin/sed
  sed "s/:/ /g"
  2⤵
  - Reads runtime system information
  PID:7373
- /usr/bin/sed
  sed -e "s|-|/|"
  2⤵
  - Reads runtime system information
  PID:7376
- /usr/bin/sed
  sed -e "s|-|/|"
  2⤵
  - Reads runtime system information
  PID:7379
- /usr/bin/cut
  cut "-d=" -f 2-
  2⤵
  PID:7384
- /usr/bin/which
  which firefox
  2⤵
  PID:7385
- /usr/bin/cut
  cut "-d=" -f 2-
  2⤵
  PID:7388
- /usr/bin/cut
  cut "-d=" -f 2-
  2⤵
  PID:7391
- /usr/bin/cut
  cut "-d=" -f 2-
  2⤵
  PID:7396
- /usr/bin/cut
  cut "-d=" -f 2-
  2⤵
  PID:7399
- /usr/bin/firefox
  /usr/bin/firefox http://google.com
  2⤵
  PID:7407
- /usr/lib/firefox/firefox-bin
  /usr/bin/firefox http://google.com
  2⤵
  - Changes its process name
  - Checks CPU configuration
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:7407
- - /usr/local/sbin/dbus-launch
    dbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr
    3⤵
    PID:7413
- - /usr/local/bin/dbus-launch
    dbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr
    3⤵
    PID:7413
- - /usr/sbin/dbus-launch
    dbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr
    3⤵
    PID:7413
- - /usr/bin/dbus-launch
    dbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr
    3⤵
    PID:7413
- - /usr/local/sbin/dbus-launch
    dbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr
    3⤵
    PID:7415
- - /usr/local/bin/dbus-launch
    dbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr
    3⤵
    PID:7415
- - /usr/sbin/dbus-launch
    dbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr
    3⤵
    PID:7415
- - /usr/bin/dbus-launch
    dbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr
    3⤵
    PID:7415
- - /usr/lib/firefox/glxtest
    /usr/lib/firefox/glxtest -f 16
    3⤵
    - Changes its process name
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    PID:7417
- - /usr/local/sbin/dbus-launch
    dbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr
    3⤵
    PID:7439
- - /usr/local/bin/dbus-launch
    dbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr
    3⤵
    PID:7439
- - /usr/sbin/dbus-launch
    dbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr
    3⤵
    PID:7439
- - /usr/bin/dbus-launch
    dbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr
    3⤵
    PID:7439
- - /usr/lib/firefox/firefox-bin
    /usr/lib/firefox/firefox-bin -contentproc -ipcHandle 0 -sandboxReporter 1 -initialChannelId "{1997c40c-40d1-4add-b789-463c815dffbc}" -parentPid 7407 -crashReporter 2 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser 1 forkserver
    3⤵
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:7456

/usr/libexec/gvfsd-fuse
/usr/libexec/gvfsd-fuse /root/.gvfs -f
1⤵
- Reads runtime system information
PID:7514

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/tmpaddon

Filesize
11KB

MD5
25e8156b7f7ca8dad999ee2b93a32b71

SHA1
db587e9e9559b433cee57435cb97a83963659430

SHA256
ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986

SHA512
1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56

Download Submit
/tmp/tmpaddon-1

Filesize
575KB

MD5
2aa72a97657774b1eefabe0490b3c088

SHA1
17f12db36fc49b9cf38d61ed2dbde55e71b81b85

SHA256
997b6e1c0e07307de3adf5d0d7a3ddc5d81cd522afe675dfdb43154f73f5b0d0

SHA512
f5246bf14d038adf4ce0c4360262ab722bc3de4220f047c3d542b4c564074b4877dc8659e3125c5171c749e7ce93f20cc63777eb5e1539e960670cbc5f30ac85

Download Submit
/tmp/tmpaddon-2

Filesize
235KB

MD5
325fe4969a79462d008b0542144852a3

SHA1
cd1341a3226077eb965ad69e063bc74598ee97ed

SHA256
823877ae154b493f842372ba9faa2ea0037ccd2bab8e0946cd80d4d508375f7f

SHA512
5e7b8c2527d7b1133be6696b71888e01a628e17013274b3124f1bf7e1607e4a0e67387f10a4f71aa508a0bc0855414cce79497e342c29e9b4d27a828e696a7a1

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads