d4e580e052ea7658a68d8ed440db36dc8c911a57299edf449c310f01319109f0

Resubmissions

04/06/2026, 16:11

260604-tncgcabt2m4

04/06/2026, 16:08

260604-tletpabs6q4

04/06/2026, 16:06

260604-tj5bkaav9y4

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
ubuntu-24.04_amd64
resource
ubuntu2404-amd64-20260127-en
resource tags

arch:amd64arch:i386image:ubuntu2404-amd64-20260127-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
submitted
04/06/2026, 16:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FjordLauncher-Linux-x86_64.appimage
Size 104.6MB
Sample260604-tncgcabt2m
SHA256 d4e580e052ea7658a68d8ed440db36dc8c911a57299edf449c310f01319109f0
MD5 e2d2225f9f04be0f058110f02def8498
SHA1 a90e69479701822c74c9a65d0f3cfa27edd5dedf
SHA512 4c6055fc6b81f7269a7c5ce70eb03311bc098e47269c23e3b42ddc5b0473c666f9dccc54c30e39216196510d08d7714323c4965a5a40d36a6b438e3330f67316
SSDEEP 1572864:bYg8kR01LHriTDQqicVRTYh7yeoFGCDBZJxskQRKIf6eR8DPiV8VXOgqqnLZZ:bYGaYEqjVR84jFdBZDTnIUDPt+gqqnb
TLSH
T18B383302F5320D78E24FEA72C667FBA7F7653C73A101C427E76567814B36AE09BA0905
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Changes its process name 43 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	QXcbEventQueue	2048	fjordlauncher
Changes the process name, possibly in an attempt to hide itself	QDBusConnectionManager	2049	fjordlauncher
Changes the process name, possibly in an attempt to hide itself	gmain	2057	xdg-desktop-portal
Changes the process name, possibly in an attempt to hide itself	pool-spawner	2058	xdg-desktop-portal
Changes the process name, possibly in an attempt to hide itself	gdbus	2059	xdg-desktop-portal
Changes the process name, possibly in an attempt to hide itself	pool-/usr/libex	2060	xdg-desktop-portal
Changes the process name, possibly in an attempt to hide itself	pool-spawner	2063	xdg-document-portal
Changes the process name, possibly in an attempt to hide itself	gmain	2064	xdg-document-portal
Changes the process name, possibly in an attempt to hide itself	gdbus	2065	xdg-document-portal
Changes the process name, possibly in an attempt to hide itself	pool-spawner	2068	xdg-permission-store
Changes the process name, possibly in an attempt to hide itself	gmain	2069	xdg-permission-store
Changes the process name, possibly in an attempt to hide itself	pool-/usr/libex	2070	xdg-permission-store
Changes the process name, possibly in an attempt to hide itself	gdbus	2071	xdg-permission-store
Changes the process name, possibly in an attempt to hide itself	pool-/usr/libex	2072	xdg-document-portal
Changes the process name, possibly in an attempt to hide itself	fuse mainloop	2073	xdg-document-portal
Changes the process name, possibly in an attempt to hide itself	pool-spawner	2080	xdg-desktop-portal-gtk
Changes the process name, possibly in an attempt to hide itself	gmain	2081	xdg-desktop-portal-gtk
Changes the process name, possibly in an attempt to hide itself	gdbus	2082	xdg-desktop-portal-gtk
Changes the process name, possibly in an attempt to hide itself	pool-spawner	2085	gvfsd
Changes the process name, possibly in an attempt to hide itself	gmain	2086	gvfsd
Changes the process name, possibly in an attempt to hide itself	gdbus	2087	gvfsd
Changes the process name, possibly in an attempt to hide itself	pool-gvfsd	2088	gvfsd
Changes the process name, possibly in an attempt to hide itself	pool-spawner	2093	gvfsd-fuse
Changes the process name, possibly in an attempt to hide itself	gmain	2094	gvfsd-fuse
Changes the process name, possibly in an attempt to hide itself	gdbus	2095	gvfsd-fuse
Changes the process name, possibly in an attempt to hide itself	gvfs-fuse-sub	2096	gvfsd-fuse
Changes the process name, possibly in an attempt to hide itself	pool-xdg-deskto	2097	xdg-desktop-portal-gtk
Changes the process name, possibly in an attempt to hide itself	dconf worker	2098	xdg-desktop-portal-gtk
Changes the process name, possibly in an attempt to hide itself	pool-/usr/libex	2099	xdg-desktop-portal
Changes the process name, possibly in an attempt to hide itself	dconf worker	2100	xdg-desktop-portal
Changes the process name, possibly in an attempt to hide itself	QNetworkAccessManager thread	2114	fjordlauncher
Changes the process name, possibly in an attempt to hide itself	Thread (pooled)	2115	fjordlauncher
Changes the process name, possibly in an attempt to hide itself	Thread (pooled)	2116	fjordlauncher
Changes the process name, possibly in an attempt to hide itself	QXcbEventQueue	2118	fjordlauncher_updater
Changes the process name, possibly in an attempt to hide itself	QDBusConnectionManager	2119	fjordlauncher_updater
Changes the process name, possibly in an attempt to hide itself	QNetworkAccessManager thread	2121	fjordlauncher_updater
Changes the process name, possibly in an attempt to hide itself	Thread (pooled)	2122	fjordlauncher_updater
Changes the process name, possibly in an attempt to hide itself	QXcbEventQueue	2124	fjordlauncher
Changes the process name, possibly in an attempt to hide itself	QDBusConnectionManager	2125	fjordlauncher
Changes the process name, possibly in an attempt to hide itself	pool-/usr/libex	2127	xdg-desktop-portal
Changes the process name, possibly in an attempt to hide itself	pool-/usr/libex	2128	xdg-document-portal
Changes the process name, possibly in an attempt to hide itself	pool-/usr/libex	2129	xdg-desktop-portal
Changes the process name, possibly in an attempt to hide itself	Thread (pooled)	2130	fjordlauncher

Reads CPU attributes 1 TTPs 1 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	gamemoded

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/module/apparmor/parameters/enabled	dbus-daemon
File opened for reading	/sys/kernel/security/apparmor/features/dbus/mask	dbus-daemon

Reads runtime system information 36 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/exe	FjordLauncher-Linux-x86_64.appimage
File opened for reading	/proc/sys/kernel/cap_last_cap	dbus-daemon
File opened for reading	/proc/mounts	dbus-daemon
File opened for reading	/proc/2084/cmdline	dbus-daemon
File opened for reading	/proc/meminfo	fjordlauncher
File opened for reading	/proc/filesystems	xdg-permission-store
File opened for reading	/proc/sys/kernel/random/boot_id	fjordlauncher
File opened for reading	/proc/2117/cmdline	dbus-daemon
File opened for reading	/proc/2123/cmdline	dbus-daemon
File opened for reading	/proc/filesystems	dbus-daemon
File opened for reading	/proc/self/mountinfo	fjordlauncher
File opened for reading	/proc/self/fd	dbus-launch
File opened for reading	/proc/filesystems	xdg-desktop-portal
File opened for reading	/proc/filesystems	xdg-document-portal
File opened for reading	/proc/filesystems	xdg-desktop-portal-gtk
File opened for reading	/proc/filesystems	gvfsd
File opened for reading	/proc/2106/cmdline	dbus-daemon
File opened for reading	/proc/2054/status	dbus-daemon
File opened for reading	/proc/2067/cmdline	dbus-daemon
File opened for reading	/proc/filesystems	gvfsd-fuse
File opened for reading	/proc/self/fd	fjordlauncher
File opened for reading	/proc/self/fd	fjordlauncher
File opened for reading	/proc/2054/attr/apparmor/current	dbus-daemon
File opened for reading	/proc/2040/cmdline	dbus-daemon
File opened for reading	/proc/2056/cmdline	dbus-daemon
File opened for reading	/proc/2090/cmdline	dbus-daemon
File opened for reading	/proc/self/task/2101/comm	xdg-desktop-portal
File opened for reading	/proc/2106/fdinfo/5	gamemoded
File opened for reading	/proc/2106/fdinfo/6	gamemoded
File opened for reading	/proc/2062/cmdline	dbus-daemon
File opened for reading	/proc/sys/crypto/fips_enabled	fjordlauncher
File opened for reading	/proc/self/fd	fjordlauncher_updater
File opened for reading	/proc/self/fdinfo	gamemoded
File opened for reading	/proc/self/fd	dbus-daemon
File opened for reading	/proc/2079/cmdline	dbus-daemon
File opened for reading	/proc/sys/crypto/fips_enabled	fjordlauncher_updater

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/pl05b025a93b27-lockfile	fjordlauncher

/tmp/FjordLauncher-Linux-x86_64.appimage
/tmp/FjordLauncher-Linux-x86_64.appimage
1⤵
- Reads runtime system information
PID:2040

/tmp/.mount_FjordLfCdAHI/AppRun
/tmp/FjordLauncher-Linux-x86_64.appimage
1⤵
PID:2040

/tmp/.mount_FjordLfCdAHI/bin/fjordlauncher
/tmp/.mount_FjordLfCdAHI/bin/fjordlauncher
1⤵
- Changes its process name
- Reads runtime system information
- Writes file to tmp directory
PID:2040
- /usr/bin/dbus-launch
  dbus-launch --autolaunch 36e6eb39a6fa405996e79cad2731865d --binary-syntax --close-stderr
  2⤵
  - Reads runtime system information
  PID:2050
- - /usr/bin/dbus-daemon
    /usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:2052
  - - /usr/libexec/xdg-desktop-portal
      /usr/libexec/xdg-desktop-portal
      4⤵
      Changes its process name
      Reads runtime system information
      PID:2056
  - - /usr/libexec/xdg-document-portal
      /usr/libexec/xdg-document-portal
      4⤵
      Changes its process name
      Reads runtime system information
      PID:2062
    - - /usr/bin/fusermount3
        
        fusermount3 -o "rw,nosuid,nodev,fsname=portal,auto_unmount,subtype=portal" -- /root/.cache/doc
        5⤵
        
        PID:2074
  - - /usr/libexec/xdg-permission-store
      /usr/libexec/xdg-permission-store
      4⤵
      Changes its process name
      Reads runtime system information
      PID:2067
  - - /usr/libexec/xdg-desktop-portal-gtk
      /usr/libexec/xdg-desktop-portal-gtk
      4⤵
      Changes its process name
      Reads runtime system information
      PID:2079
  - - /usr/libexec/gvfsd
      /usr/libexec/gvfsd
      4⤵
      Changes its process name
      Reads runtime system information
      PID:2084
    - - /usr/libexec/gvfsd-fuse
        
        /usr/libexec/gvfsd-fuse /root/.gvfs -f
        5⤵
        Changes its process name
        Reads runtime system information
        
        PID:2090
  - - /usr/bin/gamemoded
      /usr/bin/gamemoded -d
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:2104
- /usr/bin/dbus-launch
  dbus-launch --autolaunch 36e6eb39a6fa405996e79cad2731865d --binary-syntax --close-stderr
  2⤵
  PID:2102
- /tmp/.mount_FjordLfCdAHI/bin/fjordlauncher_updater
  /tmp/.mount_FjordLfCdAHI/bin/fjordlauncher_updater --check-only --dir /.local/share/FjordLauncher --debug
  2⤵
  - Changes its process name
  - Reads runtime system information
  PID:2117
- - /usr/bin/dbus-launch
    dbus-launch --autolaunch 36e6eb39a6fa405996e79cad2731865d --binary-syntax --close-stderr
    3⤵
    PID:2120
- - /tmp/.mount_FjordLfCdAHI/bin/fjordlauncher
    /tmp/.mount_FjordLfCdAHI/bin/fjordlauncher --version
    3⤵
    - Changes its process name
    - Reads runtime system information
    PID:2123
  - - /usr/bin/dbus-launch
      dbus-launch --autolaunch 36e6eb39a6fa405996e79cad2731865d --binary-syntax --close-stderr
      4⤵
      PID:2126

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FjordLauncher-0.log

Path /.local/share/FjordLauncher/logs/FjordLauncher-0.log
Size 9KB
SHA256 a473a448677b5175d36b67fa7d7a5c4deb941d6b07be62d916d0827b587ce9ea
MD5 bd4aa53951c82e66a3212946e0ef5e8f
SHA1 55236728de3435e7bde489c71face2ca219faa19
SHA512 84b80b1b2633dfe73223695be5fdf46f4406024f2a442df3e97f41f379e166c96720042326863851302ade7c61cf8e79a31dd19de2551af7e7a93a68e11580fb
SSDEEP 192:14l7W937fWKYWxsrMpBb1Dl/wwrYTfw6Mrwabp:14KR6MpBT/wYYTIrcaV
TLSH
T1A712891AB21110255B47E2009E5F17AAC038DF7E87816FBAF10E43F98B7A56137FE925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FjordLauncher-0.log

Path /.local/share/FjordLauncher/logs/FjordLauncher-0.log
Size 25KB
SHA256 a8ce2e55a0c17f5518f5f49815da18e0c8b0223c6e7240f1d74230f3403ba985
MD5 91cc8a6566cd028ec8d4006cf25aa8f0
SHA1 e6b58ac3d4dd0261109753e092b81ad887e774a8
SHA512 bbd5debb23663a4f2e0265fb03b22f582430b5ae8e46d2e596026330238a7a216226b7eb2515a56e348a5e691a7302ce7a791d82961d856a669c22761b82f9e7
SSDEEP 768:14KR6MpdwYYTxafNa9xtK1D3KGlBcWjE/:14KJjE/
TLSH
T1BEC2681BBA0656257747B001E55A2759D034CF6ECB828FF6B24A07D8AF778A037D9233
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FjordLauncherUpdater-CheckOnly-0.log

Path /.local/share/FjordLauncher/logs/FjordLauncherUpdater-CheckOnly-0.log
Size 2KB
SHA256 a36975d9d2f98d012499bf76844da7529eccc3a3535d55e74c6b91173bf15105
MD5 9119bb42c83c2b27374a8599300a519b
SHA1 c33e9ea467ed6f930d7b1ae44061e2008748f12a
SHA512 5a8297b3f732dfcc5b82b014ccf5394daa5200d3714f90ec2f1c59ffcd3df9893f311c3dfb9bf9f0ca1f8cce6e48f780f76ee310a2bf01e4f28ab38ba3df0466
TLSH
T12D412EA7504450DE0EB927E56E1605B21178C6170F4748F334ED806C8FBF2ACF6B6A89
MD5 SHA1 SHA512 TLSH

Submit Download

FjordLauncherUpdater-CheckOnly-0.log

Path /.local/share/FjordLauncher/logs/FjordLauncherUpdater-CheckOnly-0.log
Size 2KB
SHA256 ff3f92220d961c27e00d5c57addfa617cca576540ee68d44cd1d829b8cb42d45
MD5 d6b104f01e92fa872dfa9c6c33e6a03d
SHA1 a48ab142270f68867fb9536e322d023af74bbff6
SHA512 12dccb835f2ed6c7d2668345410ed36cf2e8fbef754e9e52f424c490b4045a23e949085d467390c3fd1369ddb2fb06cc73a7766010d94e56c054d96eb0222167
TLSH
T12C511197500090DB0E6D17E16D1606B662ACD6170F430CF634EDC46C9F7F1ACE7BAA9A
MD5 SHA1 SHA512 TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads