Analysis
-
max time kernel
256s -
max time network
269s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240508-en -
resource tags
-
submitted
28/03/2025, 13:09
General
-
Target
http://8.8.4.4
Score
4/10
Malware Config
Signatures
-
Changes its process name 64 IoCs
-
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
-
Reads CPU attributes 1 TTPs 11 IoCs
-
Enumerates kernel/hardware configuration 1 TTPs 60 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
-
System Information Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the system, such as OS, hostname, and hardware details.
-
Writes file to tmp directory 3 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/usr/bin/xdg-openxdg-open http://8.8.4.41⤵
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager2⤵
- Reads runtime system information
-
/usr/bin/dbus-launchdbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr3⤵
-
/usr/bin/dbus-daemon/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session4⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/libexec/xdg-desktop-portal/usr/libexec/xdg-desktop-portal5⤵
- Changes its process name
-
-
/usr/libexec/xdg-document-portal/usr/libexec/xdg-document-portal5⤵
- Changes its process name
- Reads runtime system information
-
-
/usr/libexec/xdg-permission-store/usr/libexec/xdg-permission-store5⤵
- Changes its process name
- Reads runtime system information
-
-
/usr/libexec/xdg-desktop-portal-gtk/usr/libexec/xdg-desktop-portal-gtk5⤵
- Changes its process name
- Reads runtime system information
-
-
/usr/lib/gvfs/gvfsd/usr/lib/gvfs/gvfsd5⤵
- Changes its process name
- Reads runtime system information
-
-
-
-
-
/bin/grepgrep " = \\\"xfce4\\\"\$"2⤵
-
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE2⤵
-
-
/bin/grepgrep -i "^xfce_desktop_window"2⤵
-
-
/usr/bin/xpropxprop -root2⤵
-
-
/bin/grepgrep -q "^Enlightenment"2⤵
-
-
/bin/unameuname2⤵
-
-
/bin/grepgrep -q "^file://"2⤵
-
-
/bin/egrepegrep -q "^[[:alpha:]+\\.\\-]+:"2⤵
-
-
/usr/local/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
-
-
/usr/local/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
-
-
/usr/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
-
-
/usr/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
-
-
/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
-
-
/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
-
-
/bin/sedsed -n "s/\\(^[[:alnum:]+\\.-]*\\):.*\$/\\1/p"2⤵
- Reads runtime system information
-
-
/usr/bin/xdg-mimexdg-mime query default x-scheme-handler/http2⤵
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager3⤵
- Reads runtime system information
-
/usr/bin/dbus-launchdbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr4⤵
-
-
-
/bin/grepgrep " = \\\"xfce4\\\"\$"3⤵
-
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE3⤵
-
-
/bin/grepgrep -i "^xfce_desktop_window"3⤵
-
-
/usr/bin/xpropxprop -root3⤵
-
-
/bin/grepgrep -q "^Enlightenment"3⤵
-
-
/bin/unameuname3⤵
-
-
/bin/sedsed "s/:/ /g"3⤵
- Reads runtime system information
-
-
/usr/bin/cutcut -d ";" -f 13⤵
-
-
/usr/bin/cutcut -d "=" -f 23⤵
-
-
/bin/grepgrep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵
-
-
/usr/bin/headhead -n 13⤵
-
-
/usr/bin/cutcut -d ";" -f 13⤵
-
-
/usr/bin/cutcut -d "=" -f 23⤵
-
-
/usr/bin/headhead -n 13⤵
-
-
/bin/grepgrep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵
-
-
/usr/bin/cutcut -d ";" -f 13⤵
-
-
/usr/bin/cutcut -d "=" -f 23⤵
-
-
/usr/bin/headhead -n 13⤵
-
-
/bin/grepgrep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵
-
-
/usr/bin/cutcut -d ";" -f 13⤵
-
-
/usr/bin/cutcut -d "=" -f 23⤵
-
-
/usr/bin/headhead -n 13⤵
-
-
/bin/grepgrep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵
-
-
/usr/bin/cutcut -d ";" -f 13⤵
-
-
/usr/bin/cutcut -d "=" -f 23⤵
-
-
/usr/bin/headhead -n 13⤵
-
-
/bin/grepgrep "x-scheme-handler/http=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache3⤵
-
-
-
/bin/sedsed "s/:/ /g"2⤵
- Reads runtime system information
-
-
/bin/sedsed -e "s|-|/|"2⤵
- Reads runtime system information
-
-
/bin/sedsed -e "s|-|/|"2⤵
- Reads runtime system information
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵
-
-
/usr/bin/whichwhich firefox2⤵
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵
-
-
/usr/bin/firefox/usr/bin/firefox http://8.8.4.42⤵
-
/usr/bin/whichwhich /usr/bin/firefox3⤵
-
-
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox http://8.8.4.42⤵
- Changes its process name
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
-
/usr/bin/dbus-launchdbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr3⤵
-
-
/usr/bin/lsb_release/usr/bin/lsb_release -idrc3⤵
- System Information Discovery
-
-
/usr/local/sbin/dbus-launchdbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr3⤵
-
-
/usr/local/bin/dbus-launchdbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr3⤵
-
-
/usr/sbin/dbus-launchdbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr3⤵
-
-
/usr/bin/dbus-launchdbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr3⤵
-
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -parentBuildID 20230522134052 -prefsLen 21344 -prefMapSize 234909 -appDir /usr/lib/firefox/browser "{97327d1a-0055-4339-b2a8-947bdca6f0e5}" 2636 true socket3⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 19550 -prefMapSize 234909 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{77d2a2cc-6c9e-4582-b341-c854d8f068b1}" 2636 true tab3⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 2 -isForBrowser -prefsLen 25864 -prefMapSize 234909 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{16b43276-e5a5-412d-aee1-79f697c9f902}" 2636 true tab3⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 3 -isForBrowser -prefsLen 23998 -prefMapSize 234909 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{dd9b9421-6427-4a9b-b6fd-6e84dcd4413a}" 2636 true tab3⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 4 -isForBrowser -prefsLen 23998 -prefMapSize 234909 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{a5df0d3d-4ace-42bd-b644-38642ccb9064}" 2636 true tab3⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -contentproc -childID 5 -isForBrowser -prefsLen 23998 -prefMapSize 234909 -jsInitLen 238780 -parentBuildID 20230522134052 -appDir /usr/lib/firefox/browser "{a3cd847c-cf90-45da-ae15-4ba92b00754e}" 2636 true tab3⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
-
/usr/lib/gvfs/gvfsd-fuse/usr/lib/gvfs/gvfsd-fuse /root/.gvfs -f -o big_writes1⤵
- Changes its process name
- Reads runtime system information
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD57daae609c23338d7a4ce1e540261e3e1
SHA14ca4f2c0ea54d1ad23fa559d8637ca9c0bd3d320
SHA256b7d8bfe084b451a9b81660abdcef732fc9d1e96236142525d731f03d15f6a238
SHA51232fd8b81ea5932227d8e017905238f52c82730d6c13e40511f7448d5f11c54a0af55caa615c771cffc7e83d6b5dd4e606e797c4fd49a691c6cb9c6152a70ae4a
-
Filesize
499KB
MD5152eda253e242e18443ef3282495bc7c
SHA1ff0fa85565f21ec4931baad4573b4c0bd08c4019
SHA2568e03090fee16f6e0ee2e436af8e51d0c3deed6d9f0db80dec048e668fc009a48
SHA51294531e267314de661b2205c606283fb066d781e5c11027578f2a3c3aa353437c2289544074a28101b6b6f0179f0fe6bd890a0ae2bb6e1cf9053650472576366c