hxxps://www[.]thisworldthesedays[.]com/sherlockhollmes-2[.]html

Analysis

max time kernel
563s
max time network
597s
platform
ubuntu-24.04_amd64
resource
ubuntu2404-amd64-20250307-en
resource tags

arch:amd64arch:i386image:ubuntu2404-amd64-20250307-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
submitted
28/03/2025, 13:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.thisworldthesedays.com/sherlockhollmes-2.html

Score

4^/10

antivm discovery

Malware Config

Signatures

Changes its process name 64 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	AsyncSi~lThread	2662	firefox-bin
Changes the process name, possibly in an attempt to hide itself	pool-spawner	2663	firefox-bin
Changes the process name, possibly in an attempt to hide itself	gmain	2664	firefox-bin
Changes the process name, possibly in an attempt to hide itself	gdbus	2666	firefox-bin
Changes the process name, possibly in an attempt to hide itself	glean.dispatche	2668	firefox-bin
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	2670	firefox-bin
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	2670	firefox-bin
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	2670	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Timer	2671	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Timer	2671	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	2672	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	2672	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Socket Thread	2673	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Socket Thread	2673	firefox-bin
Changes the process name, possibly in an attempt to hide itself	IPDL Background	2674	firefox-bin
Changes the process name, possibly in an attempt to hide itself	IPDL Background	2674	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	2675	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	2675	firefox-bin
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	2676	firefox-bin
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	2676	firefox-bin
Changes the process name, possibly in an attempt to hide itself	pool-firefox	2677	firefox-bin
Changes the process name, possibly in an attempt to hide itself	pool-firefox	2678	firefox-bin
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	2680	firefox-bin
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	2680	firefox-bin
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	2681	firefox-bin
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	2681	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Cache2 I/O	2682	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Cookie	2683	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Cookie	2683	firefox-bin
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #0	2684	firefox-bin
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #1	2685	firefox-bin
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	2686	firefox-bin
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	2686	firefox-bin
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	2687	firefox-bin
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	2687	firefox-bin
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	2688	firefox-bin
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	2688	firefox-bin
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #2	2689	firefox-bin
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #2	2689	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Worker Launcher	2690	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Worker Launcher	2690	firefox-bin
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	2691	firefox-bin
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	2691	firefox-bin
Changes the process name, possibly in an attempt to hide itself	glxtest:disk$0	2693	glxtest
Changes the process name, possibly in an attempt to hide itself	Softwar~cThread	2696	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Softwar~cThread	2696	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Softwar~cThread	2696	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Renderer	2697	firefox-bin
Changes the process name, possibly in an attempt to hide itself	WRWorker#0	2698	firefox-bin
Changes the process name, possibly in an attempt to hide itself	WRWorkerLP#0	2699	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Renderer	2697	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Glyph rasterize	2700	firefox-bin
Changes the process name, possibly in an attempt to hide itself	WrGlyph~terizer	2700	firefox-bin
Changes the process name, possibly in an attempt to hide itself	CanvasRenderer	2702	firefox-bin
Changes the process name, possibly in an attempt to hide itself	CanvasRenderer	2702	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Compositor	2701	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Compositor	2701	firefox-bin
Changes the process name, possibly in an attempt to hide itself	WRWorkerLP#0	2699	firefox-bin
Changes the process name, possibly in an attempt to hide itself	WRWorker#0	2698	firefox-bin
Changes the process name, possibly in an attempt to hide itself	ImageIO	2703	firefox-bin
Changes the process name, possibly in an attempt to hide itself	ImageIO	2703	firefox-bin
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	2705	firefox-bin
Changes the process name, possibly in an attempt to hide itself	IPC Launch	2706	firefox-bin
Changes the process name, possibly in an attempt to hide itself	SandboxReporter	2705	firefox-bin

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	firefox-bin

Reads CPU attributes 1 TTPs 11 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/possible	firefox-bin
File opened for reading	/sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq	firefox-bin
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/size	firefox-bin
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/size	firefox-bin
File opened for reading	/sys/devices/system/cpu/cpu0/cpu_capacity	firefox-bin
File opened for reading	/sys/devices/system/cpu/possible	firefox-bin
File opened for reading	/sys/devices/system/cpu/present	firefox-bin
File opened for reading	/sys/devices/system/cpu/possible	glxtest
File opened for reading	/sys/devices/system/cpu/cpu0/cpu_capacity	glxtest
File opened for reading	/sys/devices/system/cpu/present	firefox-bin
File opened for reading	/sys/devices/system/cpu/cpu0/topology/core_cpus	firefox-bin

Enumerates kernel/hardware configuration 1 TTPs 48 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/class	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/device	glxtest
File opened for reading	/sys/module/apparmor/parameters/enabled	dbus-daemon
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/class	glxtest
File opened for reading	/sys/fs/cgroup/system.slice/agent.service/cpu.max	firefox-bin
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0	firefox-bin
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/drm/card1	firefox-bin
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/vendor	firefox-bin
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/device	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_vendor	firefox-bin
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_device	firefox-bin
File opened for reading	/sys/class/drm/card0/device/boot_vga	firefox-bin
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/device	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/uevent	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/drm/renderD128	firefox-bin
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/class	glxtest
File opened for reading	/sys/kernel/security/apparmor/features/dbus/mask	dbus-daemon
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/class	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/vendor	glxtest
File opened for reading	/sys/class/drm/card0/device/boot_vga	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/vendor	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/device	glxtest
File opened for reading	/sys/devices/system/node	firefox-bin
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/device	firefox-bin
File opened for reading	/sys/bus/pci/devices	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/vendor	glxtest
File opened for reading	/sys/fs/cgroup/system.slice/agent.service/cpu.max	firefox-bin
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_device	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/uevent	firefox-bin
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/device	glxtest

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/2753/cmdline	dbus-daemon
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/2590/cmdline	dbus-daemon
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/filesystems	firefox-bin
File opened for reading	/proc/self/maps	firefox-bin
File opened for reading	/proc/self/cgroup	firefox-bin
File opened for reading	/proc/self/fd/101	firefox-bin
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	xdg-document-portal
File opened for reading	/proc/self/mountinfo	firefox-bin
File opened for reading	/proc/self/status	firefox-bin
File opened for reading	/proc/self/fd	dbus-send
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/filesystems	xdg-permission-store
File opened for reading	/proc/2574/status	dbus-daemon
File opened for reading	/proc/self/fd/65	firefox-bin
File opened for reading	/proc/self/fd/116	firefox-bin
File opened for reading	/proc/2569/cmdline	dbus-daemon
File opened for reading	/proc/2968/stat	firefox-bin
File opened for reading	/proc/3104/stat	firefox-bin
File opened for reading	/proc/3023/stat	firefox-bin
File opened for reading	/proc/self/fd/63	firefox-bin
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/stat	firefox-bin
File opened for reading	/proc/meminfo	firefox-bin
File opened for reading	/proc/self/fd	dbus-launch
File opened for reading	/proc/self/fd/33	firefox-bin
File opened for reading	/proc/filesystems	at-spi-bus-launcher
File opened for reading	/proc/self/task/3437/stat	firefox-bin
File opened for reading	/proc/self/fd/46	firefox-bin
File opened for reading	/proc/2741/cmdline	dbus-daemon
File opened for reading	/proc/3288/stat	firefox-bin
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	gvfsd
File opened for reading	/proc/self/task/2883/stat	firefox-bin
File opened for reading	/proc/3150/stat	firefox-bin
File opened for reading	/proc/3242/stat	firefox-bin
File opened for reading	/proc/2714/cmdline	dbus-daemon
File opened for reading	/proc/self/task/2797/stat	firefox-bin
File opened for reading	/proc/self/task/3025/stat	firefox-bin
File opened for reading	/proc/2659/cgroup	xdg-desktop-portal
File opened for reading	/proc/2709/stat	firefox-bin
File opened for reading	/proc/mounts	dbus-daemon
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/maps	firefox-bin
File opened for reading	/proc/1/cgroup	xdg-desktop-portal
File opened for reading	/proc/self/fd	dbus-send
File opened for reading	/proc/self/cgroup	firefox-bin
File opened for reading	/proc/self/task/3219/stat	firefox-bin
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/task/2896/stat	firefox-bin
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/2659/cmdline	dbus-daemon
File opened for reading	/proc/2765/cmdline	dbus-daemon
File opened for reading	/proc/2818/stat	firefox-bin
File opened for reading	/proc/self/task/3352/stat	firefox-bin
File opened for reading	/proc/3387/stat	firefox-bin
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/2889/stat	firefox-bin
File opened for reading	/proc/self/task/3068/stat	firefox-bin
File opened for reading	/proc/self/fd/82	firefox-bin

Writes file to shm directory 1 IoCs

Malware can drop malicious files in the shm directory which will run directly from RAM.

description	ioc	Process
File opened for modification	/dev/shm/sem.6uI7ZG	sd_dummy

Writes file to tmp directory 3 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/tmpaddon-1	firefox-bin
File opened for modification	/tmp/firefox/.parentlock	firefox-bin
File opened for modification	/tmp/tmpaddon	firefox-bin

/usr/bin/xdg-open
xdg-open https://www.thisworldthesedays.com/sherlockhollmes-2.html
1⤵
PID:2567
- /usr/bin/dbus-send
  dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
  2⤵
  - Reads runtime system information
  PID:2569
- - /usr/bin/dbus-launch
    dbus-launch --autolaunch 36e6eb39a6fa405996e79cad2731865d --binary-syntax --close-stderr
    3⤵
    - Reads runtime system information
    PID:2570
  - - /usr/bin/dbus-daemon
      /usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:2572
    - - /usr/libexec/xdg-desktop-portal
        
        /usr/libexec/xdg-desktop-portal
        5⤵
        Reads runtime system information
        
        PID:2713
    - - /usr/libexec/at-spi-bus-launcher
        
        /usr/libexec/at-spi-bus-launcher
        5⤵
        Reads runtime system information
        
        PID:2714
    - - /usr/libexec/xdg-document-portal
        
        /usr/libexec/xdg-document-portal
        5⤵
        Reads runtime system information
        
        PID:2734
      - /usr/bin/fusermount3
        
        fusermount3 -o "rw,nosuid,nodev,fsname=portal,auto_unmount,subtype=portal" -- /root/.cache/doc
        6⤵
        
        PID:2748
    - - /usr/libexec/xdg-permission-store
        
        /usr/libexec/xdg-permission-store
        5⤵
        Reads runtime system information
        
        PID:2741
    - - /usr/libexec/xdg-desktop-portal-gtk
        
        /usr/libexec/xdg-desktop-portal-gtk
        5⤵
        
        PID:2753
    - - /usr/libexec/gvfsd
        
        /usr/libexec/gvfsd
        5⤵
        Reads runtime system information
        
        PID:2758
- /usr/bin/grep
  grep " = \\\"xfce4\\\"\$"
  2⤵
  - Reads runtime system information
  PID:2576
- /usr/bin/xprop
  xprop -root _DT_SAVE_MODE
  2⤵
  PID:2575
- /usr/bin/xprop
  xprop -root
  2⤵
  PID:2577
- /usr/bin/grep
  grep -i "^xfce_desktop_window"
  2⤵
  PID:2578
- /usr/bin/grep
  grep -q "^Enlightenment"
  2⤵
  - Reads runtime system information
  PID:2580
- /usr/bin/uname
  uname
  2⤵
  PID:2581
- /usr/bin/grep
  grep -q "^file://"
  2⤵
  - Reads runtime system information
  PID:2583
- /usr/bin/egrep
  egrep -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:2585
- /usr/local/sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:2585
- /usr/local/bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:2585
- /usr/sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:2585
- /usr/bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  - Reads runtime system information
  PID:2585
- /usr/bin/sed
  sed -n "s/\$^[[:alnum:]+\\.-]*\$:.*\$/\\1/p"
  2⤵
  - Reads runtime system information
  PID:2588
- /usr/bin/xdg-mime
  xdg-mime query default x-scheme-handler/https
  2⤵
  PID:2589
- - /usr/bin/dbus-send
    dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
    3⤵
    - Reads runtime system information
    PID:2590
  - - /usr/bin/dbus-launch
      dbus-launch --autolaunch 36e6eb39a6fa405996e79cad2731865d --binary-syntax --close-stderr
      4⤵
      PID:2591
- - /usr/bin/xprop
    xprop -root _DT_SAVE_MODE
    3⤵
    PID:2592
- - /usr/bin/grep
    grep " = \\\"xfce4\\\"\$"
    3⤵
    PID:2593
- - /usr/bin/xprop
    xprop -root
    3⤵
    PID:2594
- - /usr/bin/grep
    grep -i "^xfce_desktop_window"
    3⤵
    - Reads runtime system information
    PID:2595
- - /usr/bin/grep
    grep -q "^Enlightenment"
    3⤵
    - Reads runtime system information
    PID:2597
- - /usr/bin/uname
    uname
    3⤵
    PID:2598
- - /usr/bin/sed
    sed "s/:/ /g"
    3⤵
    - Reads runtime system information
    PID:2601
- - /usr/bin/grep
    grep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
    3⤵
    - Reads runtime system information
    PID:2603
- - /usr/bin/head
    head -n 1
    3⤵
    PID:2604
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:2606
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:2605
- - /usr/bin/grep
    grep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
    3⤵
    PID:2608
- - /usr/bin/head
    head -n 1
    3⤵
    PID:2609
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:2611
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:2610
- - /usr/bin/grep
    grep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
    3⤵
    PID:2613
- - /usr/bin/head
    head -n 1
    3⤵
    PID:2614
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:2615
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:2616
- - /usr/bin/grep
    grep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
    3⤵
    PID:2618
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:2620
- - /usr/bin/head
    head -n 1
    3⤵
    PID:2619
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:2621
- - /usr/bin/head
    head -n 1
    3⤵
    PID:2624
- - /usr/bin/grep
    grep "x-scheme-handler/https=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache
    3⤵
    - Reads runtime system information
    PID:2623
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:2625
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:2626
- /usr/bin/sed
  sed "s/:/ /g"
  2⤵
  PID:2629
- /usr/bin/sed
  sed -e "s|-|/|"
  2⤵
  - Reads runtime system information
  PID:2632
- /usr/bin/sed
  sed -e "s|-|/|"
  2⤵
  - Reads runtime system information
  PID:2635
- /usr/bin/cut
  cut "-d=" -f 2-
  2⤵
  PID:2640
- /usr/bin/which
  which firefox
  2⤵
  PID:2644
- /usr/bin/cut
  cut "-d=" -f 2-
  2⤵
  PID:2647
- /usr/bin/cut
  cut "-d=" -f 2-
  2⤵
  PID:2650
- /usr/bin/cut
  cut "-d=" -f 2-
  2⤵
  PID:2655
- /usr/bin/cut
  cut "-d=" -f 2-
  2⤵
  PID:2658
- /usr/bin/firefox
  /usr/bin/firefox https://www.thisworldthesedays.com/sherlockhollmes-2.html
  2⤵
  PID:2659
- /usr/lib/firefox/firefox-bin
  /usr/bin/firefox https://www.thisworldthesedays.com/sherlockhollmes-2.html
  2⤵
  - Changes its process name
  - Checks CPU configuration
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:2659
- - /usr/local/sbin/dbus-launch
    dbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr
    3⤵
    PID:2665
- - /usr/local/bin/dbus-launch
    dbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr
    3⤵
    PID:2665
- - /usr/sbin/dbus-launch
    dbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr
    3⤵
    PID:2665
- - /usr/bin/dbus-launch
    dbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr
    3⤵
    PID:2665
- - /usr/local/sbin/dbus-launch
    dbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr
    3⤵
    PID:2667
- - /usr/local/bin/dbus-launch
    dbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr
    3⤵
    PID:2667
- - /usr/sbin/dbus-launch
    dbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr
    3⤵
    PID:2667
- - /usr/bin/dbus-launch
    dbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr
    3⤵
    PID:2667
- - /usr/lib/firefox/glxtest
    /usr/lib/firefox/glxtest -f 16
    3⤵
    - Changes its process name
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    PID:2669
- - /usr/local/sbin/dbus-launch
    dbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr
    3⤵
    PID:2692
- - /usr/local/bin/dbus-launch
    dbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr
    3⤵
    PID:2692
- - /usr/sbin/dbus-launch
    dbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr
    3⤵
    PID:2692
- - /usr/bin/dbus-launch
    dbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr
    3⤵
    PID:2692
- - /usr/lib/firefox/firefox-bin
    /usr/lib/firefox/firefox-bin -contentproc -ipcHandle 0 -sandboxReporter 1 -initialChannelId "{d873ee12-0c7b-4514-a903-6c51f29ca05d}" -parentPid 2659 -crashReporter 2 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser 1 forkserver
    3⤵
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:2707
- - /usr/bin/speech-dispatcher
    /usr/bin/speech-dispatcher --spawn --communication-method unix_socket --socket-path /root/.cache/speech-dispatcher/speechd.sock
    3⤵
    PID:3406
  - - /bin/sh
      sh -c -- "type mimic3 > /dev/null 2>&1"
      4⤵
      PID:3407
  - - /bin/sh
      sh -c -- "type epos-say > /dev/null 2>&1"
      4⤵
      PID:3408
  - - /bin/sh
      sh -c -- "type espeak > /dev/null 2>&1"
      4⤵
      PID:3409
  - - /bin/sh
      sh -c -- "type mbrola > /dev/null 2>&1"
      4⤵
      PID:3410
  - - /bin/sh
      sh -c -- "type /opt/swift/bin/swift > /dev/null 2>&1"
      4⤵
      PID:3411
  - - /bin/sh
      sh -c -- "type curl > /dev/null 2>&1"
      4⤵
      PID:3412
  - - /bin/sh
      sh -c -- "type say > /dev/null 2>&1"
      4⤵
      PID:3413
  - - /bin/sh
      sh -c -- "type espeak-ng > /dev/null 2>&1"
      4⤵
      PID:3414
  - - /bin/sh
      sh -c -- "type mbrola > /dev/null 2>&1"
      4⤵
      PID:3415
  - - /bin/sh
      sh -c -- "type llia_phon > /dev/null 2>&1"
      4⤵
      PID:3416
  - - /bin/sh
      sh -c -- "type mbrola > /dev/null 2>&1"
      4⤵
      PID:3417
  - - /usr/lib/speech-dispatcher-modules/sd_espeak-ng-mbrola
      /usr/lib/speech-dispatcher-modules/sd_espeak-ng-mbrola /etc/speech-dispatcher/modules/espeak-ng-mbrola.conf
      4⤵
      PID:3418
  - - /usr/lib/speech-dispatcher-modules/sd_espeak-ng
      /usr/lib/speech-dispatcher-modules/sd_espeak-ng /etc/speech-dispatcher/modules/espeak-ng.conf
      4⤵
      PID:3420
  - - /usr/lib/speech-dispatcher-modules/sd_dummy
      /usr/lib/speech-dispatcher-modules/sd_dummy /etc/speech-dispatcher/modules/dummy.conf
      4⤵
      Writes file to shm directory
      PID:3503
  - - /usr/lib/speech-dispatcher-modules/sd_openjtalk
      /usr/lib/speech-dispatcher-modules/sd_openjtalk /etc/speech-dispatcher/modules/openjtalk.conf
      4⤵
      PID:3505

/usr/libexec/gvfsd-fuse
/usr/libexec/gvfsd-fuse /root/.gvfs -f
1⤵
PID:2765

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/dev/shm/sem.6uI7ZG

Filesize
32B

MD5
fd8ebcfae4c6b0f76ae44176d5a08480

SHA1
0d520752af1739fb60832987aa02a025d1621b59

SHA256
c8387bf8dbadf1c9ba583a8d27b620f4bd13cee4ea2ef98bcb0e1bdfd6f3d8c8

SHA512
ddc3f4f30ee927a232084df67f92bf08ddeea12b4089f0662dcff27e66f07a19d15f453466731689bc1f6d22e4d0aa2364b60bbab7adb2bb7668935a2da0be75

Download Submit
/root/.cache/speech-dispatcher/log/dummy.log

Filesize
129B

MD5
b2b3a649e7e18f578a7d885627764958

SHA1
9581944e1dd494b74896964a2b2db251428849be

SHA256
4d0663e7c2b22f2942d0e8eb992e7cce6350a01bde90d941a4fb1fab1e65065a

SHA512
db150cd21eeea03ae2a4e0a1325f3f5d60343d08de349cb27e1da0a51402301b6271ede58f69377dc0d337e9db1071d5921a4d26f81427b74d361959d2c823e7

Download Submit
/root/.cache/speech-dispatcher/log/openjtalk.log

Filesize
13B

MD5
96e23f7ca3a59099ff1918181c6245cd

SHA1
d3281aab2bdb4ab8ab286c4931db4b2cdd078cf7

SHA256
13da6708a2d9f8e382e8e2bc393abf852bcb30a763ea0f29c22bc162fd082ddb

SHA512
2245183dcbd2643525dbc42734c3f7bbc762000a5b9df2915d18d1fa8778db1b3761f9540ad2220ab1cdbf1c7d715c657406500591246337be3e9ff59ef90617

Download Submit
/root/.cache/speech-dispatcher/log/speech-dispatcher.log

Filesize
2.4MB

MD5
103d09e07fdfeac7e2dff0b8a8a29742

SHA1
8b833f5d33de610497ca62a8a6e9c5c160cd099f

SHA256
dbab673136bde6e7b9605658e2a2deccca0adfe149bf986928f88a1b127f3331

SHA512
9f168c8f8d3e55de324264b8016581cb2676a224aa6fef10faca5710fc648f214b9d534df3db7eaa3d21739821612b22a0d94c2a8b887e551357907f0d82988e

Download Submit
/root/.cache/speech-dispatcher/pid/speech-dispatcher.pid

Filesize
5B

MD5
4e137c4035538ba1f76ce4d661c3006f

SHA1
db0f602ccad077fe8dc271cd1dd25173bd4f8a4c

SHA256
295f97fb1513713697f9ed35d1b19f0535ecd127c72b6908258773e820eb7dd0

SHA512
fc15d6e364540baece2f94d3424b5f6b5e2ff0038b0a0728474362daf1c4d5291db549072750e7425f24b9594ddc8f4d59150c276b222cfee9898bf0381a96af

Download Submit
/root/.cache/speech-dispatcher/pid/speech-dispatcher.pid

Filesize
5B

MD5
bd128fbb11a1583cfe0dbe6936953245

SHA1
071a45d04c9a6b892d773c19c172d4426d7aa4e8

SHA256
63a668a62f46c30434f7dd88e9996252d5d35098845acb6a2416b27f99fe7031

SHA512
e35416eb083693b0834853d6347c954fe93837d1e64ca0ec05d50d35dcc83404439edbcf7e5cd3bf6ea6b83bebe2c08887cd1a1df94503c1ee085657c07b3aa8

Download Submit
/tmp/tmpaddon

Filesize
575KB

MD5
2aa72a97657774b1eefabe0490b3c088

SHA1
17f12db36fc49b9cf38d61ed2dbde55e71b81b85

SHA256
997b6e1c0e07307de3adf5d0d7a3ddc5d81cd522afe675dfdb43154f73f5b0d0

SHA512
f5246bf14d038adf4ce0c4360262ab722bc3de4220f047c3d542b4c564074b4877dc8659e3125c5171c749e7ce93f20cc63777eb5e1539e960670cbc5f30ac85

Download Submit
/tmp/tmpaddon

Filesize
11KB

MD5
25e8156b7f7ca8dad999ee2b93a32b71

SHA1
db587e9e9559b433cee57435cb97a83963659430

SHA256
ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986

SHA512
1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56

Download Submit
/tmp/tmpaddon-1

Filesize
235KB

MD5
325fe4969a79462d008b0542144852a3

SHA1
cd1341a3226077eb965ad69e063bc74598ee97ed

SHA256
823877ae154b493f842372ba9faa2ea0037ccd2bab8e0946cd80d4d508375f7f

SHA512
5e7b8c2527d7b1133be6696b71888e01a628e17013274b3124f1bf7e1607e4a0e67387f10a4f71aa508a0bc0855414cce79497e342c29e9b4d27a828e696a7a1

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads