Resubmissions
23/04/2026, 15:10
260423-ske8dsf12m623/04/2026, 15:10
260423-sj4jlafz9l623/04/2026, 15:09
260423-sjtpdsgx6w623/04/2026, 15:06
260423-sgsdjsgw71823/04/2026, 14:50
260423-r7t5dsfw5m923/04/2026, 14:47
260423-r547ksgs8v323/04/2026, 14:43
260423-r33wqsgs4t817/04/2026, 16:02
260417-tg553scs6r309/02/2026, 21:46
260209-1mnxbadw3a409/02/2026, 21:42
260209-1kdnkadv6c7Analysis
- user interaction
yes - max time kernel
148s - max time network
128s - platform
ubuntu-22.04_amd64 - resource
ubuntu2204-amd64-20260126-en - resource tags
- submitted
23/04/2026, 15:10
General
- Target http://Google.com
- Sample260423-ske8dsf12m
Score
6/10
Malware Config
Signatures
- Checks hardware identifiers (DMI) 1 TTPs 1 IoCs
Checks DMI information which indicate if the system is a virtual machine.
- Reads hardware information 1 TTPs 1 IoCs
Accesses system info like serial numbers, manufacturer names etc.
- Changes its process name 64 IoCs
- Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
- Reads CPU attributes 1 TTPs 9 IoCs
- Enumerates kernel/hardware configuration 1 TTPs 41 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
- Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
- Writes file to tmp directory 5 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/usr/bin/xdg-openxdg-open http://Google.com1⤵
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager2⤵
- Reads runtime system information
-
/usr/bin/dbus-launchdbus-launch --autolaunch f2de92a803c744e586bd87567a26b68a --binary-syntax --close-stderr3⤵
-
/usr/bin/dbus-daemon/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session4⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/libexec/xdg-desktop-portal/usr/libexec/xdg-desktop-portal5⤵
- Reads runtime system information
-
-
/usr/libexec/at-spi-bus-launcher/usr/libexec/at-spi-bus-launcher5⤵
- Reads runtime system information
-
-
/usr/libexec/xdg-document-portal/usr/libexec/xdg-document-portal5⤵
-
/usr/bin/fusermount3fusermount3 -o "rw,nosuid,nodev,fsname=portal,auto_unmount,subtype=portal" -- /root/.cache/doc6⤵
-
-
-
/usr/libexec/xdg-permission-store/usr/libexec/xdg-permission-store5⤵
- Reads runtime system information
-
-
/usr/libexec/xdg-desktop-portal-gnome/usr/libexec/xdg-desktop-portal-gnome5⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/usr/libexec/gvfsd/usr/libexec/gvfsd5⤵
-
-
/usr/libexec/xdg-desktop-portal-gtk/usr/libexec/xdg-desktop-portal-gtk5⤵
-
-
/usr/bin/gnome-keyring-daemon/usr/bin/gnome-keyring-daemon --start --foreground "--components=secrets"5⤵
- Reads runtime system information
-
-
/usr/libexec/dconf-service/usr/libexec/dconf-service5⤵
-
-
-
-
-
/usr/bin/grepgrep " = \\\"xfce4\\\"\$"2⤵
- Reads runtime system information
-
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE2⤵
-
-
/usr/bin/grepgrep -i "^xfce_desktop_window"2⤵
-
-
/usr/bin/xpropxprop -root2⤵
-
-
/usr/bin/grepgrep -q "^Enlightenment"2⤵
- Reads runtime system information
-
-
/usr/bin/unameuname2⤵
-
-
/usr/bin/grepgrep -q "^file://"2⤵
- Reads runtime system information
-
-
/usr/bin/egrepegrep -q "^[[:alpha:]+\\.\\-]+:"2⤵
-
-
/usr/local/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
-
-
/usr/local/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
-
-
/usr/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
-
-
/usr/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
-
-
/usr/bin/sedsed -n "s/\\(^[[:alnum:]+\\.-]*\\):.*\$/\\1/p"2⤵
- Reads runtime system information
-
-
/usr/bin/xdg-mimexdg-mime query default x-scheme-handler/http2⤵
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager3⤵
-
/usr/bin/dbus-launchdbus-launch --autolaunch f2de92a803c744e586bd87567a26b68a --binary-syntax --close-stderr4⤵
-
-
-
/usr/bin/grepgrep " = \\\"xfce4\\\"\$"3⤵
-
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE3⤵
-
-
/usr/bin/grepgrep -i "^xfce_desktop_window"3⤵
-
-
/usr/bin/xpropxprop -root3⤵
-
-
/usr/bin/grepgrep -q "^Enlightenment"3⤵
- Reads runtime system information
-
-
/usr/bin/unameuname3⤵
-
-
/usr/bin/sedsed "s/:/ /g"3⤵
- Reads runtime system information
-
-
/usr/bin/cutcut -d ";" -f 13⤵
-
-
/usr/bin/cutcut -d "=" -f 23⤵
-
-
/usr/bin/headhead -n 13⤵
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵
- Reads runtime system information
-
-
/usr/bin/cutcut -d ";" -f 13⤵
-
-
/usr/bin/cutcut -d "=" -f 23⤵
-
-
/usr/bin/headhead -n 13⤵
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵
- Reads runtime system information
-
-
/usr/bin/cutcut -d ";" -f 13⤵
-
-
/usr/bin/cutcut -d "=" -f 23⤵
-
-
/usr/bin/headhead -n 13⤵
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵
-
-
/usr/bin/cutcut -d ";" -f 13⤵
-
-
/usr/bin/cutcut -d "=" -f 23⤵
-
-
/usr/bin/headhead -n 13⤵
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵
- Reads runtime system information
-
-
/usr/bin/cutcut -d ";" -f 13⤵
-
-
/usr/bin/cutcut -d "=" -f 23⤵
-
-
/usr/bin/headhead -n 13⤵
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache3⤵
- Reads runtime system information
-
-
-
/usr/bin/sedsed "s/:/ /g"2⤵
- Reads runtime system information
-
-
/usr/bin/sedsed -e "s|-|/|"2⤵
-
-
/usr/bin/sedsed -e "s|-|/|"2⤵
- Reads runtime system information
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵
-
-
/usr/bin/whichwhich firefox2⤵
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵
-
-
/usr/bin/firefox/usr/bin/firefox http://Google.com2⤵
-
-
/usr/lib/firefox/firefox-bin/usr/bin/firefox http://Google.com2⤵
- Checks hardware identifiers (DMI)
- Reads hardware information
- Changes its process name
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
-
/usr/lib/firefox/crashhelper/usr/lib/firefox/crashhelper 1663 9 /tmp/ 113⤵
-
-
/usr/local/sbin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr3⤵
-
-
/usr/local/bin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr3⤵
-
-
/usr/sbin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr3⤵
-
-
/usr/bin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr3⤵
-
-
/usr/lib/firefox/glxtest/usr/lib/firefox/glxtest -f 183⤵
- Changes its process name
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/usr/lib/firefox/firefox-bin/usr/lib/firefox/firefox-bin -contentproc -ipcHandle 0 -signalPipe 1 -initialChannelId "{20580d6a-ff90-42ce-9bfd-dd4afe6d2b70}" -parentPid 1663 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser 1 forkserver3⤵
- Changes its process name
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
-
/usr/libexec/gvfsd-fuse/usr/libexec/gvfsd-fuse /root/.cache/gvfs -f1⤵
- Reads runtime system information
-
/bin/sh/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=\$\$; exec \"\$@\"" sh file-roller /root/Downloads/steam_latest.deb1⤵
-
/usr/local/sbin/file-rollerfile-roller /root/Downloads/steam_latest.deb1⤵
-
/usr/local/bin/file-rollerfile-roller /root/Downloads/steam_latest.deb1⤵
-
/usr/sbin/file-rollerfile-roller /root/Downloads/steam_latest.deb1⤵
-
/usr/bin/file-rollerfile-roller /root/Downloads/steam_latest.deb1⤵
- Reads runtime system information
-
/usr/local/sbin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr2⤵
-
-
/usr/local/bin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr2⤵
-
-
/usr/sbin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr2⤵
-
-
/usr/bin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr2⤵
-
-
/bin/sh/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=\$\$; exec \"\$@\"" sh file-roller /root/.cache/.fr-ROUJOF/control.tar.gz1⤵
-
/usr/local/sbin/file-rollerfile-roller /root/.cache/.fr-ROUJOF/control.tar.gz1⤵
-
/usr/local/bin/file-rollerfile-roller /root/.cache/.fr-ROUJOF/control.tar.gz1⤵
-
/usr/sbin/file-rollerfile-roller /root/.cache/.fr-ROUJOF/control.tar.gz1⤵
-
/usr/bin/file-rollerfile-roller /root/.cache/.fr-ROUJOF/control.tar.gz1⤵
-
/usr/local/sbin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr2⤵
-
-
/usr/local/bin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr2⤵
-
-
/usr/sbin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr2⤵
-
-
/usr/bin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
control.tar.gz
user
events
events
25da84ef-81f7-4528-9b7c-27f39738e88b
2bc98c1b-9b6f-42a5-8470-84d62ea3baf2
5e260627-a9cd-44f5-ac83-a5acbd6caaa1
633d5ed5-924b-46e6-bf87-f49323faac20
66bffcd4-1595-4b70-983d-f81487d8af83
7cbb64e2-9f95-48e1-9ca3-084ca68f0415
8415f790-cccc-434a-8cae-9d6f4e7f914b
92e6a679-14e7-480c-9826-935693242c53
cd253f44-7ea4-48dd-b956-9ced370b33ff
e5f1b5c5-0847-4869-a50c-191252853d5e
f451a56c-16d2-45db-8ca0-33972283fc86
f90b2bd6-4cc3-4091-a965-c9add3c1821c
formhistory.sqlite
prefs-1.js
prefs-1.js
prefs-1.js
prefs-1.js
prefs-1.js
protections.sqlite
recovery.jsonlz4.tmp
webappsstore.sqlite
tmpaddon
tmpaddon-1