Overview
overview
6Static
static
1URLScan
urlscan
1https://kfijbavfbc.l...
android-9-x86
1https://kfijbavfbc.l...
android-10-x64
1https://kfijbavfbc.l...
android-11-x64
1https://kfijbavfbc.l...
ubuntu-22.04-amd64
6https://kfijbavfbc.l...
debian-9-armhf
https://kfijbavfbc.l...
debian-9-mips
https://kfijbavfbc.l...
debian-9-mipsel
Analysis
- user interaction
yes - max time kernel
149s - max time network
151s - platform
ubuntu-22.04_amd64 - resource
ubuntu2204-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20260513-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system - submitted
03/06/2026, 11:04
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://kfijbavfbc.lebrsgod.pics/
Resource
android-x86-arm-20260325-en
android-9-x86
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
https://kfijbavfbc.lebrsgod.pics/
Resource
android-x64-20260325-en
android-10-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
https://kfijbavfbc.lebrsgod.pics/
Resource
android-x64-arm64-20260325-en
android-11-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
https://kfijbavfbc.lebrsgod.pics/
Resource
ubuntu2204-amd64-20260513-en
ubuntu-22.04-amd64
8 signatures
150 seconds
Behavioral task
behavioral5
Sample
https://kfijbavfbc.lebrsgod.pics/
Resource
debian9-armhf-20260513-en
debian-9-armhf
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
https://kfijbavfbc.lebrsgod.pics/
Resource
debian9-mipsbe-20260513-en
debian-9-mips
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
https://kfijbavfbc.lebrsgod.pics/
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
0 signatures
150 seconds
Malware Config
Signatures
- Checks hardware identifiers (DMI) 1 TTPs 1 IoCs
Checks DMI information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /sys/devices/virtual/dmi/id/product_name firefox-bin - Reads hardware information 1 TTPs 1 IoCs
Accesses system info like serial numbers, manufacturer names etc.
description ioc Process File opened for reading /sys/devices/virtual/dmi/id/product_sku firefox-bin - Changes its process name 64 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself AsyncSi~lThread 1707 firefox-bin Changes the process name, possibly in an attempt to hide itself gmain 1711 firefox-bin Changes the process name, possibly in an attempt to hide itself pool 1713 firefox-bin Changes the process name, possibly in an attempt to hide itself gdbus 1714 firefox-bin Changes the process name, possibly in an attempt to hide itself glean.dispatche 1715 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 1717 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 1717 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 1717 firefox-bin Changes the process name, possibly in an attempt to hide itself IPDL Background 1721 firefox-bin Changes the process name, possibly in an attempt to hide itself Socket Thread 1720 firefox-bin Changes the process name, possibly in an attempt to hide itself IPDL Background 1721 firefox-bin Changes the process name, possibly in an attempt to hide itself Socket Thread 1720 firefox-bin Changes the process name, possibly in an attempt to hide itself Backgro~Pool #1 1722 firefox-bin Changes the process name, possibly in an attempt to hide itself Backgro~Pool #1 1722 firefox-bin Changes the process name, possibly in an attempt to hide itself Netlink Monitor 1719 firefox-bin Changes the process name, possibly in an attempt to hide itself Netlink Monitor 1719 firefox-bin Changes the process name, possibly in an attempt to hide itself Timer 1718 firefox-bin Changes the process name, possibly in an attempt to hide itself Timer 1718 firefox-bin Changes the process name, possibly in an attempt to hide itself [pango] FcInit 1723 firefox-bin Changes the process name, possibly in an attempt to hide itself glxtest:disk$0 1729 glxtest Changes the process name, possibly in an attempt to hide itself HTML5 Parser 1731 firefox-bin Changes the process name, possibly in an attempt to hide itself HTML5 Parser 1731 firefox-bin Changes the process name, possibly in an attempt to hide itself dconf worker 1730 firefox-bin Changes the process name, possibly in an attempt to hide itself JS Watchdog 1733 firefox-bin Changes the process name, possibly in an attempt to hide itself JS Watchdog 1733 firefox-bin Changes the process name, possibly in an attempt to hide itself BGReadURLs 1734 firefox-bin Changes the process name, possibly in an attempt to hide itself BGReadURLs 1734 firefox-bin Changes the process name, possibly in an attempt to hide itself Cache2 I/O 1735 firefox-bin Changes the process name, possibly in an attempt to hide itself Cache2 I/O 1735 firefox-bin Changes the process name, possibly in an attempt to hide itself Cookie 1736 firefox-bin Changes the process name, possibly in an attempt to hide itself Cookie 1736 firefox-bin Changes the process name, possibly in an attempt to hide itself TaskCon~ller #1 1738 firefox-bin Changes the process name, possibly in an attempt to hide itself StreamTrans #1 1739 firefox-bin Changes the process name, possibly in an attempt to hide itself StreamTrans #1 1739 firefox-bin Changes the process name, possibly in an attempt to hide itself TaskCon~ller #0 1737 firefox-bin Changes the process name, possibly in an attempt to hide itself BgIOThr~Pool #1 1740 firefox-bin Changes the process name, possibly in an attempt to hide itself BgIOThr~Pool #1 1740 firefox-bin Changes the process name, possibly in an attempt to hide itself Worker Launcher 1741 firefox-bin Changes the process name, possibly in an attempt to hide itself Worker Launcher 1741 firefox-bin Changes the process name, possibly in an attempt to hide itself QuotaManager IO 1742 firefox-bin Changes the process name, possibly in an attempt to hide itself QuotaManager IO 1742 firefox-bin Changes the process name, possibly in an attempt to hide itself Softwar~cThread 1743 firefox-bin Changes the process name, possibly in an attempt to hide itself Softwar~cThread 1743 firefox-bin Changes the process name, possibly in an attempt to hide itself Softwar~cThread 1743 firefox-bin Changes the process name, possibly in an attempt to hide itself CanvasRenderer 1749 firefox-bin Changes the process name, possibly in an attempt to hide itself CanvasRenderer 1749 firefox-bin Changes the process name, possibly in an attempt to hide itself Compositor 1748 firefox-bin Changes the process name, possibly in an attempt to hide itself Compositor 1748 firefox-bin Changes the process name, possibly in an attempt to hide itself Glyph rasterize 1747 firefox-bin Changes the process name, possibly in an attempt to hide itself WrGlyph~terizer 1747 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorkerLP#0 1746 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorkerLP#0 1746 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorker#0 1745 firefox-bin Changes the process name, possibly in an attempt to hide itself Renderer 1744 firefox-bin Changes the process name, possibly in an attempt to hide itself Renderer 1744 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorker#0 1745 firefox-bin Changes the process name, possibly in an attempt to hide itself ImageIO 1750 firefox-bin Changes the process name, possibly in an attempt to hide itself ImageIO 1750 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC Launch 1751 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC Launch 1751 firefox-bin Changes the process name, possibly in an attempt to hide itself Permission 1753 firefox-bin Changes the process name, possibly in an attempt to hide itself Permission 1753 firefox-bin Changes the process name, possibly in an attempt to hide itself forkserver 1752 firefox-bin Changes the process name, possibly in an attempt to hide itself SandboxReporter 1754 firefox-bin - Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo firefox-bin - Reads CPU attributes 1 TTPs 9 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/size firefox-bin File opened for reading /sys/devices/system/cpu/possible firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/cpu_capacity glxtest File opened for reading /sys/devices/system/cpu/present firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/size firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/topology/core_cpus firefox-bin File opened for reading /sys/devices/system/cpu/present firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/cpu_capacity xdg-desktop-portal-gnome File opened for reading /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq firefox-bin - Enumerates kernel/hardware configuration 1 TTPs 41 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/bus/pci/devices/0000:00:03.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:00.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:04.0/class glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0/virtio0/drm/renderD128 firefox-bin File opened for reading /sys/bus/pci/devices/0000:00:06.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.3/device glxtest File opened for reading /sys/devices/system/cpu glxtest File opened for reading /sys/fs/cgroup/system.slice/agent.service/cpu.max firefox-bin File opened for reading /sys/bus/pci/devices/0000:00:02.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.3/class glxtest File opened for reading /sys/fs/cgroup/system.slice/agent.service/cpu.max firefox-bin File opened for reading /sys/kernel/security/apparmor/features/dbus/mask dbus-daemon File opened for reading /sys/bus/pci/devices/0000:00:05.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:06.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:03.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.3/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:00.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:04.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:03.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:04.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.0/vendor glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0/virtio0/drm/card0 firefox-bin File opened for reading /sys/devices/system/node/node0/meminfo firefox-bin File opened for reading /sys/bus/pci/devices/0000:00:02.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.1/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.1/device glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0 firefox-bin File opened for reading /sys/devices/system/node firefox-bin File opened for reading /sys/bus/pci/devices glxtest File opened for reading /sys/bus/pci/devices/0000:00:05.0/device glxtest File opened for reading /sys/devices/system/cpu xdg-desktop-portal-gnome File opened for reading /sys/module/apparmor/parameters/enabled dbus-daemon File opened for reading /sys/bus/pci/devices/0000:00:05.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:06.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:00.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.0/class glxtest File opened for reading /sys/devices/system/cpu firefox-bin File opened for reading /sys/devices/system/cpu firefox-bin File opened for reading /sys/bus/pci/devices/0000:00:02.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.1/class glxtest -
description ioc Process File opened for reading /proc/filesystems sed File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/fd firefox-bin File opened for reading /proc/filesystems xdg-desktop-portal-gnome File opened for reading /proc/1799/cmdline dbus-daemon File opened for reading /proc/1804/cmdline dbus-daemon File opened for reading /proc/self/fd/42 firefox-bin File opened for reading /proc/sys/kernel/cap_last_cap dbus-daemon File opened for reading /proc/self/maps grep File opened for reading /proc/self/fd dbus-send File opened for reading /proc/self/task/1705/stat firefox-bin File opened for reading /proc/self/stat firefox-bin File opened for reading /proc/self/cmdline firefox-bin File opened for reading /proc/self/fd/57 firefox-bin File opened for reading /proc/self/task/1842/stat firefox-bin File opened for reading /proc/1619/status dbus-daemon File opened for reading /proc/self/fd/58 firefox-bin File opened for reading /proc/self/task/1924/stat firefox-bin File opened for reading /proc/self/fd/135 firefox-bin File opened for reading /proc/filesystems dbus-daemon File opened for reading /proc/filesystems at-spi-bus-launcher File opened for reading /proc/1766/cmdline dbus-daemon File opened for reading /proc/filesystems xdg-permission-store File opened for reading /proc/1778/cmdline dbus-daemon File opened for reading /proc/self/cgroup firefox-bin File opened for reading /proc/self/fd/82 firefox-bin File opened for reading /proc/self/task/1879/stat firefox-bin File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/cgroup firefox-bin File opened for reading /proc/self/task/1763/stat firefox-bin File opened for reading /proc/self/mountinfo firefox-bin File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/filesystems sed File opened for reading /proc/self/fd/17 firefox-bin File opened for reading /proc/1757/cmdline dbus-daemon File opened for reading /proc/filesystems xdg-desktop-portal-gtk File opened for reading /proc/self/maps grep File opened for reading /proc/filesystems firefox-bin File opened for reading /proc/filesystems gvfsd File opened for reading /proc/self/fd/59 firefox-bin File opened for reading /proc/self/fd/115 firefox-bin File opened for reading /proc/self/task/1912/stat firefox-bin File opened for reading /proc/self/task/1919/stat firefox-bin File opened for reading /proc/filesystems crashreporter File opened for reading /proc/self/maps firefox-bin File opened for reading /proc/self/fd/39 firefox-bin File opened for reading /proc/1760/cmdline dbus-daemon File opened for reading /proc/self/fd/85 firefox-bin File opened for reading /proc/self/task/1941/stat firefox-bin File opened for reading /proc/filesystems sed File opened for reading /proc/self/fd/111 firefox-bin File opened for reading /proc/self/maps crashreporter File opened for reading /proc/filesystems firefox-bin File opened for reading /proc/self/stat firefox-bin File opened for reading /proc/1824/cmdline dbus-daemon File opened for reading /proc/1704/root xdg-desktop-portal File opened for reading /proc/self/status firefox-bin File opened for reading /proc/self/maps grep File opened for reading /proc/self/fd/41 firefox-bin File opened for reading /proc/self/fd firefox-bin - Writes file to tmp directory 5 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/tmpaddon firefox-bin File opened for modification /tmp/firefox/.parentlock firefox-bin File opened for modification /tmp/tmp-hsc.xpi firefox-bin File opened for modification /tmp/remote-settings-startup-bundle- firefox-bin File opened for modification /tmp/remote-settings-startup-bundle-.tmp firefox-bin
Processes
-
/usr/bin/xdg-openxdg-open https://kfijbavfbc.lebrsgod.pics/1⤵PID:1613
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager2⤵PID:1614
-
/usr/bin/dbus-launchdbus-launch --autolaunch f2de92a803c744e586bd87567a26b68a --binary-syntax --close-stderr3⤵PID:1615
-
/usr/bin/dbus-daemon/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session4⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1617 -
/usr/libexec/xdg-desktop-portal/usr/libexec/xdg-desktop-portal5⤵
- Reads runtime system information
PID:1757
-
-
/usr/libexec/at-spi-bus-launcher/usr/libexec/at-spi-bus-launcher5⤵
- Reads runtime system information
PID:1760
-
-
/usr/libexec/xdg-document-portal/usr/libexec/xdg-document-portal5⤵PID:1766
-
/usr/bin/fusermount3fusermount3 -o "rw,nosuid,nodev,fsname=portal,auto_unmount,subtype=portal" -- /root/.cache/doc6⤵PID:1786
-
-
-
/usr/libexec/xdg-permission-store/usr/libexec/xdg-permission-store5⤵
- Reads runtime system information
PID:1778
-
-
/usr/libexec/xdg-desktop-portal-gnome/usr/libexec/xdg-desktop-portal-gnome5⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1792
-
-
/usr/libexec/gvfsd/usr/libexec/gvfsd5⤵
- Reads runtime system information
PID:1799
-
-
/usr/libexec/xdg-desktop-portal-gtk/usr/libexec/xdg-desktop-portal-gtk5⤵
- Reads runtime system information
PID:1815
-
-
/usr/bin/gnome-keyring-daemon/usr/bin/gnome-keyring-daemon --start --foreground "--components=secrets"5⤵PID:1824
-
-
-
-
-
/usr/bin/grepgrep " = \\\"xfce4\\\"\$"2⤵
- Reads runtime system information
PID:1621
-
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE2⤵PID:1620
-
-
/usr/bin/grepgrep -i "^xfce_desktop_window"2⤵
- Reads runtime system information
PID:1623
-
-
/usr/bin/xpropxprop -root2⤵PID:1622
-
-
/usr/bin/grepgrep -q "^Enlightenment"2⤵PID:1625
-
-
/usr/bin/unameuname2⤵PID:1626
-
-
/usr/bin/grepgrep -q "^file://"2⤵
- Reads runtime system information
PID:1628
-
-
/usr/bin/egrepegrep -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1630
-
-
/usr/local/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1630
-
-
/usr/local/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1630
-
-
/usr/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1630
-
-
/usr/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
- Reads runtime system information
PID:1630
-
-
/usr/bin/sedsed -n "s/\\(^[[:alnum:]+\\.-]*\\):.*\$/\\1/p"2⤵
- Reads runtime system information
PID:1633
-
-
/usr/bin/xdg-mimexdg-mime query default x-scheme-handler/https2⤵PID:1634
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager3⤵
- Reads runtime system information
PID:1635 -
/usr/bin/dbus-launchdbus-launch --autolaunch f2de92a803c744e586bd87567a26b68a --binary-syntax --close-stderr4⤵PID:1636
-
-
-
/usr/bin/grepgrep " = \\\"xfce4\\\"\$"3⤵
- Reads runtime system information
PID:1638
-
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE3⤵PID:1637
-
-
/usr/bin/grepgrep -i "^xfce_desktop_window"3⤵
- Reads runtime system information
PID:1640
-
-
/usr/bin/xpropxprop -root3⤵PID:1639
-
-
/usr/bin/grepgrep -q "^Enlightenment"3⤵
- Reads runtime system information
PID:1642
-
-
/usr/bin/unameuname3⤵PID:1643
-
-
/usr/bin/sedsed "s/:/ /g"3⤵
- Reads runtime system information
PID:1646
-
-
/usr/bin/headhead -n 13⤵PID:1649
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:1651
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:1650
-
-
/usr/bin/grepgrep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵
- Reads runtime system information
PID:1648
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:1656
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:1655
-
-
/usr/bin/headhead -n 13⤵PID:1654
-
-
/usr/bin/grepgrep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵PID:1653
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:1661
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:1660
-
-
/usr/bin/headhead -n 13⤵PID:1659
-
-
/usr/bin/grepgrep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵PID:1658
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:1666
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:1665
-
-
/usr/bin/headhead -n 13⤵PID:1664
-
-
/usr/bin/grepgrep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵
- Reads runtime system information
PID:1663
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:1671
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:1670
-
-
/usr/bin/headhead -n 13⤵PID:1669
-
-
/usr/bin/grepgrep "x-scheme-handler/https=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache3⤵
- Reads runtime system information
PID:1668
-
-
-
/usr/bin/sedsed "s/:/ /g"2⤵PID:1674
-
-
/usr/bin/sedsed -e "s|-|/|"2⤵
- Reads runtime system information
PID:1677
-
-
/usr/bin/sedsed -e "s|-|/|"2⤵PID:1680
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:1685
-
-
/usr/bin/whichwhich firefox2⤵PID:1686
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:1689
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:1695
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:1700
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:1703
-
-
/usr/bin/firefox/usr/bin/firefox https://kfijbavfbc.lebrsgod.pics/2⤵PID:1704
-
-
/usr/lib/firefox/firefox-bin/usr/bin/firefox https://kfijbavfbc.lebrsgod.pics/2⤵
- Checks hardware identifiers (DMI)
- Reads hardware information
- Changes its process name
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
PID:1704 -
/usr/lib/firefox/crashhelper/usr/lib/firefox/crashhelper 1704 9 /tmp/ 113⤵PID:1708
-
-
/usr/local/sbin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr3⤵PID:1712
-
-
/usr/local/bin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr3⤵PID:1712
-
-
/usr/sbin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr3⤵PID:1712
-
-
/usr/bin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr3⤵PID:1712
-
-
/usr/lib/firefox/glxtest/usr/lib/firefox/glxtest -f 183⤵
- Changes its process name
- Reads CPU attributes
- Enumerates kernel/hardware configuration
PID:1716
-
-
/usr/lib/firefox/firefox-bin/usr/lib/firefox/firefox-bin -contentproc -ipcHandle 0 -signalPipe 1 -initialChannelId "{5a3f47ac-1880-4042-a563-285af740d414}" -parentPid 1704 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser 1 forkserver3⤵
- Changes its process name
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1752
-
-
/usr/lib/firefox/crashreporter/usr/lib/firefox/crashreporter --ping-cleanup "/root/.config/mozilla/firefox/Crash Reports" false3⤵
- Reads runtime system information
PID:2023
-
-
-
/usr/libexec/gvfsd-fuse/usr/libexec/gvfsd-fuse /root/.cache/gvfs -f1⤵PID:1804
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /root/.config/mozilla/firefox/Crash Reports/glean/crashping.pid
- Size 4B
- SHA256 d398b29d3dbbb9bf201d4c7e1c19ff9d43c15fd45a0cec46fbe9885ec3f6e97f
- MD5 5531a5834816222280f20d1ef9e95f69
- SHA1 445cd2fd3273962bdf09425109a2d09f7170e837
- SHA512 a1e11c5d0b12fb74fd97f392c088b16ea641fcc55f80c8b0d4e5e1a2903887b70173c487ab994516f26f0b13a72da36f61ac00b5644bb1a2e9a78cbd4a4c4dc9
- MD5 SHA1 SHA512
- Path /root/.config/mozilla/firefox/z2e2svap.default-release/datareporting/glean/events/events
- Size 5KB
- SHA256 27149edd6eafba84a0d4d3baa3fd5b2995913424dd3f3d5c4220f9f179314b3f
- MD5 da009c85febb516786a5e1f4742078eb
- SHA1 3a8fa32ec5f80766fcd1666dae1cdbbfb6495ea2
- SHA512 a88f0f81290d627669fb4171c9fa0138639839ae15f655170c23a693a1b6226e7801127604b5288e499735e4a130c290410843cbc7c9c9851af382eb1829dbcb
- SSDEEP 96:oGCAOIyjnU2YZ+jRgL/4jPlp/4GHGoVHhoNPqC:4U2Y+6/s/bjHMSC
- TLSH T1BAB1D05E2B658CBAADD7F2DCB44043CE83554B2399561C932C91EF8ACDA16C6310F13D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/z2e2svap.default-release/datareporting/glean/events/nimbus-targeting-context
- Size 50KB
- SHA256 a9c818fc74a4037f3cc52b5f5cacd07c59337a390fc68fa0d7aa99a290064c52
- MD5 906a903caefb556aaa7d16b09260c3d1
- SHA1 2de18f3ab58453dbb94ead61028b7a92d758cad3
- SHA512 4ae0bde4ae874323c35b458d200b9066b3e74d260105ae4fd810d4615f4d4582c7c5c6c497c0432801addeadc97430f87ff8fe7a27f5e30ae17711d467c4eee9
- SSDEEP 1536:qHkzfsL9d0hPwAADG0zfGC/SV5UN5FNxhePCwE6OL5cWg9/mVWhtnfDjci1pdo:x5i
- TLSH T15D33A0C8255018BE3F87C3AD958443FE6FDA4FA0055B18D31D8AEE5DCE69A99703D03A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/z2e2svap.default-release/datareporting/glean/tmp/277a7b34-469e-4857-acc1-1297d3ea711d
- Size 4KB
- SHA256 4cd057333c1f54f0b496cc0c1da3cc473d705c185ac5a5634e3ab4b547a94212
- MD5 3dc2da70ef24b86f5a93c354d5c71441
- SHA1 7c55f5eaf316ac360c7e1c34f72564b5c29bd172
- SHA512 4aaa6353f2978806660753ca58e76a79bca41dd02447993a7876dc8dcf280fb8c835c30dd9e67e10b9dbf4f63ef114ad7a8b6049f12c45221d572f72d516556a
- SSDEEP 96:klnUe41cyWv3YPN1JvrHPBKwxJr5fD+ECBphTqrch4a4hW98eP+iIq:k8Pf1sP+iIq
- TLSH T1E591C0F4246009163DE3D67EE9C027B2D62F85D6C0C114562D11CE6FABEE60C51B3F9A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/z2e2svap.default-release/datareporting/glean/tmp/3f681e74-1b77-468f-9f64-95dd3db3b87d
- Size 4KB
- SHA256 a6daf77237f596513ae6d947ec9bfc0a03183d57cab16c564b1dca8405a7f4c1
- MD5 1796c0533a80e243fed76c861c63f8e2
- SHA1 cea73ba8418d200588b63a6120c681aaf77bf1a4
- SHA512 3bbf4cce9a23188e2eacdaa58f2312ef2eefc2dadb134623f3065acf5af77ca37df50dd71e3003ab5f74632d529b321e722d92dee5bd44a744427afdaf79e484
- SSDEEP 96:7LrB1ifW+1cPU3T4YPNEvr5xJrvJnpCBDKwyHehG3T4a4hW63rTIk+mI:kPgJM9bTF+d
- TLSH T1EBA1D2E4246008167EF3D6BEDDC027B7C71F859580C104652E21DD6EA7EDA0C62A3F9B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/z2e2svap.default-release/datareporting/glean/tmp/592b4124-11d9-4ae8-afee-2cd7c670123c
- Size 7KB
- SHA256 b2d55436bc7a1904ba4c171e685792a8b85d47768c7e42e35a146e7c083850d0
- MD5 fa61a3db505636307bd8683105994841
- SHA1 1efd4adb30d4337b7e023ac1d2fa9e8f88973228
- SHA512 ece5707dd169d45d0c74fe5ac8fca7190af84453e8e612af73aaf836c34dc2bdfaad6afb93c8610be3ed16c1ab70c98ae983f5941095846798c1ae45e8ca94d1
- SSDEEP 96:7TvrE1nfUe1cDJBW+yPYPNxJriH43Kwp5hqrCBd4a46vWs3jhYZAXJA0EAbGAUsU:TPhm4T+W20J7XsLqt+z
- TLSH T1AAE134E4002468397CE3D776DAE13F92C73F46A6E0C52419AC6A8D1A67EF2481173A4B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/z2e2svap.default-release/datareporting/glean/tmp/664b8b31-7b79-45b3-b808-f0f1f933682d
- Size 7KB
- SHA256 18ad319601007fa641a43bc1786cc851a6347d5db500baabc1a585cf6277a65d
- MD5 27b0d72832fab02850d3f1496f58cb58
- SHA1 ab6a55b6e59db81259966e2a7ff046def33f3544
- SHA512 3b73f5bb5f8091f07e2e1a398a4c0b9f6bb8acad3d55a7b4db5b0a7c8401be14b5241ae9c93d8bcd646901934ba5edfc21a8e992f1e98da97f581736cf713bb6
- SSDEEP 96:7WJKwhxJr5yWTeEYPN3fivrP4nH1cUBvD+CBpqrd4a4avWDZAXJA0EAbGAUsLA6a:KYPRvW20J7XsLqbPTe
- TLSH T1B3E123E4042468397CE3D7B6DAE13F92C73F4666E0C52419AC6A8D1B67EF24C1172A4B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/z2e2svap.default-release/datareporting/glean/tmp/896ec972-4cca-40aa-a11e-23e345143bb5
- Size 637B
- SHA256 a6e06385a78a3264682980d786c60615fd134c7ddc0579ecf17e1ff707aad09a
- MD5 3046e8cc43bc11bc7b39404c953e9fe3
- SHA1 25d6617fa9b081079b77498efdb2ea9bdbc83eb5
- SHA512 c506ae0a473b9fb9ea378d157891332e8d4d562c7aa9f7b833536ef8b52dd1b99dc9bd255cfe053c5b5a1d0cb850caa6ce8369d9f36b9c3f1c361930003ee4ae
- TLSH T15AF078426698953A8C406B4BF0D03A4091798533A096F2ADE0D4D739785FA9B02B7E4F
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/z2e2svap.default-release/datareporting/glean/tmp/933e452b-5af7-4edd-9b37-1c72e9c6e41e
- Size 637B
- SHA256 299e3ea114b3d7230bddbcd6657129e32526b417eac1e0a28c322c51311a7735
- MD5 7a5a7968a3eeb08c788d62acd043c3ca
- SHA1 d9b47d2addd27845bec32834cea12992c966d98c
- SHA512 c087536b7544577602f7028360188da6ac434917f2623dc2429758a4d750bfacd2a8da768510b68e7650203d7a0912088968530fa33e424cd552f13633cdd622
- TLSH T1AFF0D8421698D12A4C406A8BF0D03F409178413760AAF22DE4D49B397C6FADB0277B0F
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/z2e2svap.default-release/datareporting/glean/tmp/ae0b2342-4944-4ff5-b53d-453e92ff50f8
- Size 61KB
- SHA256 ee2b5059f29cd88c9d531af86c2fdf564f7a67fde7490633e012ab47bd6e85a5
- MD5 3a9eacb0f27a08a01fc2de2b8ac32208
- SHA1 5044eb32d849cd4e75bb4f2a83e5ec0432be309c
- SHA512 407878d3b819c42cc957dfd6ca555c6f0f94bf13c2e2126d968e2a79455dea271a471dcd51f3ff058de3f5fae9e1e844b69faee59dc4fc459434e40b21e221fa
- SSDEEP 1536:K4Tuyb8SLxuQXnVj6FI3uSFDyiijyNXCkmPUW/0pbLDODJJXDpWLg8U1So:K6Q
- TLSH T18453DFC8251008BE3FC3C2BD948653F96FDA8FE0555618D31D8AEE2DCE99998712E077
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/z2e2svap.default-release/datareporting/glean/tmp/b2c7ee74-429a-4291-ba90-8096817135df
- Size 21KB
- SHA256 9747076464d72c56ac88827fb9d2c400e710c54a7ab8bf325b5938fd2444ffa4
- MD5 f996c6e99b1ff561cc169d4725fd3b77
- SHA1 a7e85b9a7c42e83822e8db216b139d2851383241
- SHA512 9321b0402e6533874b70d3490a5f5ea16cab0c68900e3ecbecc0af6832a1926f58a5dac9a518e92846dcff4176c6affc7148b0249138c359e10363e03f0ca4ae
- SSDEEP 192:kYPOe+GOB+VgJa8NqDUpAw86UhC/Ae2KpOO:kiOB+VAagA0j
- TLSH T12FA20F9C25344C1F7ED3D56D9DC143AD925B8A8184C218836E52EE8FDE9CF0C3366AB6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/z2e2svap.default-release/datareporting/glean/tmp/be0baafe-a2b8-4de8-9667-1cb1fa0b1fe9
- Size 4KB
- SHA256 2ccecefbe8301c49e353f2a12139a1f9a94c603ba55e9a0ce1bba2effa9571fe
- MD5 fba80f704581acdfb3a5a9bf9f4ee944
- SHA1 ea2d18c6a1ed36fb4fe65874d4cce7b4422b78e9
- SHA512 43fb241dfb2a1ef31bfe8f40df73ffb56ef1dac13a7671c3d7c76a846baddb2bf673bba89bd40670459ce95cfa54824b631ca98ac7032215193290ebcf8b6408
- SSDEEP 96:8UQ+eihvrvJyfPUHKwDTxJrYPNn31qrEWCBBp51cYia4vW9DwWciQ:80cPggwWciQ
- TLSH T1E991D0F8246049123DE3D67EE9C027B2D61F85D680C214661D21DE6FABEE60C51B3F8B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/z2e2svap.default-release/datareporting/glean/tmp/ca2569a0-8223-4f83-9cd1-00b53b66731a
- Size 13KB
- SHA256 429dc6a4e691266f6c7b1ce65519f6ee6469f199d83b4090aa34929c321849f6
- MD5 5a1be1c7b1b9bc738c6249d2e5e7daa7
- SHA1 d11ef153a4d6a969601954f8461c0c2a48c4a8e7
- SHA512 49bd8f30f8fc2b1c9eefe5296e278e6a12cf21a1a84a5224cfa808aa4c9b0db22d413bcc7f3cfaddad8555f444cb2aed891a7278d3e6b1dfbf3496e974efcfc0
- SSDEEP 384:X/C9Y/zzvl2uBJPHQr9IxUJP20J7XsLqm6KfQ9Wh+:X/VvsYUJxw7fQ8+
- TLSH T13652B6B800244C7EADD3D376D9A03F53CB7F415290C62858AEDD8D2A73EFA4D026695B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/z2e2svap.default-release/datareporting/glean/tmp/fe4911f9-5faf-476d-b34d-06bb0e0b62f0
- Size 368B
- SHA256 29220942f79398e6d48ff75bec78c537fcabd38105b9cff1712f97cd5667eab3
- MD5 ace692ca1744547100657743b68f2522
- SHA1 9fec9f088599ef7a21e8777b6f1128bbf38f597a
- SHA512 38e84d43288159c8bdb4d644b123e6b1937fd2fe36b2665732bcaaa2cd231cc78b842f49abf8a07324f6d72328485d191a59e5a0750271efffeb96f4d2520f24
- TLSH T169E068A6D5B8C115A980E32988954D01AF7CE803D0F640B5A8A0219E8FEB4CC82F321F
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/z2e2svap.default-release/prefs-1.js
- Size 7KB
- SHA256 cf4a7c588704b59bdeccd5febba9b82c03eca8e7f9c074c29bbd055786d52369
- MD5 f93a483834670accb9db57b97b926fe0
- SHA1 b48a263838d285a832e9c486e9a342ee1129577d
- SHA512 13261ce5d97f847a6c1e3db386563c094fefcc48a810fb567dcd8644db1bf6f1abc081d55eeb8deaaa5d74a4818cd5b92b1d12620296e1dc98c25804d5599379
- SSDEEP 96:oZo6uF2WNqjqplvh7I8ZgzGwB/z2j06gmAbIMFxxjnFkI8Aqp8E8M:ItSwuN7I8ZAB/z22xFDvqp8Ez
- TLSH T11EF1316891084BBFA97337BC6C2889410A72C16FB7BF28DA107A8709515CB7451FD6EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/z2e2svap.default-release/prefs-1.js
- Size 15KB
- SHA256 1d9f60803fc114571cf1c9c252bd19ab1d5b0b9c84c3664b22742d1d5e755fba
- MD5 56e278fa42ba099f73e49ae9b4355d05
- SHA1 3605f7a1cfabdfe7a53cd29372d1991a462125ae
- SHA512 2f9306d0350d372ae1968f4a30463f4e69cdc9ca23d0b869fbc44c0bda5db747a20aac8f16190c8437a710a1203dbd7fc717152c5136a16cd05fb587e0c1d092
- SSDEEP 192:I46tP+rcRUCwuQMh428ykEev8JciDrUEZ7mF1zB8ZAB7mz28mxFL2x7Rvqp8cBay:IyYq7YvqpNmO
- TLSH T17562FF3C9500CF7FA1B312BC6C264EA11565C26BB6BF7CE209B8C712441D7B451E6AEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/z2e2svap.default-release/prefs-1.js
- Size 7KB
- SHA256 3ac164f967c173c881f4d3e88c359be2740300d347e89f28284102066454dac9
- MD5 b0c4691772c8f9c21caa729f7ee1cc1c
- SHA1 6936ea0dfccecf9761a41b959cbd4c554511c162
- SHA512 66d2aaf58864a5f1b1a6cb3b13d8ff25eee0cc8928bfb59cf08bc2fd582244bc6702f4f90348b56028ce96c7ed14a33ef63c4d15b2587fff72624f9324b9be68
- SSDEEP 96:oZoNF2Sqjqplv/7ItHgzGC/zMj06gmAbIMFxxjnFkI8Aqp828M:IVuD7ItHy/zM2xFDvqp82z
- TLSH T17CF1426891084BBFA97337BC6C2889410A72C15FB7FF28DA107A8708510CB7451F9AEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/z2e2svap.default-release/prefs-1.js
- Size 7KB
- SHA256 246b2899e034469fbe6cad548dbd9be38ced553f320ad5857bedf32adeb07bf1
- MD5 d4106fdfc2b3cae8fabb5dcd4811b8fe
- SHA1 fd77eef33ccc4c803c81f8514dac7a1a8995818f
- SHA512 689b14289d8d8c47d9522387bf1f9f1c29cf43b56e8e9c9a807287806f50040bf67170a6ba61b60ef581eff2a849053d55f38fc3f3ee47cc6d03d6dc1c05310b
- SSDEEP 96:oZoNF2Sqjqplvh7ItHgzGC/z2j06gmAbIMFxxjnFkI8Aqp8E8M:IVuN7ItHy/z22xFDvqp8Ez
- TLSH T176F1316891084BBFA97337BC6C6889410A72C15FB7FF28DA117A8709414CB7451F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/z2e2svap.default-release/prefs-1.js
- Size 7KB
- SHA256 30b2beed69c4d06b922a8e993bd7f7c77a8d8dc5830c363f5d0f833ff4b9b02d
- MD5 c104478a1fc3bfc3afde0f0dffe3fb28
- SHA1 3242543fefd1e416d3620fd6061f1606a34fa3b7
- SHA512 387de9830c43494102b2c384573c46cb658657154d6823a554c647f0e656f7478cf4055638b0494d8ab3e6414648294ea9a2a4e1d069e7461e373f7481d6025f
- SSDEEP 96:oZoNF2WNqjqplvh7ItHgzGC/z2j06gmAbIMFxxjnFkI8Aqp8E8M:I2wuN7ItHy/z22xFDvqp8Ez
- TLSH T1BAF1416891044BBFA97337BC6C6889410A72C15FB7BF28DA107A8709414CB7451FDAEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/z2e2svap.default-release/sessionstore-backups/recovery.jsonlz4.tmp
- Size 960B
- SHA256 6296d4f65297a0de9b3d30f51c16444a58c7fdfbe2de4c9a535fa1e111054c0f
- MD5 a751e920418c0e8658584f470be6af95
- SHA1 6c3db0be3d6f116f9d2f5e08bc02331ca8e2a946
- SHA512 5d084ce3d81220741e3c5e55c922c71a5245094c8b47f5dc54d1b6c6a084d635efde6bf7bf4c11da1d5f502b423665f025799bb8d4f8d63b0e9833b2f6add4fe
- TLSH T11F1198C25A7451965F77715C906E67FD970C1465032DA84D84CC3606438C94FFED904E
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/z2e2svap.default-release/webappsstore.sqlite
- Size 96KB
- SHA256 d2ad70f945aec5eccbf8800c6a183feab8f03f92e2a8eb47b694a3cc32854d17
- MD5 0464ffc40d8ba8081682ff17f5a2e46b
- SHA1 34ca81b39b4f3ab8fbec114eb0e5d39af8da3614
- SHA512 ec4db13962b31d21937d3bcf29fef64fdfe3640e378efacd27a08d3fe4ae7e69b99b88efe92baf49f01d9d5d0131443a0a6999246cd957a180874fd60a9e4d28
- SSDEEP 6:ltTP/E7R/Wwhm914iDKrvcwTlNCcVWDeNgLu5e3cwOJrheFDEf:DrE7Rzhm9GiD0c4NCcVUo58cz16D
- TLSH T1F4A3D88FCA4813A7DD0083789B461F80EE93585E45C343E238B423CC0AA37440B2F828
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /tmp/tmp-hsc.xpi
- Size 1.8MB
- SHA256 b41d68c300767d5bfdc8531a267f42a90193f14b1ec2da80458fa260b19f4aa7
- MD5 81e4bda61b54941a0670cd602f7a7d8f
- SHA1 dfb36a3627fd4ff6f529fc2a8ff7eba7a59581de
- SHA512 185df6c010814bff8102e15827ab31d415ee34b275f6557e1833d75a5b9775f6776fe91f45e35d29b67a997d6f35e00498f7beba5a0a57dfea1f0666e9dc8d23
- SSDEEP 49152:5gu+hmb89QO0Nx6gIWNeF6ccUnjCRM6fiRyHubI/0s:5t3KqxPIcnccucZ/Hu0/0s
- TLSH T1BB95231DD96A80E5CC6760F0994DE0D1E518A691C897BD6F4206B8D8ED908CC1BEFBCF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /tmp/tmpaddon
- Size 575KB
- SHA256 997b6e1c0e07307de3adf5d0d7a3ddc5d81cd522afe675dfdb43154f73f5b0d0
- MD5 2aa72a97657774b1eefabe0490b3c088
- SHA1 17f12db36fc49b9cf38d61ed2dbde55e71b81b85
- SHA512 f5246bf14d038adf4ce0c4360262ab722bc3de4220f047c3d542b4c564074b4877dc8659e3125c5171c749e7ce93f20cc63777eb5e1539e960670cbc5f30ac85
- SSDEEP 12288:UD7rHLJG5x5cHc7eoMyBEcGytXn8X+QmkZyhwQqvQv03IS2XuEKwFPPukAHCmhdt:Y0bc8KoMyBEzyt38X+QmkZUwjvCEgpYB
- TLSH T120C433D510B9A1A62B5FBC2CCD1C2AA38935DCFAF017265EF0BA051FD76267980C0D76
- MD5 SHA1 SHA512 SSDEEP TLSH