hxxp://github[.]com

Analysis

user interaction
yes
max time kernel
896s
max time network
897s
platform
ubuntu-24.04_amd64
resource
ubuntu2404-amd64-20260126-en
resource tags

arch:amd64arch:i386image:ubuntu2404-amd64-20260126-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
submitted
22/05/2026, 13:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://github.com
Sample260522-q146cae19s

Score

6^/10

antivm discovery

Malware Config

Signatures

Checks hardware identifiers (DMI) 1 TTPs 1 IoCs

Checks DMI information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/sys/devices/virtual/dmi/id/product_name	firefox-bin

Reads hardware information 1 TTPs 1 IoCs

Accesses system info like serial numbers, manufacturer names etc.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/virtual/dmi/id/product_sku	firefox-bin

Changes its process name 64 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	AsyncSi~lThread	2139	firefox-bin
Changes the process name, possibly in an attempt to hide itself	pool-spawner	2143	firefox-bin
Changes the process name, possibly in an attempt to hide itself	gmain	2144	firefox-bin
Changes the process name, possibly in an attempt to hide itself	pool	2146	firefox-bin
Changes the process name, possibly in an attempt to hide itself	gdbus	2147	firefox-bin
Changes the process name, possibly in an attempt to hide itself	glean.dispatche	2148	firefox-bin
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	2150	firefox-bin
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	2150	firefox-bin
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	2150	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Timer	2151	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	2152	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Socket Thread	2153	firefox-bin
Changes the process name, possibly in an attempt to hide itself	IPDL Background	2154	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Timer	2151	firefox-bin
Changes the process name, possibly in an attempt to hide itself	IPDL Background	2154	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Socket Thread	2153	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	2155	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	2152	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	2155	firefox-bin
Changes the process name, possibly in an attempt to hide itself	pool	2157	firefox-bin
Changes the process name, possibly in an attempt to hide itself	pool-firefox	2158	firefox-bin
Changes the process name, possibly in an attempt to hide itself	glxtest:disk$0	2160	glxtest
Changes the process name, possibly in an attempt to hide itself	dconf worker	2161	firefox-bin
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	2162	firefox-bin
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	2162	firefox-bin
Changes the process name, possibly in an attempt to hide itself	pool-firefox	2163	firefox-bin
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	2165	firefox-bin
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	2165	firefox-bin
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	2166	firefox-bin
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	2166	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Cache2 I/O	2167	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Cache2 I/O	2167	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Cookie	2168	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Cookie	2168	firefox-bin
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #1	2170	firefox-bin
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #0	2169	firefox-bin
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	2171	firefox-bin
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	2171	firefox-bin
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	2172	firefox-bin
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	2172	firefox-bin
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	2173	firefox-bin
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	2173	firefox-bin
Changes the process name, possibly in an attempt to hide itself	StreamTrans #3	2174	firefox-bin
Changes the process name, possibly in an attempt to hide itself	StreamTrans #3	2174	firefox-bin
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #2	2175	firefox-bin
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #2	2175	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Worker Launcher	2176	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Worker Launcher	2176	firefox-bin
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	2177	firefox-bin
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	2177	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Softwar~cThread	2178	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Softwar~cThread	2178	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Softwar~cThread	2178	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Renderer	2179	firefox-bin
Changes the process name, possibly in an attempt to hide itself	WRWorker#0	2180	firefox-bin
Changes the process name, possibly in an attempt to hide itself	WRWorkerLP#0	2181	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Renderer	2179	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Glyph rasterize	2182	firefox-bin
Changes the process name, possibly in an attempt to hide itself	WrGlyph~terizer	2182	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Compositor	2183	firefox-bin
Changes the process name, possibly in an attempt to hide itself	WRWorkerLP#0	2181	firefox-bin
Changes the process name, possibly in an attempt to hide itself	CanvasRenderer	2184	firefox-bin
Changes the process name, possibly in an attempt to hide itself	WRWorker#0	2180	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Compositor	2183	firefox-bin

Reads CPU attributes 1 TTPs 6 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/present	firefox-bin
File opened for reading	/sys/devices/system/cpu/possible	firefox-bin
File opened for reading	/sys/devices/system/cpu/possible	firefox-bin
File opened for reading	/sys/devices/system/cpu/possible	glxtest
File opened for reading	/sys/devices/system/cpu/cpu0/cpu_capacity	glxtest
File opened for reading	/sys/devices/system/cpu/present	firefox-bin

Enumerates kernel/hardware configuration 1 TTPs 41 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/class	glxtest
File opened for reading	/sys/fs/cgroup/system.slice/agent.service/cpu.max	firefox-bin
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/drm/card1	firefox-bin
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/class	glxtest
File opened for reading	/sys/fs/cgroup/system.slice/agent.service/cpu.max	firefox-bin
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/device	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0	firefox-bin
File opened for reading	/sys/module/apparmor/parameters/enabled	dbus-daemon
File opened for reading	/sys/bus/pci/devices	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/class	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/device	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/drm/renderD128	firefox-bin
File opened for reading	/sys/devices/system/node	firefox-bin
File opened for reading	/sys/kernel/security/apparmor/features/dbus/mask	dbus-daemon
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/vendor	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/class	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/uevent	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/vendor	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_vendor	glxtest

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/task/2257/comm	xdg-desktop-portal
File opened for reading	/proc/self/status	firefox-bin
File opened for reading	/proc/pressure/memory	firefox-bin
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/filesystems	xdg-desktop-portal
File opened for reading	/proc/self/task/2266/stat	firefox-bin
File opened for reading	/proc/self/cgroup	firefox-bin
File opened for reading	/proc/2045/attr/apparmor/current	dbus-daemon
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/cgroup	firefox-bin
File opened for reading	/proc/filesystems	at-spi-bus-launcher
File opened for reading	/proc/2198/cmdline	dbus-daemon
File opened for reading	/proc/filesystems	xdg-permission-store
File opened for reading	/proc/filesystems	xdg-desktop-portal-gtk
File opened for reading	/proc/2232/cmdline	dbus-daemon
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/maps	firefox-bin
File opened for reading	/proc/filesystems	firefox-bin
File opened for reading	/proc/self/task/2194/stat	firefox-bin
File opened for reading	/proc/self/mountinfo	firefox-bin
File opened for reading	/proc/self/fd/70	firefox-bin
File opened for reading	/proc/self/fd/68	firefox-bin
File opened for reading	/proc/2039/cmdline	dbus-daemon
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/fd/38	firefox-bin
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/filesystems	glxtest
File opened for reading	/proc/self/fd/59	firefox-bin
File opened for reading	/proc/self/task/2279/stat	firefox-bin
File opened for reading	/proc/self/fd	dbus-send
File opened for reading	/proc/self/fd	dbus-daemon
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/fd/97	firefox-bin
File opened for reading	/proc/2045/status	dbus-daemon
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/2067/cmdline	dbus-daemon
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/filesystems	firefox-bin
File opened for reading	/proc/self/fd/88	firefox-bin
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/stat	firefox-bin
File opened for reading	/proc/filesystems	xdg-document-portal
File opened for reading	/proc/self/fd/57	firefox-bin
File opened for reading	/proc/sys/kernel/cap_last_cap	dbus-daemon
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/stat	firefox-bin
File opened for reading	/proc/2212/cmdline	dbus-daemon
File opened for reading	/proc/self/fd/41	firefox-bin
File opened for reading	/proc/self/task/2137/stat	firefox-bin
File opened for reading	/proc/2136/cmdline	dbus-daemon
File opened for reading	/proc/self/fd/17	firefox-bin
File opened for reading	/proc/self/fd/46	firefox-bin
File opened for reading	/proc/2192/cmdline	dbus-daemon
File opened for reading	/proc/2243/cmdline	dbus-daemon
File opened for reading	/proc/filesystems	dbus-daemon
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/mountinfo	firefox-bin
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	gvfsd
File opened for reading	/proc/2237/cmdline	dbus-daemon

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/firefox/.parentlock	firefox-bin

/usr/bin/xdg-open
xdg-open http://github.com
1⤵
PID:2038
- /usr/bin/dbus-send
  dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
  2⤵
  - Reads runtime system information
  PID:2039
- - /usr/bin/dbus-launch
    dbus-launch --autolaunch 36e6eb39a6fa405996e79cad2731865d --binary-syntax --close-stderr
    3⤵
    PID:2041
  - - /usr/bin/dbus-daemon
      /usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:2043
    - - /usr/libexec/xdg-desktop-portal
        
        /usr/libexec/xdg-desktop-portal
        5⤵
        Reads runtime system information
        
        PID:2192
    - - /usr/libexec/at-spi-bus-launcher
        
        /usr/libexec/at-spi-bus-launcher
        5⤵
        Reads runtime system information
        
        PID:2198
    - - /usr/libexec/xdg-document-portal
        
        /usr/libexec/xdg-document-portal
        5⤵
        Reads runtime system information
        
        PID:2212
      - /usr/bin/fusermount3
        
        fusermount3 -o "rw,nosuid,nodev,fsname=portal,auto_unmount,subtype=portal" -- /root/.cache/doc
        6⤵
        
        PID:2227
    - - /usr/libexec/xdg-permission-store
        
        /usr/libexec/xdg-permission-store
        5⤵
        Reads runtime system information
        
        PID:2220
    - - /usr/libexec/xdg-desktop-portal-gtk
        
        /usr/libexec/xdg-desktop-portal-gtk
        5⤵
        Reads runtime system information
        
        PID:2232
    - - /usr/libexec/gvfsd
        
        /usr/libexec/gvfsd
        5⤵
        Reads runtime system information
        
        PID:2237
- /usr/bin/grep
  grep " = \\\"xfce4\\\"\$"
  2⤵
  - Reads runtime system information
  PID:2047
- /usr/bin/xprop
  xprop -root _DT_SAVE_MODE
  2⤵
  PID:2046
- /usr/bin/grep
  grep -i "^xfce_desktop_window"
  2⤵
  - Reads runtime system information
  PID:2049
- /usr/bin/xprop
  xprop -root
  2⤵
  PID:2048
- /usr/bin/grep
  grep -q "^Enlightenment"
  2⤵
  - Reads runtime system information
  PID:2057
- /usr/bin/uname
  uname
  2⤵
  PID:2058
- /usr/bin/grep
  grep -q "^file://"
  2⤵
  - Reads runtime system information
  PID:2060
- /usr/bin/egrep
  egrep -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:2062
- /usr/local/sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:2062
- /usr/local/bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:2062
- /usr/sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:2062
- /usr/bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  - Reads runtime system information
  PID:2062
- /usr/bin/sed
  sed -n "s/\$^[[:alnum:]+\\.-]*\$:.*\$/\\1/p"
  2⤵
  - Reads runtime system information
  PID:2065
- /usr/bin/xdg-mime
  xdg-mime query default x-scheme-handler/http
  2⤵
  PID:2066
- - /usr/bin/dbus-send
    dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
    3⤵
    PID:2067
  - - /usr/bin/dbus-launch
      dbus-launch --autolaunch 36e6eb39a6fa405996e79cad2731865d --binary-syntax --close-stderr
      4⤵
      PID:2068
- - /usr/bin/xprop
    xprop -root _DT_SAVE_MODE
    3⤵
    PID:2069
- - /usr/bin/grep
    grep " = \\\"xfce4\\\"\$"
    3⤵
    - Reads runtime system information
    PID:2070
- - /usr/bin/xprop
    xprop -root
    3⤵
    PID:2071
- - /usr/bin/grep
    grep -i "^xfce_desktop_window"
    3⤵
    PID:2072
- - /usr/bin/grep
    grep -q "^Enlightenment"
    3⤵
    - Reads runtime system information
    PID:2075
- - /usr/bin/uname
    uname
    3⤵
    PID:2076
- - /usr/bin/sed
    sed "s/:/ /g"
    3⤵
    - Reads runtime system information
    PID:2081
- - /usr/bin/grep
    grep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
    3⤵
    - Reads runtime system information
    PID:2083
- - /usr/bin/head
    head -n 1
    3⤵
    PID:2084
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:2085
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:2086
- - /usr/bin/grep
    grep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
    3⤵
    - Reads runtime system information
    PID:2088
- - /usr/bin/head
    head -n 1
    3⤵
    PID:2089
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:2090
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:2091
- - /usr/bin/grep
    grep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
    3⤵
    - Reads runtime system information
    PID:2093
- - /usr/bin/head
    head -n 1
    3⤵
    PID:2094
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:2095
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:2096
- - /usr/bin/grep
    grep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
    3⤵
    - Reads runtime system information
    PID:2098
- - /usr/bin/head
    head -n 1
    3⤵
    PID:2099
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:2100
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:2101
- - /usr/bin/grep
    grep "x-scheme-handler/http=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache
    3⤵
    PID:2103
- - /usr/bin/head
    head -n 1
    3⤵
    PID:2104
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:2105
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:2106
- /usr/bin/sed
  sed "s/:/ /g"
  2⤵
  - Reads runtime system information
  PID:2109
- /usr/bin/sed
  sed -e "s|-|/|"
  2⤵
  - Reads runtime system information
  PID:2112
- /usr/bin/sed
  sed -e "s|-|/|"
  2⤵
  - Reads runtime system information
  PID:2115
- /usr/bin/cut
  cut "-d=" -f 2-
  2⤵
  PID:2120
- /usr/bin/which
  which firefox
  2⤵
  PID:2121
- /usr/bin/cut
  cut "-d=" -f 2-
  2⤵
  PID:2124
- /usr/bin/cut
  cut "-d=" -f 2-
  2⤵
  PID:2127
- /usr/bin/cut
  cut "-d=" -f 2-
  2⤵
  PID:2132
- /usr/bin/cut
  cut "-d=" -f 2-
  2⤵
  PID:2135
- /usr/bin/firefox
  /usr/bin/firefox http://github.com
  2⤵
  PID:2136
- /usr/lib/firefox/firefox-bin
  /usr/bin/firefox http://github.com
  2⤵
  - Checks hardware identifiers (DMI)
  - Reads hardware information
  - Changes its process name
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:2136
- - /usr/lib/firefox/crashhelper
    /usr/lib/firefox/crashhelper 2136 9 /tmp/ 11
    3⤵
    PID:2140
- - /usr/local/sbin/dbus-launch
    dbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr
    3⤵
    PID:2145
- - /usr/local/bin/dbus-launch
    dbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr
    3⤵
    PID:2145
- - /usr/sbin/dbus-launch
    dbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr
    3⤵
    PID:2145
- - /usr/bin/dbus-launch
    dbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr
    3⤵
    PID:2145
- - /usr/lib/firefox/glxtest
    /usr/lib/firefox/glxtest -f 18
    3⤵
    - Changes its process name
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:2149
- - /usr/lib/firefox/firefox-bin
    /usr/lib/firefox/firefox-bin -contentproc -ipcHandle 0 -signalPipe 1 -initialChannelId "{5cc18fd7-b2f5-43a5-bee4-226dc9efe072}" -parentPid 2136 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser 1 forkserver
    3⤵
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:2188

/usr/libexec/gvfsd-fuse
/usr/libexec/gvfsd-fuse /root/.gvfs -f
1⤵
PID:2243

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

events

Path /root/.config/mozilla/firefox/q9xs27wp.default-release/datareporting/glean/events/events
Size 2KB
SHA256 baf418dfcef5a7cd5367520e0c689aa6fca6d22bfd2b9d719b4bbebae4c41f24
MD5 f41a5e7e16e0d010e1abb704c9d73a34
SHA1 b39b7cdf4c63bd0f98915bac010f48b7a8154b32
SHA512 e4c0f612af980e4d8656cbf820396717ec98ac9fccdb43cd15a0a27a4d5f3c22a8e440f7870fb1a5a53d902fafb37ca0db3490a3f0f7e976ba9af5f112d82f11
TLSH
T1A2419B2C3AB08D7ADCABF2DC2080438BD3264A67A5922D435D61EFCECDC46D9711983C
MD5 SHA1 SHA512 TLSH

Submit Download

0e009254-f4bf-4dc7-830f-690c2c29dd9c

Path /root/.config/mozilla/firefox/q9xs27wp.default-release/datareporting/glean/tmp/0e009254-f4bf-4dc7-830f-690c2c29dd9c
Size 1KB
SHA256 214867a9b72ff98ccde5bc13aa4a633d9aeb3b887d4c4e8d3ae32ac749431eb9
MD5 ef134a818d451b86d95a442a690fcebc
SHA1 beafc61f6083a20b96bcae4a7cfd97a01e4677fd
SHA512 d253bcdd40debbf07f0bedccf2a3023eac0e0a19d3257ee27832dcfab9769553291e858b3eb113fea4cd438bcf37e0818648a2b5f45445688fe1a9b36b687755
TLSH
T1EA31C2D02DA458A56E49D3864A543D1BCFEC3272848D89A07ED6DE0C5579E3E12DF603
MD5 SHA1 SHA512 TLSH

Submit Download

17df50cd-82d4-4045-8df7-f6c619c94b35

Path /root/.config/mozilla/firefox/q9xs27wp.default-release/datareporting/glean/tmp/17df50cd-82d4-4045-8df7-f6c619c94b35
Size 1KB
SHA256 f4033ddb2c738b71768cb10ff62afe5704d12511bb5b4a63c07f612c0450fb7e
MD5 7cecd254daffa944e51a89ea83e2d285
SHA1 7c64911005189a718645166f9fa1b47d2fb26f57
SHA512 c2ef3f2a97ebc8f9f0ad1e72a744143d86794799611ea3a14e616a1d269b32a3749772c730e4939f2add7c02db1a27b712bbc88a3ebe7d8a11ee9fe2a68d7f1c
TLSH
T1EF11869099B0E971CD5893C785843B025BB4713780CA64287CE58A0808BFA2E92B7307
MD5 SHA1 SHA512 TLSH

Submit Download

2b212ffe-e66b-4e3e-ae18-f980116fe46a

Path /root/.config/mozilla/firefox/q9xs27wp.default-release/datareporting/glean/tmp/2b212ffe-e66b-4e3e-ae18-f980116fe46a
Size 9KB
SHA256 679a6639554205746399e4116670b539c4b252bf43babcba9264a485d44dd222
MD5 999e19e2438c86524450303ae48b203b
SHA1 3f2bf42a90007cb2bd1e7ecafcf3d0cf30f0ff3e
SHA512 2a7ea62d69cb9780063d8d9372b4f63db52c5da09ce5de6a030fe20e025759de03c6d6cc9b5b9331a9485c14fb179a872c0b1e8d22c6dd215b9e4895fd467ebd
SSDEEP 192:weK4wY1Wbtb028bObLbzK20JRXsLSubitP0Qcu+MrXxuKFHjxz7r6WA28g6NFt:weK4AJ428SfnK20JRXsLSuutP0QcKzxK
TLSH
T10222A92840249CBDC9DAE3A2D9313F438BB81223509F7D5CEEDD4D1923EF996436641B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

30964050-66ba-4d15-b215-276c75eb7451

Path /root/.config/mozilla/firefox/q9xs27wp.default-release/datareporting/glean/tmp/30964050-66ba-4d15-b215-276c75eb7451
Size 871B
SHA256 a42c79e34ef7cb0f8835cf049f8507514cfa75e02f5159a597b3bdebea3f10a4
MD5 b9c2de1442765dc5db1e62b238502a8b
SHA1 111a590792d8e2f4adaaa89f675387e1d37d392b
SHA512 07dbfc6ae955df7b7e3009cee18900719b39fd4caaf2aee6210b51985013208700cdaf91327b030532c3a73f3b7f6f46df5e3fc69e9058b7f2ec38b0b01b2f5f
TLSH
T10011C0D099B1FAB28E1D978A95903B424AA4712740C99C387DE19A0809FE52C977330B
MD5 SHA1 SHA512 TLSH

Submit Download

61198caa-908c-4dce-bbc5-23d61ba8c873

Path /root/.config/mozilla/firefox/q9xs27wp.default-release/datareporting/glean/tmp/61198caa-908c-4dce-bbc5-23d61ba8c873
Size 4KB
SHA256 3462add4f6f79c61dc5be74111c45b0587d3f279abea7ea4c1b889fb36d12970
MD5 4c79c2f97cd051f8e8a6ed345ce4f153
SHA1 2dde9fefe4df0235e3e0b526cfb4f79d1282a896
SHA512 748a8bd4ec2b5c29f586dc56531411c1f86a8537a51bc39417a506a14a25a5569ba59b3d5aee96dd3b63944ec391eb5fb6be5eb0f57f67416a607c4ebde6476b
SSDEEP 48:+URLA/cDz9WpBUg3jAWK0zAXISA0RU4KAba9A9qs/TAgZhALwYhA7aXQ:thDhWpP3jhvAXJA0EAbAAUsLA6AUMAx
TLSH
T139818C144429B87CD89AD7A1CBB37F8787785736B089B51CECEF450626EB1A2123600B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c6887ef4-185e-4ebb-8b8d-241c282a14e3

Path /root/.config/mozilla/firefox/q9xs27wp.default-release/datareporting/glean/tmp/c6887ef4-185e-4ebb-8b8d-241c282a14e3
Size 5KB
SHA256 13dea2342e1d6504b2213f365a67d200e129993543f651320003ba437e28a531
MD5 7adf8d87d003371db6ee9cff0000efb1
SHA1 b0540020a4a08d3b5d0dfb5d7db2ec7a09af034b
SHA512 22ed5bf8f8c3c70fe3ac693c94d4baafbe4013b8a2443ca20c18ed27996d407c06938119fb9bdff265c11f434ca7feaaa9b721256c134d0e80be13cefaa01f59
SSDEEP 48:uUEacLA/ccWmfCnDKAgawXOi1xW2cZh+7KJlcJ7LV1ArXFl1xFwr84mT46Efkfkx:YPhcWu2DgaKFA2cZtwGqEtmx
TLSH
T1E6B141EC3AB48C7A9DCBF35C5051135B93B14B8784002D835E95EF8DDC9CBA9326A639
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d42550b6-1ad4-42a7-932c-005180cb1018

Path /root/.config/mozilla/firefox/q9xs27wp.default-release/datareporting/glean/tmp/d42550b6-1ad4-42a7-932c-005180cb1018
Size 368B
SHA256 01e84680288b1d36e3c3bf9b466ee211349b5966b2602a7b8a48a432c469d5d3
MD5 f161aed4b70b560531ae689d8f3d5d1c
SHA1 f5e202ad80b4e2604670bf5f97cf13e4f7e6d83a
SHA512 b0707c1253fbd1fbb7e2538472e7d25f7791d3e0a6026b6c0acb50f5b5bc6bbe27b4a18742f008e3b36d2f413fc62d73f4b04674d54b2fff86eac9740315d9d2
TLSH
T16AE0685AA0A88110E984921A89904D1147ACE847D8E680B9A9E0616EDBD54CC52F321E
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path /root/.config/mozilla/firefox/q9xs27wp.default-release/prefs-1.js
Size 6KB
SHA256 0ea7c7438321f8d92abede853423727b7c726895237ede18b812e7d8634332be
MD5 edc1a8ae7e088887545a6c0e7949c6a1
SHA1 0bec65b39cdb88baf003349d479e19b623708482
SHA512 636398e6b495d6a5f3581c61c1fe79f8f7d57266fe1a466974ae7f18d560d8c04d15ce3ac0af426fe283b8ee036b584c1e6f59e3c2d90abd2a1c8297304a31ba
SSDEEP 96:oz/jHF2XhqjqbQ7sKYnRgzGUCzMjJ6eYFdTGbFFuv/AOT8xp8MzX:AY8ubQ7shRECzM6Kuv/Akup8eX
TLSH
T1B7D1317890188F7FB5B237AC6C6488605972C21FB3BF28D610BA4719415CB7841FDAE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path /root/.config/mozilla/firefox/q9xs27wp.default-release/prefs-1.js
Size 6KB
SHA256 303ca359cfc350b0ed6279c6c9aa860683c5d2c68e14a64225927bf8015bc66f
MD5 197e807364b9115d7556c8a80e56eae8
SHA1 8f8ef7d10e96b9872e6ea5999d9a76d4df4be0b5
SHA512 57aa2c9c0334fe272cbe0156db6000ebad1b64dcb3ae5ca736f9b0fbe5c75c0bec54c6906fb58f4d2267a003469f483c01308c20fb46bcdbd06761ac81dbe3ae
SSDEEP 96:oz/jHF2XhqjqbQ7sKYnRgzGUCz2jJ6eYFdTGbFFuv/AOT8xp86zX:AY8ubQ7shRECz26Kuv/Akup8EX
TLSH
T1C0D1207890188F7FA5B277AC6C6488505972C21F73BF18D710BA8319055CB7841FDAE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path /root/.config/mozilla/firefox/q9xs27wp.default-release/prefs-1.js
Size 6KB
SHA256 42f9a7790038da6ded0833f82ec29ea86306dbd338a0230551759c4d2796bf0e
MD5 88e7408787af20b1059f0c94e5bec320
SHA1 e85a4356dedc231f720b21d164ea6bf0355043f7
SHA512 eb95a8114ebf268176decc87259c21c18616aa5f93f747bd61cce0399e3aed88c70f1b5b591107da82142acc545b4618ffb519c4ccdbb706be8a47474b80b90d
SSDEEP 96:oz/jHF28/qjqbQ7sKYnRgzGU3z2jJ6eYFdTGbFFuv/AOT8xp8W8bzX:A5SubQ7shRE3z26Kuv/Akup83HX
TLSH
T170D12278A1188F7FA47277AC6C6888605972C21FB3BF18D710BA8619055CB7841FDAE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path /root/.config/mozilla/firefox/q9xs27wp.default-release/prefs-1.js
Size 6KB
SHA256 3b4c8a2bb3ec101daf8dc91d527330c89601bb731c782eecb2333ac6fca2a020
MD5 bb9b210927d0187707e3ca97e800c6dc
SHA1 2ad332fc9ee8099a27a080fcd7f2e4935f9e3599
SHA512 6917eb5cbb64f4cfab194cf7c998026a215e0583d534cb3a07533978a3c9f73493fd54f0a6ff6eda6f1e9dd347ec67ef064c2d92f19b26eea16ecd7acd18d320
SSDEEP 96:oz/jHF28/qjqbQ7sKYnRgzGU3z2jJ6eYFdTGbFFuv/AOT8xp8W8JAzX:A5SubQ7shRE3z26Kuv/Akup83UX
TLSH
T1A7D13278A0188F7FA47277AC6C6888605972C11F73BF18D710BA8719055CB7841FDAE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path /root/.config/mozilla/firefox/q9xs27wp.default-release/prefs-1.js
Size 6KB
SHA256 93791bf8863c0ce63df4f30d9e04533a3487d687c96789c35fb13ba3180814e7
MD5 d271fdaa5e51f262e6208ca44a5b0d26
SHA1 59ce20ad445899b8b5385939c12cf33b576e3156
SHA512 d9f32f1a2d6a96f073bbca81b810f7a2badfc19f4c8535686e7af829e2a42eef924a7aa0abf98a9aab2ff4a65093bda58645735aebf23986844452aac909b289
SSDEEP 96:oz/jHF28/qjqbQ7sKYnRgzGU3z2jJ6eYFdTGbFFuv/AOT8xp8L8JAzX:A5SubQ7shRE3z26Kuv/Akup8YUX
TLSH
T12AE11178A0188F7FA4B277AC6C6889505972C11F73BF18D710BA4309155CB7851FDAE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webappsstore.sqlite

Path /root/.config/mozilla/firefox/q9xs27wp.default-release/webappsstore.sqlite
Size 96KB
SHA256 d884477ede4c58bb90cccb1552ba8a0eb784ec7e89614d7d37fbf274db078e16
MD5 28265a4276d6806d3b28cbcd8f3cc687
SHA1 a4e22988e4bf9bd4f5923cd3c9f21263850cdc98
SHA512 3f0b156743e8ab892823931a77e2d331436d5a19223993a5abcd8d37378df68ddebc315a74bd07dfbf37e039d49b153f08723026c2d3434ded87dfc15e75c346
SSDEEP 6:ltTo/e/E7R/Wwhm914iDKrvcwTlNCcVWDeNgLu5e3cwOJrheFDEf:D0OE7Rzhm9GiD0c4NCcVUo58cz16D
TLSH
T15AA3D88FCA4813A7DD0083789B461F80EE93585E45C343E238B423CC0AA37440B2F828
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads