Analysis
- user interaction
yes - max time kernel
146s - max time network
141s - platform
ubuntu-22.04_amd64 - resource
ubuntu2204-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20260513-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system - submitted
17/05/2026, 17:39
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://google.com
Resource
ubuntu2204-amd64-20260513-en
ubuntu-22.04-amd64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
http://google.com
Resource
debian9-armhf-20260513-en
debian-9-armhf
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
http://google.com
Resource
debian9-mipsbe-20260513-en
debian-9-mips
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
http://google.com
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
0 signatures
150 seconds
Malware Config
Signatures
- Checks hardware identifiers (DMI) 1 TTPs 1 IoCs
Checks DMI information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /sys/devices/virtual/dmi/id/product_name firefox-bin - Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 202 raw.githubusercontent.com 198 raw.githubusercontent.com 199 raw.githubusercontent.com 200 raw.githubusercontent.com 201 raw.githubusercontent.com - Reads hardware information 1 TTPs 1 IoCs
Accesses system info like serial numbers, manufacturer names etc.
description ioc Process File opened for reading /sys/devices/virtual/dmi/id/product_sku firefox-bin - Changes its process name 64 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself AsyncSi~lThread 1709 firefox-bin Changes the process name, possibly in an attempt to hide itself gmain 1713 firefox-bin Changes the process name, possibly in an attempt to hide itself pool 1715 firefox-bin Changes the process name, possibly in an attempt to hide itself gdbus 1716 firefox-bin Changes the process name, possibly in an attempt to hide itself glean.dispatche 1717 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 1719 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 1719 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 1719 firefox-bin Changes the process name, possibly in an attempt to hide itself Backgro~Pool #1 1724 firefox-bin Changes the process name, possibly in an attempt to hide itself Backgro~Pool #1 1724 firefox-bin Changes the process name, possibly in an attempt to hide itself IPDL Background 1723 firefox-bin Changes the process name, possibly in an attempt to hide itself IPDL Background 1723 firefox-bin Changes the process name, possibly in an attempt to hide itself Socket Thread 1722 firefox-bin Changes the process name, possibly in an attempt to hide itself Socket Thread 1722 firefox-bin Changes the process name, possibly in an attempt to hide itself Netlink Monitor 1721 firefox-bin Changes the process name, possibly in an attempt to hide itself Netlink Monitor 1721 firefox-bin Changes the process name, possibly in an attempt to hide itself Timer 1720 firefox-bin Changes the process name, possibly in an attempt to hide itself Timer 1720 firefox-bin Changes the process name, possibly in an attempt to hide itself [pango] FcInit 1725 firefox-bin Changes the process name, possibly in an attempt to hide itself glxtest:disk$0 1731 glxtest Changes the process name, possibly in an attempt to hide itself HTML5 Parser 1733 firefox-bin Changes the process name, possibly in an attempt to hide itself HTML5 Parser 1733 firefox-bin Changes the process name, possibly in an attempt to hide itself dconf worker 1732 firefox-bin Changes the process name, possibly in an attempt to hide itself JS Watchdog 1735 firefox-bin Changes the process name, possibly in an attempt to hide itself JS Watchdog 1735 firefox-bin Changes the process name, possibly in an attempt to hide itself BGReadURLs 1736 firefox-bin Changes the process name, possibly in an attempt to hide itself BGReadURLs 1736 firefox-bin Changes the process name, possibly in an attempt to hide itself Cache2 I/O 1737 firefox-bin Changes the process name, possibly in an attempt to hide itself Cache2 I/O 1737 firefox-bin Changes the process name, possibly in an attempt to hide itself Cookie 1738 firefox-bin Changes the process name, possibly in an attempt to hide itself Cookie 1738 firefox-bin Changes the process name, possibly in an attempt to hide itself TaskCon~ller #1 1740 firefox-bin Changes the process name, possibly in an attempt to hide itself StreamTrans #1 1741 firefox-bin Changes the process name, possibly in an attempt to hide itself StreamTrans #1 1741 firefox-bin Changes the process name, possibly in an attempt to hide itself TaskCon~ller #0 1739 firefox-bin Changes the process name, possibly in an attempt to hide itself BgIOThr~Pool #1 1742 firefox-bin Changes the process name, possibly in an attempt to hide itself BgIOThr~Pool #1 1742 firefox-bin Changes the process name, possibly in an attempt to hide itself Worker Launcher 1743 firefox-bin Changes the process name, possibly in an attempt to hide itself Worker Launcher 1743 firefox-bin Changes the process name, possibly in an attempt to hide itself QuotaManager IO 1744 firefox-bin Changes the process name, possibly in an attempt to hide itself QuotaManager IO 1744 firefox-bin Changes the process name, possibly in an attempt to hide itself Softwar~cThread 1745 firefox-bin Changes the process name, possibly in an attempt to hide itself Softwar~cThread 1745 firefox-bin Changes the process name, possibly in an attempt to hide itself Softwar~cThread 1745 firefox-bin Changes the process name, possibly in an attempt to hide itself CanvasRenderer 1751 firefox-bin Changes the process name, possibly in an attempt to hide itself CanvasRenderer 1751 firefox-bin Changes the process name, possibly in an attempt to hide itself Compositor 1750 firefox-bin Changes the process name, possibly in an attempt to hide itself Compositor 1750 firefox-bin Changes the process name, possibly in an attempt to hide itself Glyph rasterize 1749 firefox-bin Changes the process name, possibly in an attempt to hide itself WrGlyph~terizer 1749 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorkerLP#0 1748 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorkerLP#0 1748 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorker#0 1747 firefox-bin Changes the process name, possibly in an attempt to hide itself Renderer 1746 firefox-bin Changes the process name, possibly in an attempt to hide itself Renderer 1746 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorker#0 1747 firefox-bin Changes the process name, possibly in an attempt to hide itself ImageIO 1752 firefox-bin Changes the process name, possibly in an attempt to hide itself ImageIO 1752 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC Launch 1753 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC Launch 1753 firefox-bin Changes the process name, possibly in an attempt to hide itself Permission 1755 firefox-bin Changes the process name, possibly in an attempt to hide itself Permission 1755 firefox-bin Changes the process name, possibly in an attempt to hide itself forkserver 1754 firefox-bin Changes the process name, possibly in an attempt to hide itself SandboxReporter 1756 firefox-bin - Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo firefox-bin - Reads CPU attributes 1 TTPs 9 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/cpu0/cpu_capacity glxtest File opened for reading /sys/devices/system/cpu/present firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/size firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/topology/core_cpus firefox-bin File opened for reading /sys/devices/system/cpu/present firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/cpu_capacity xdg-desktop-portal-gnome File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/size firefox-bin File opened for reading /sys/devices/system/cpu/possible firefox-bin - Enumerates kernel/hardware configuration 1 TTPs 41 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/bus/pci/devices glxtest File opened for reading /sys/bus/pci/devices/0000:00:05.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:00.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:00.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:04.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:05.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:02.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:02.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.3/vendor glxtest File opened for reading /sys/devices/system/cpu firefox-bin File opened for reading /sys/bus/pci/devices/0000:00:05.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:06.0/class glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0 firefox-bin File opened for reading /sys/module/apparmor/parameters/enabled dbus-daemon File opened for reading /sys/bus/pci/devices/0000:00:06.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.1/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:04.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:04.0/device glxtest File opened for reading /sys/fs/cgroup/system.slice/agent.service/cpu.max firefox-bin File opened for reading /sys/kernel/security/apparmor/features/dbus/mask dbus-daemon File opened for reading /sys/devices/pci0000:00/0000:00:02.0/virtio0/drm/renderD128 firefox-bin File opened for reading /sys/bus/pci/devices/0000:00:02.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.1/vendor glxtest File opened for reading /sys/devices/system/cpu glxtest File opened for reading /sys/devices/system/cpu firefox-bin File opened for reading /sys/devices/system/node/node0/meminfo firefox-bin File opened for reading /sys/bus/pci/devices/0000:00:06.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.1/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:03.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:03.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.3/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:00.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:03.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.3/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.0/vendor glxtest File opened for reading /sys/devices/system/cpu xdg-desktop-portal-gnome File opened for reading /sys/fs/cgroup/system.slice/agent.service/cpu.max firefox-bin File opened for reading /sys/devices/pci0000:00/0000:00:02.0/virtio0/drm/card0 firefox-bin File opened for reading /sys/devices/system/node firefox-bin -
description ioc Process File opened for reading /proc/self/fd/41 firefox-bin File opened for reading /proc/filesystems firefox-bin File opened for reading /proc/self/task/1764/stat firefox-bin File opened for reading /proc/1621/attr/apparmor/current dbus-daemon File opened for reading /proc/self/maps grep File opened for reading /proc/filesystems sed File opened for reading /proc/self/maps firefox-bin File opened for reading /proc/filesystems xdg-desktop-portal-gtk File opened for reading /proc/1829/cmdline dbus-daemon File opened for reading /proc/self/maps grep File opened for reading /proc/self/stat firefox-bin File opened for reading /proc/self/mountinfo firefox-bin File opened for reading /proc/1759/cmdline dbus-daemon File opened for reading /proc/1817/cmdline dbus-daemon File opened for reading /proc/filesystems gnome-keyring-daemon File opened for reading /proc/self/fd/59 firefox-bin File opened for reading /proc/sys/kernel/cap_last_cap dbus-daemon File opened for reading /proc/1621/status dbus-daemon File opened for reading /proc/filesystems xdg-document-portal File opened for reading /proc/1801/cmdline dbus-daemon File opened for reading /proc/self/task/1906/stat firefox-bin File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/filesystems firefox-bin File opened for reading /proc/self/fd firefox-bin File opened for reading /proc/self/mountinfo firefox-bin File opened for reading /proc/self/fd dbus-send File opened for reading /proc/1768/cmdline dbus-daemon File opened for reading /proc/1794/cmdline dbus-daemon File opened for reading /proc/filesystems gvfsd File opened for reading /proc/1/cgroup xdg-desktop-portal File opened for reading /proc/self/task/1845/stat firefox-bin File opened for reading /proc/self/fd/86 firefox-bin File opened for reading /proc/self/fd/39 firefox-bin File opened for reading /proc/filesystems xdg-desktop-portal File opened for reading /proc/1780/cmdline dbus-daemon File opened for reading /proc/self/cgroup firefox-bin File opened for reading /proc/self/task/1883/stat firefox-bin File opened for reading /proc/self/fd/116 firefox-bin File opened for reading /proc/self/maps grep File opened for reading /proc/self/cgroup firefox-bin File opened for reading /proc/self/fd firefox-bin File opened for reading /proc/self/stat firefox-bin File opened for reading /proc/self/fd/73 firefox-bin File opened for reading /proc/self/fd/85 firefox-bin File opened for reading /proc/self/maps grep File opened for reading /proc/1637/cmdline dbus-daemon File opened for reading /proc/self/maps firefox-bin File opened for reading /proc/self/fd/45 firefox-bin File opened for reading /proc/filesystems xdg-permission-store File opened for reading /proc/filesystems dbus-daemon File opened for reading /proc/filesystems sed File opened for reading /proc/filesystems sed File opened for reading /proc/self/task/1707/stat firefox-bin File opened for reading /proc/filesystems gvfsd-fuse File opened for reading /proc/self/status firefox-bin File opened for reading /proc/self/fd/96 firefox-bin File opened for reading /proc/self/cmdline firefox-bin File opened for reading /proc/self/task/1849/stat firefox-bin File opened for reading /proc/self/fd/70 firefox-bin File opened for reading /proc/mounts dbus-daemon File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/1706/cmdline dbus-daemon - Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/firefox/.parentlock firefox-bin
Processes
-
/usr/bin/xdg-openxdg-open http://google.com1⤵PID:1611
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager2⤵
- Reads runtime system information
PID:1612 -
/usr/bin/dbus-launchdbus-launch --autolaunch f2de92a803c744e586bd87567a26b68a --binary-syntax --close-stderr3⤵PID:1613
-
/usr/bin/dbus-daemon/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session4⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1615 -
/usr/libexec/xdg-desktop-portal/usr/libexec/xdg-desktop-portal5⤵
- Reads runtime system information
PID:1759
-
-
/usr/libexec/at-spi-bus-launcher/usr/libexec/at-spi-bus-launcher5⤵PID:1762
-
-
/usr/libexec/xdg-document-portal/usr/libexec/xdg-document-portal5⤵
- Reads runtime system information
PID:1768 -
/usr/bin/fusermount3fusermount3 -o "rw,nosuid,nodev,fsname=portal,auto_unmount,subtype=portal" -- /root/.cache/doc6⤵PID:1788
-
-
-
/usr/libexec/xdg-permission-store/usr/libexec/xdg-permission-store5⤵
- Reads runtime system information
PID:1780
-
-
/usr/libexec/xdg-desktop-portal-gnome/usr/libexec/xdg-desktop-portal-gnome5⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
PID:1794
-
-
/usr/libexec/gvfsd/usr/libexec/gvfsd5⤵
- Reads runtime system information
PID:1801
-
-
/usr/libexec/xdg-desktop-portal-gtk/usr/libexec/xdg-desktop-portal-gtk5⤵
- Reads runtime system information
PID:1817
-
-
/usr/bin/gnome-keyring-daemon/usr/bin/gnome-keyring-daemon --start --foreground "--components=secrets"5⤵
- Reads runtime system information
PID:1829
-
-
-
-
-
/usr/bin/grepgrep " = \\\"xfce4\\\"\$"2⤵PID:1623
-
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE2⤵PID:1622
-
-
/usr/bin/grepgrep -i "^xfce_desktop_window"2⤵PID:1625
-
-
/usr/bin/xpropxprop -root2⤵PID:1624
-
-
/usr/bin/grepgrep -q "^Enlightenment"2⤵
- Reads runtime system information
PID:1627
-
-
/usr/bin/unameuname2⤵PID:1628
-
-
/usr/bin/grepgrep -q "^file://"2⤵
- Reads runtime system information
PID:1630
-
-
/usr/bin/egrepegrep -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1632
-
-
/usr/local/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1632
-
-
/usr/local/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1632
-
-
/usr/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1632
-
-
/usr/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
- Reads runtime system information
PID:1632
-
-
/usr/bin/sedsed -n "s/\\(^[[:alnum:]+\\.-]*\\):.*\$/\\1/p"2⤵PID:1635
-
-
/usr/bin/xdg-mimexdg-mime query default x-scheme-handler/http2⤵PID:1636
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager3⤵PID:1637
-
/usr/bin/dbus-launchdbus-launch --autolaunch f2de92a803c744e586bd87567a26b68a --binary-syntax --close-stderr4⤵PID:1638
-
-
-
/usr/bin/grepgrep " = \\\"xfce4\\\"\$"3⤵
- Reads runtime system information
PID:1640
-
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE3⤵PID:1639
-
-
/usr/bin/grepgrep -i "^xfce_desktop_window"3⤵PID:1642
-
-
/usr/bin/xpropxprop -root3⤵PID:1641
-
-
/usr/bin/grepgrep -q "^Enlightenment"3⤵
- Reads runtime system information
PID:1644
-
-
/usr/bin/unameuname3⤵PID:1645
-
-
/usr/bin/sedsed "s/:/ /g"3⤵
- Reads runtime system information
PID:1648
-
-
/usr/bin/headhead -n 13⤵PID:1651
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:1653
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:1652
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵PID:1650
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:1658
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:1657
-
-
/usr/bin/headhead -n 13⤵PID:1656
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵
- Reads runtime system information
PID:1655
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:1663
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:1662
-
-
/usr/bin/headhead -n 13⤵PID:1661
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵
- Reads runtime system information
PID:1660
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:1668
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:1667
-
-
/usr/bin/headhead -n 13⤵PID:1666
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵
- Reads runtime system information
PID:1665
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:1673
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:1672
-
-
/usr/bin/headhead -n 13⤵PID:1671
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache3⤵PID:1670
-
-
-
/usr/bin/sedsed "s/:/ /g"2⤵
- Reads runtime system information
PID:1676
-
-
/usr/bin/sedsed -e "s|-|/|"2⤵
- Reads runtime system information
PID:1679
-
-
/usr/bin/sedsed -e "s|-|/|"2⤵PID:1682
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:1687
-
-
/usr/bin/whichwhich firefox2⤵PID:1691
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:1694
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:1697
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:1702
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:1705
-
-
/usr/bin/firefox/usr/bin/firefox http://google.com2⤵PID:1706
-
-
/usr/lib/firefox/firefox-bin/usr/bin/firefox http://google.com2⤵
- Checks hardware identifiers (DMI)
- Reads hardware information
- Changes its process name
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
PID:1706 -
/usr/lib/firefox/crashhelper/usr/lib/firefox/crashhelper 1706 9 /tmp/ 113⤵PID:1710
-
-
/usr/local/sbin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr3⤵PID:1714
-
-
/usr/local/bin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr3⤵PID:1714
-
-
/usr/sbin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr3⤵PID:1714
-
-
/usr/bin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr3⤵PID:1714
-
-
/usr/lib/firefox/glxtest/usr/lib/firefox/glxtest -f 183⤵
- Changes its process name
- Reads CPU attributes
- Enumerates kernel/hardware configuration
PID:1718
-
-
/usr/lib/firefox/firefox-bin/usr/lib/firefox/firefox-bin -contentproc -ipcHandle 0 -signalPipe 1 -initialChannelId "{f9ea8094-276c-4f0b-9439-9792aca8af2a}" -parentPid 1706 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser 1 forkserver3⤵
- Changes its process name
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1754
-
-
-
/usr/libexec/gvfsd-fuse/usr/libexec/gvfsd-fuse /root/.cache/gvfs -f1⤵
- Reads runtime system information
PID:1806
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /root/.config/mozilla/firefox/z2e2svap.default-release/datareporting/glean/events/events
- Size 2KB
- SHA256 cf6e4ce067104180349bf25c31d96f06f02fee44f3d950c27556d2d432e9f57e
- MD5 cc8623f4832222210cc9f6fc2fcaba5f
- SHA1 738b0a8119a3468d151d918e568784fa20fa8823
- SHA512 83b03958bf5334c84ff0a78419b2b0b9c2843281e7c982c3c3bc45c914e0532c79158a7ffddba4bdee7440a315d48c146feace03a4068f721144f374eb01c646
- TLSH T14651474C3BF48EAAACDBF29C3580028A93694A4755962D439D22EFCDCC946D6316D63C
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/z2e2svap.default-release/datareporting/glean/events/nimbus-targeting-context
- Size 50KB
- SHA256 a36ad6afc05241eeea08d7cf382b1b44ffe085427f966061b6e37a85f7799462
- MD5 4d309f87e5948d1dd07077bc7c3d41e6
- SHA1 914136992f90601d9326db77a62f0fd17c7b09e8
- SHA512 0ec66ce25fcbed5554a9b7e6d2178f9cd842a1f304793de1cf1489120f58877c2ef086de858927422987fda5df3458707e3b8b77237190d4ad09164594ee6021
- SSDEEP 1536:7eCWd1txRDB/YZtLyg4saGr5UIU70aiSRVfu92Slu9mGEgYhUQPolUI888HDnKAa:IsQ
- TLSH T14A337FC8226019FE3E97C3B9958403BD6FDA8F80259B18934D8BDD6DCD9DA99703D036
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/z2e2svap.default-release/datareporting/glean/tmp/2ca2a50f-5eb3-426f-86c7-eceee9dfcbb0
- Size 62KB
- SHA256 d86be8a5b03fd289ad811554bba0d25918aba1e61946f3b32a8989275597d574
- MD5 f37186ae148bbecf65b85c768f67269e
- SHA1 fa7570def4844411aa10ae2577f4388632ea12c4
- SHA512 aa37833cb0eb12ce330d04bf5a1145523cc14a79a4356c3fd502b55fe70ab4adce6f3b1c54ac6fa3d062b64b7d794dc4bfb263c2f2f044436502baef26ae65a0
- SSDEEP 1536:jguD72h8oNXxH/WMgQv6OfCG/4GxmSUXROgma1/keMYqtaNIMakP0fMO/aY48cij:T+WYatS
- TLSH T17853AB88222418FE3ED3C3B9958903B96FDA8FC0259618D35D8BDD2DCE9D958712E077
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/z2e2svap.default-release/datareporting/glean/tmp/66f17603-49eb-404e-9b0d-b50007cb4425
- Size 4KB
- SHA256 b30489e9fe195a92a6a52925bdadcbc9617b7104fe134997f6c17761c02604e8
- MD5 ad6c0df1d5f0471a2c3675c78c6ef159
- SHA1 0a429bd0419578c9a45e82dfe534e7cbb00c3d91
- SHA512 e1826703c7043e99ba2c93f79abf5ea55514c3284228e204b1a6accb391d37c99ee941c5a7abb17639239cfc56fd7911dc639be254d244ea44a50c10a78c32ac
- SSDEEP 96:7Tw1+PYPNBvqrTiWJxJrE3fDUp1cH5yevrCBn4h6/4a4hW94wCcG+:7KPwOnwCct
- TLSH T1DF91D1F8246009173DE3D67EE9C027B2DA2F85D6C4C114561D21CE6BABEE60C51B3F9A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/z2e2svap.default-release/datareporting/glean/tmp/6c5d7c9f-77c6-448c-aa46-996b2cffd365
- Size 4KB
- SHA256 ec42d415c56fd54dd4ddc94dd77e1a1065776ccd890764e440d90935051192ea
- MD5 86e42fa960afa6a649b8d871b587d4d5
- SHA1 061f15286fced821c14a3be6e1fbfa078ef4fd6d
- SHA512 c9c330eeff8db37b22c04266e7a9dfe6254e6b07ccd15b3403f96b1c81631bc9bc911a036994582d553de7e1b05a997f9ae926f0cb57b98f25892c32728742ff
- SSDEEP 96:kyJ51ie5f1cCBYPNpvrxJrBJ4ny3UWHEhqrvKwTDPSa4GRWH3rTfG+sv:56PHcLbTe+sv
- TLSH T141A1BFE824600C167EE3D6BED9C027B3C71F45D584C104652E21DE6EA7EDA0C62A3E9B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/z2e2svap.default-release/datareporting/glean/tmp/728108b1-676b-4ea9-8e9d-3b8b0aad8875
- Size 10KB
- SHA256 374d19ba6a7d9d61c76aacfc01143b793ca230b6198eccb4cdc3a162634a17c0
- MD5 a691faceff6e2f651a7f4a154f7818c8
- SHA1 f92dbc854e143710d755c3211695b98729da20bb
- SHA512 31c163ee89651ab443387081a4c482134b79dd1526020cc3521033b63c61feabb9398975be3494e49979c03f5bbe00365481724868eae51d02d447d29fc15a7e
- SSDEEP 96:fcvJr1cxJr4+hfqrpTEDH3nB1YPN5JiPeyKwUCBvWSa4MfWUhAMMGF/NE6mGUget:fcv4OPyMLcki9f1UKQS30oG8
- TLSH T10C2288FD9C1204033EB2E63DF4E4BEAB411B697149C887991AEC4C3A73DA9BB1153B45
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/z2e2svap.default-release/datareporting/glean/tmp/9de5cbcf-4222-4e5e-b652-ef702f8d2595
- Size 368B
- SHA256 1bce2e0f4c3394a3bb0f17a8121e79241672720bb73a8dc51fc965ea95a12707
- MD5 d59a6c560abfc580eb3554e6ef6d40ed
- SHA1 e6b44ac25fc6f3620d71c13efb4d53f285b20565
- SHA512 1164ab289f688a963b311ae347b788a81fbc67de2f5abb7289b68705a2716e6dab59eb09256284df5bda0e063a24a0e4446e5768234f6177f669ca7b8ebd1b54
- TLSH T120E06866E074C115ED90D619D8904D025E6CE803D0F540B9B9A0B16ECBEB9CC43F362F
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/z2e2svap.default-release/datareporting/glean/tmp/aa0291b9-de29-4e6b-af07-49cb87b75fc2
- Size 4KB
- SHA256 78bbd2cd5a7d329088cc88a4d7929772bf5a48ede0d5c3174ed54138dae124ea
- MD5 e167ca4ad249385c837d97ffc4a00c71
- SHA1 9beea68580257ca88c65fde0b1fcbb4f97062294
- SHA512 212828f8bab970c47991108342a78dc3add0df6971ef482d4ccec0a387571fc68683c7bd287dcfef70dd34b93a1c45840de5c02ec7233bd82872a2575740930f
- SSDEEP 96:zYZvrCB4BnHpE1cqrJKwDyWTe35vP1hYPNxJri+fSa4wvWBwCr:zYAPh4vwCr
- TLSH T18391CFF8246009163DE3D67EE9C027B1D62F85D6C0C114561D11DE6BABEE60C51B3F9A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/z2e2svap.default-release/datareporting/glean/tmp/b34b37da-1baa-4fd2-96d2-29d7f40410a0
- Size 21KB
- SHA256 422327b70e932f975d12605aba5a0a3ccb4fa2c4361171020530ab2ea8156929
- MD5 5a7cdc71d69b8b955b1289dadba75952
- SHA1 15eda8a746f6678899bbd8f47f0fc6e04953729d
- SHA512 1fa15bafe152cd573a70a1ab0876e40ced6ab4f1f14c3430eb902fcda6fad18ab422f9c142a5924128f1d7af2c5e41916b8437e6ae2b03f2beefd7315af0cea2
- SSDEEP 192:X9ZPhjoDwCKgeoCmN1Yilw6ahyAm7QpdO9B:FEfKPo9vAmt
- TLSH T176A20F9C25344C1F7ED3D56D9DC143AD925B8A8188C218836E52EE8FDE9CF0C3356AB6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/z2e2svap.default-release/datareporting/glean/tmp/bcf07b5b-10c0-4938-bbdd-b0820ef46ba0
- Size 13KB
- SHA256 fa9ed4b26aced4ea6159b9e1cf10bb5d2b99cd612743ba3bbbbb09d87e77a544
- MD5 7295d91332f80d8571966909b6cdbdd7
- SHA1 19f5c96a82950b4e9b87fcda6a6727565c8a631d
- SHA512 9d3c77b10da6cc6049d8e614478663e55bca520005554754fb9b60caa320221fa6f1774d4f76d091c61ffc5fa09adcb93d9f8e687551045ffd6f5118fff71dcf
- SSDEEP 384:0P20J7XsLqAtFWXZQr6rrKD4FO8eQ8E6b3QyurP:0xat4ZeF4Frym
- TLSH T1DB52C7B800244C7EADD3D77AD9A13F53CB7F415290C62858AEDD8D1A33EFA4D026690B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/z2e2svap.default-release/datareporting/glean/tmp/d5624056-7e3d-44ca-b8c3-047667e5cd68
- Size 7KB
- SHA256 78a0750fa81b5dca4c363cc7ffcad24bfbde13e8757d3a4ab0ce545589739506
- MD5 76b7fff87809e6dcc0a41776e67777f2
- SHA1 6fb88f2461d939aae11e7af2d62d75d47de6bb4b
- SHA512 9a3e4a08d50cb741ac47c9837cffd77b073ea535d29dd63c65a8b128738e692e75ff434641de3991a5d1f23167aa07dc0c71b7e890d9cf2ee846afa2d756a02d
- SSDEEP 96:LKw+JhUTBqrpxJrf5v1yCB4i3ePE1cHnvrWYPNSa44LWEAXJA0EAbGAUsLA6AU02:KWP4t20J7XsLqbPTO+z
- TLSH T139E123E4042428397DE3D7B5DAE13F92C73F46A6E0C52419AC6A8D1B67EF24C1173A4B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/z2e2svap.default-release/prefs-1.js
- Size 7KB
- SHA256 de867e0029f64cbb93b6573ace0487903b2440d075b474d73a123b2cc23cb6fb
- MD5 9d7c2c4fd06712986f8c21ac593dd86e
- SHA1 899db2244944139395bc4fbf1a4fabf8cc76dd67
- SHA512 bd4f540089de92bc0f16fea7ced525612ca59055c362016da3613950419b29e3a8e38017c3ca06d3fd149cf55aeeb1d2098180d7da965eda8a5714fa0b629003
- SSDEEP 96:oZoYF2c4qjqp2Zh7ItHgzGC7z2j06gmAbIMFxxjnFkI8Aqp8L8kh8M:Ixuwf7ItHy7z22xFDvqp8Y0z
- TLSH T169F1206891084FBFA97337AC6C2889510672C15FB7BF28D750BA8708114CB7491FDAEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/z2e2svap.default-release/prefs-1.js
- Size 7KB
- SHA256 3ac164f967c173c881f4d3e88c359be2740300d347e89f28284102066454dac9
- MD5 b0c4691772c8f9c21caa729f7ee1cc1c
- SHA1 6936ea0dfccecf9761a41b959cbd4c554511c162
- SHA512 66d2aaf58864a5f1b1a6cb3b13d8ff25eee0cc8928bfb59cf08bc2fd582244bc6702f4f90348b56028ce96c7ed14a33ef63c4d15b2587fff72624f9324b9be68
- SSDEEP 96:oZoNF2Sqjqplv/7ItHgzGC/zMj06gmAbIMFxxjnFkI8Aqp828M:IVuD7ItHy/zM2xFDvqp82z
- TLSH T17CF1426891084BBFA97337BC6C2889410A72C15FB7FF28DA107A8708510CB7451F9AEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/z2e2svap.default-release/prefs-1.js
- Size 7KB
- SHA256 1f53345327f4da9ed52a0572869299b25a34116749ad5cf56fdb1fc10186ee01
- MD5 86b47da5984104f2076b589d3ad4d2fe
- SHA1 a1908005c029c57440f5084d7915f3086163b529
- SHA512 6d843ad34ec95c99e95432bf305379837990ed8fb0849eb0ebbed0618be44f19fc6e4bf4655530b1c3535a1967c33b5ae4081979d6aa1e53a9d564e44ebab91a
- SSDEEP 96:oZoNF2Sqjqplv/7ItHgzGC/z2j06gmAbIMFxxjnFkI8Aqp8E8M:IVuD7ItHy/z22xFDvqp8Ez
- TLSH T142F1426891084BBFA97337BC6C6889410672C15FB7FF28DA117A8708414CB7451F9AEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/z2e2svap.default-release/prefs-1.js
- Size 7KB
- SHA256 61debc27527a50a1df256c8d7b721d02bde61bf822032464d78d1e5199f9ef37
- MD5 9452483c27a162fea9c441bdd072a314
- SHA1 2a9f41a95db817ec275c03fcd2fc7d26e7d9e95b
- SHA512 519b86528905e999d2ee57f2d47c0f7d887c1ab4fdea7f5c9eac8ce94c401f696381379c1c7f23aa87d4be8eaba7994bf81d50b0af0e839742228d720676b696
- SSDEEP 96:oZoNF2c4qjqplvh7ItHgzGC/z2j06gmAbIMFxxjnFkI8Aqp8E8M:IWuN7ItHy/z22xFDvqp8Ez
- TLSH T12DF1316891044BBFA97337BC6C6889410672C15FB7FF28DB107A8708514CB7451F9AEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/z2e2svap.default-release/prefs-1.js
- Size 7KB
- SHA256 107a176f12f61d45f22da086dad7f926e6551cca22099175f5e815d7a441f640
- MD5 a8f3c4dbf4794783b295e33ecc2cd3d8
- SHA1 a2315effa02b4a5f10e68f65a716cc9cf2d590ee
- SHA512 c2a18f95c4e361e9f6bae060b887961a8a2c7766ba8fb07bd9b462ea1cd21e16c6bd2f765bd4c95e46cad3c4da8034614c4f909fe6c8c9b93fd2cb6f66791325
- SSDEEP 96:oZoNF2c4qjqplvh7ItHgzGC7z2j06gmAbIMFxxjnFkI8Aqp8W8X8M:IWuN7ItHy7z22xFDvqp83Xz
- TLSH T131F1316891088BBFA97337BC6C6889510672C15FB7BF28DB507A8708114CB7451FDAEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/z2e2svap.default-release/protections.sqlite
- Size 64KB
- SHA256 3d7e2297df3a7421d7015ebc4b95c5097c932fbda0e50027272b4f32e11dd552
- MD5 cbc71dbdc8eb78cd7369cdb44d307f5e
- SHA1 6c1c2e956327cc7d410a3190037cbf335a19cf4f
- SHA512 2c362443ac75e6807916b49d9bb6b2cb120a8d4b9572d6e870205f398df6f60e4b2abe9dd46b7637dd04c93e9f2e2966e44e3b6f46b9bacfb031f73dc5fe88bf
- SSDEEP 3:lSGBl/l/l//lAltllPltlJQdollzvulJOlzALRWemFxu7TuRjBFbrl58lcV+wgn8:ltBl/lYN1ad4BEJYqWvLue3FMOrMZ0l
- TLSH T1B653225E03383122C09A137627C323A23F3CD2BA93232D8379100C308C0A226B821AE8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/z2e2svap.default-release/webappsstore.sqlite
- Size 96KB
- SHA256 d2ad70f945aec5eccbf8800c6a183feab8f03f92e2a8eb47b694a3cc32854d17
- MD5 0464ffc40d8ba8081682ff17f5a2e46b
- SHA1 34ca81b39b4f3ab8fbec114eb0e5d39af8da3614
- SHA512 ec4db13962b31d21937d3bcf29fef64fdfe3640e378efacd27a08d3fe4ae7e69b99b88efe92baf49f01d9d5d0131443a0a6999246cd957a180874fd60a9e4d28
- SSDEEP 6:ltTP/E7R/Wwhm914iDKrvcwTlNCcVWDeNgLu5e3cwOJrheFDEf:DrE7Rzhm9GiD0c4NCcVUo58cz16D
- TLSH T1F4A3D88FCA4813A7DD0083789B461F80EE93585E45C343E238B423CC0AA37440B2F828
- MD5 SHA1 SHA512 SSDEEP TLSH