hxxp://google[.]com

Analysis

geolocation tags

cacanadananorth-americatoronto
user interaction
yes
max time kernel
197s
max time network
201s
platform
ubuntu-24.04_amd64
resource
ubuntu2404-amd64-20260127-de
resource tags

arch:amd64arch:i386image:ubuntu2404-amd64-20260127-dekernel:6.8.0-31-genericlocale:de-deos:ubuntu-24.04-amd64system
submitted
05/06/2026, 22:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://google.com
Sample260605-2ld66aex21

Score

6^/10

antivm discovery

Malware Config

Signatures

Checks hardware identifiers (DMI) 1 TTPs 1 IoCs

Checks DMI information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/sys/devices/virtual/dmi/id/product_name	firefox-bin

Reads hardware information 1 TTPs 1 IoCs

Accesses system info like serial numbers, manufacturer names etc.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/virtual/dmi/id/product_sku	firefox-bin

Changes its process name 64 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	AsyncSi~lThread	2134	firefox-bin
Changes the process name, possibly in an attempt to hide itself	gmain	2139	firefox-bin
Changes the process name, possibly in an attempt to hide itself	pool-spawner	2138	firefox-bin
Changes the process name, possibly in an attempt to hide itself	pool	2141	firefox-bin
Changes the process name, possibly in an attempt to hide itself	gdbus	2142	firefox-bin
Changes the process name, possibly in an attempt to hide itself	glean.dispatche	2143	firefox-bin
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	2145	firefox-bin
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	2145	firefox-bin
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	2145	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Timer	2146	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Timer	2146	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	2147	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Socket Thread	2148	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Socket Thread	2148	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	2147	firefox-bin
Changes the process name, possibly in an attempt to hide itself	IPDL Background	2149	firefox-bin
Changes the process name, possibly in an attempt to hide itself	IPDL Background	2149	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	2150	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	2150	firefox-bin
Changes the process name, possibly in an attempt to hide itself	pool	2153	firefox-bin
Changes the process name, possibly in an attempt to hide itself	pool-firefox	2154	firefox-bin
Changes the process name, possibly in an attempt to hide itself	glxtest:disk$0	2155	glxtest
Changes the process name, possibly in an attempt to hide itself	dconf worker	2156	firefox-bin
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	2157	firefox-bin
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	2157	firefox-bin
Changes the process name, possibly in an attempt to hide itself	pool-firefox	2158	firefox-bin
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	2160	firefox-bin
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	2160	firefox-bin
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	2161	firefox-bin
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	2161	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Cache2 I/O	2162	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Cache2 I/O	2162	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Cookie	2163	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Cookie	2163	firefox-bin
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #0	2164	firefox-bin
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #1	2165	firefox-bin
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	2166	firefox-bin
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	2166	firefox-bin
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	2168	firefox-bin
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	2168	firefox-bin
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	2167	firefox-bin
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	2167	firefox-bin
Changes the process name, possibly in an attempt to hide itself	StreamTrans #3	2169	firefox-bin
Changes the process name, possibly in an attempt to hide itself	StreamTrans #3	2169	firefox-bin
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #2	2170	firefox-bin
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #2	2170	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Worker Launcher	2171	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Worker Launcher	2171	firefox-bin
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	2172	firefox-bin
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	2172	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Softwar~cThread	2173	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Softwar~cThread	2173	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Softwar~cThread	2173	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Renderer	2174	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Renderer	2174	firefox-bin
Changes the process name, possibly in an attempt to hide itself	WRWorker#0	2175	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Glyph rasterize	2177	firefox-bin
Changes the process name, possibly in an attempt to hide itself	WrGlyph~terizer	2177	firefox-bin
Changes the process name, possibly in an attempt to hide itself	WRWorkerLP#0	2176	firefox-bin
Changes the process name, possibly in an attempt to hide itself	CanvasRenderer	2179	firefox-bin
Changes the process name, possibly in an attempt to hide itself	CanvasRenderer	2179	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Compositor	2178	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Compositor	2178	firefox-bin
Changes the process name, possibly in an attempt to hide itself	WRWorker#0	2175	firefox-bin

Reads CPU attributes 1 TTPs 6 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/possible	firefox-bin
File opened for reading	/sys/devices/system/cpu/possible	glxtest
File opened for reading	/sys/devices/system/cpu/cpu0/cpu_capacity	glxtest
File opened for reading	/sys/devices/system/cpu/present	firefox-bin
File opened for reading	/sys/devices/system/cpu/present	firefox-bin
File opened for reading	/sys/devices/system/cpu/possible	firefox-bin

Enumerates kernel/hardware configuration 1 TTPs 41 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/class	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/uevent	glxtest
File opened for reading	/sys/bus/pci/devices	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/class	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_vendor	glxtest
File opened for reading	/sys/devices/system/node	firefox-bin
File opened for reading	/sys/kernel/security/apparmor/features/dbus/mask	dbus-daemon
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/device	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/vendor	glxtest
File opened for reading	/sys/fs/cgroup/system.slice/agent.service/cpu.max	firefox-bin
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/class	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_device	glxtest
File opened for reading	/sys/fs/cgroup/system.slice/agent.service/cpu.max	firefox-bin
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0	firefox-bin
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/drm/card1	firefox-bin
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/class	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/drm/renderD128	firefox-bin
File opened for reading	/sys/module/apparmor/parameters/enabled	dbus-daemon
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/class	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/device	glxtest

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/filesystems	firefox-bin
File opened for reading	/proc/sys/kernel/cap_last_cap	dbus-daemon
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/cgroup	firefox-bin
File opened for reading	/proc/self/mountinfo	firefox-bin
File opened for reading	/proc/2188/cmdline	dbus-daemon
File opened for reading	/proc/self/task/2273/stat	firefox-bin
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/2056/cmdline	dbus-daemon
File opened for reading	/proc/self/fd/17	firefox-bin
File opened for reading	/proc/self/maps	firefox-bin
File opened for reading	/proc/filesystems	xdg-document-portal
File opened for reading	/proc/pressure/memory	firefox-bin
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/maps	firefox-bin
File opened for reading	/proc/filesystems	glxtest
File opened for reading	/proc/filesystems	gvfsd
File opened for reading	/proc/self/fd/57	firefox-bin
File opened for reading	/proc/self/fd/41	firefox-bin
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd/70	firefox-bin
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/stat	firefox-bin
File opened for reading	/proc/filesystems	at-spi-bus-launcher
File opened for reading	/proc/self/fd/95	firefox-bin
File opened for reading	/proc/self/fd	dbus-launch
File opened for reading	/proc/self/fd	dbus-daemon
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	xdg-desktop-portal
File opened for reading	/proc/2194/cmdline	dbus-daemon
File opened for reading	/proc/filesystems	gvfsd-fuse
File opened for reading	/proc/self/status	firefox-bin
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/2238/cmdline	dbus-daemon
File opened for reading	/proc/self/task/2261/stat	firefox-bin
File opened for reading	/proc/self/task/2310/stat	firefox-bin
File opened for reading	/proc/filesystems	xdg-desktop-portal-gtk
File opened for reading	/proc/2227/cmdline	dbus-daemon
File opened for reading	/proc/2040/attr/apparmor/current	dbus-daemon
File opened for reading	/proc/self/fd	dbus-send
File opened for reading	/proc/2131/cmdline	dbus-daemon
File opened for reading	/proc/self/task/2189/stat	firefox-bin
File opened for reading	/proc/2034/cmdline	dbus-daemon
File opened for reading	/proc/2207/cmdline	dbus-daemon
File opened for reading	/proc/self/cgroup	firefox-bin
File opened for reading	/proc/mounts	fusermount3
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd/93	firefox-bin
File opened for reading	/proc/mounts	dbus-daemon
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/task/2132/stat	firefox-bin
File opened for reading	/proc/self/task/2253/comm	xdg-desktop-portal
File opened for reading	/proc/self/mountinfo	firefox-bin
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/stat	firefox-bin
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd/39	firefox-bin
File opened for reading	/proc/2215/cmdline	dbus-daemon
File opened for reading	/proc/self/fd/72	firefox-bin

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/firefox/.parentlock	firefox-bin

/usr/bin/xdg-open
xdg-open http://google.com
1⤵
PID:2033
- /usr/bin/dbus-send
  dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
  2⤵
  PID:2034
- - /usr/bin/dbus-launch
    dbus-launch --autolaunch 36e6eb39a6fa405996e79cad2731865d --binary-syntax --close-stderr
    3⤵
    - Reads runtime system information
    PID:2036
  - - /usr/bin/dbus-daemon
      /usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:2038
    - - /usr/libexec/xdg-desktop-portal
        
        /usr/libexec/xdg-desktop-portal
        5⤵
        Reads runtime system information
        
        PID:2188
    - - /usr/libexec/at-spi-bus-launcher
        
        /usr/libexec/at-spi-bus-launcher
        5⤵
        Reads runtime system information
        
        PID:2194
    - - /usr/libexec/xdg-document-portal
        
        /usr/libexec/xdg-document-portal
        5⤵
        Reads runtime system information
        
        PID:2207
      - /usr/bin/fusermount3
        
        fusermount3 -o "rw,nosuid,nodev,fsname=portal,auto_unmount,subtype=portal" -- /root/.cache/doc
        6⤵
        Reads runtime system information
        
        PID:2222
    - - /usr/libexec/xdg-permission-store
        
        /usr/libexec/xdg-permission-store
        5⤵
        
        PID:2215
    - - /usr/libexec/xdg-desktop-portal-gtk
        
        /usr/libexec/xdg-desktop-portal-gtk
        5⤵
        Reads runtime system information
        
        PID:2227
    - - /usr/libexec/gvfsd
        
        /usr/libexec/gvfsd
        5⤵
        Reads runtime system information
        
        PID:2232
- /usr/bin/grep
  grep " = \\\"xfce4\\\"\$"
  2⤵
  - Reads runtime system information
  PID:2042
- /usr/bin/xprop
  xprop -root _DT_SAVE_MODE
  2⤵
  PID:2041
- /usr/bin/grep
  grep -i "^xfce_desktop_window"
  2⤵
  - Reads runtime system information
  PID:2044
- /usr/bin/xprop
  xprop -root
  2⤵
  PID:2043
- /usr/bin/grep
  grep -q "^Enlightenment"
  2⤵
  - Reads runtime system information
  PID:2046
- /usr/bin/uname
  uname
  2⤵
  PID:2047
- /usr/bin/grep
  grep -q "^file://"
  2⤵
  - Reads runtime system information
  PID:2049
- /usr/bin/egrep
  egrep -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:2051
- /usr/local/sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:2051
- /usr/local/bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:2051
- /usr/sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:2051
- /usr/bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:2051
- /usr/bin/sed
  sed -n "s/\$^[[:alnum:]+\\.-]*\$:.*\$/\\1/p"
  2⤵
  - Reads runtime system information
  PID:2054
- /usr/bin/xdg-mime
  xdg-mime query default x-scheme-handler/http
  2⤵
  PID:2055
- - /usr/bin/dbus-send
    dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
    3⤵
    - Reads runtime system information
    PID:2056
  - - /usr/bin/dbus-launch
      dbus-launch --autolaunch 36e6eb39a6fa405996e79cad2731865d --binary-syntax --close-stderr
      4⤵
      PID:2057
- - /usr/bin/xprop
    xprop -root _DT_SAVE_MODE
    3⤵
    PID:2058
- - /usr/bin/grep
    grep " = \\\"xfce4\\\"\$"
    3⤵
    - Reads runtime system information
    PID:2059
- - /usr/bin/xprop
    xprop -root
    3⤵
    PID:2060
- - /usr/bin/grep
    grep -i "^xfce_desktop_window"
    3⤵
    - Reads runtime system information
    PID:2061
- - /usr/bin/grep
    grep -q "^Enlightenment"
    3⤵
    - Reads runtime system information
    PID:2063
- - /usr/bin/uname
    uname
    3⤵
    PID:2064
- - /usr/bin/sed
    sed "s/:/ /g"
    3⤵
    - Reads runtime system information
    PID:2067
- - /usr/bin/grep
    grep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
    3⤵
    - Reads runtime system information
    PID:2069
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:2071
- - /usr/bin/head
    head -n 1
    3⤵
    PID:2070
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:2072
- - /usr/bin/head
    head -n 1
    3⤵
    PID:2075
- - /usr/bin/grep
    grep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
    3⤵
    PID:2074
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:2077
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:2076
- - /usr/bin/head
    head -n 1
    3⤵
    PID:2080
- - /usr/bin/grep
    grep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
    3⤵
    - Reads runtime system information
    PID:2079
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:2081
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:2082
- - /usr/bin/grep
    grep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
    3⤵
    - Reads runtime system information
    PID:2084
- - /usr/bin/head
    head -n 1
    3⤵
    PID:2085
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:2086
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:2087
- - /usr/bin/grep
    grep "x-scheme-handler/http=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache
    3⤵
    - Reads runtime system information
    PID:2089
- - /usr/bin/head
    head -n 1
    3⤵
    PID:2090
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:2091
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:2092
- /usr/bin/sed
  sed "s/:/ /g"
  2⤵
  - Reads runtime system information
  PID:2098
- /usr/bin/sed
  sed -e "s|-|/|"
  2⤵
  - Reads runtime system information
  PID:2101
- /usr/bin/sed
  sed -e "s|-|/|"
  2⤵
  - Reads runtime system information
  PID:2104
- /usr/bin/cut
  cut "-d=" -f 2-
  2⤵
  PID:2109
- /usr/bin/which
  which firefox
  2⤵
  PID:2116
- /usr/bin/cut
  cut "-d=" -f 2-
  2⤵
  PID:2119
- /usr/bin/cut
  cut "-d=" -f 2-
  2⤵
  PID:2122
- /usr/bin/cut
  cut "-d=" -f 2-
  2⤵
  PID:2127
- /usr/bin/cut
  cut "-d=" -f 2-
  2⤵
  PID:2130
- /usr/bin/firefox
  /usr/bin/firefox http://google.com
  2⤵
  PID:2131
- /usr/lib/firefox/firefox-bin
  /usr/bin/firefox http://google.com
  2⤵
  - Checks hardware identifiers (DMI)
  - Reads hardware information
  - Changes its process name
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:2131
- - /usr/lib/firefox/crashhelper
    /usr/lib/firefox/crashhelper 2131 9 /tmp/ 11
    3⤵
    PID:2135
- - /usr/local/sbin/dbus-launch
    dbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr
    3⤵
    PID:2140
- - /usr/local/bin/dbus-launch
    dbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr
    3⤵
    PID:2140
- - /usr/sbin/dbus-launch
    dbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr
    3⤵
    PID:2140
- - /usr/bin/dbus-launch
    dbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr
    3⤵
    PID:2140
- - /usr/lib/firefox/glxtest
    /usr/lib/firefox/glxtest -f 18
    3⤵
    - Changes its process name
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:2144
- - /usr/lib/firefox/firefox-bin
    /usr/lib/firefox/firefox-bin -contentproc -ipcHandle 0 -signalPipe 1 -initialChannelId "{4be3af4c-5c88-4ea2-b597-6e3b49291b94}" -parentPid 2131 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser 1 forkserver
    3⤵
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:2183

/usr/libexec/gvfsd-fuse
/usr/libexec/gvfsd-fuse /root/.gvfs -f
1⤵
- Reads runtime system information
PID:2238

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

events

Path /root/.config/mozilla/firefox/fq58mci9.default-release/datareporting/glean/events/events
Size 2KB
SHA256 25c3e663db13b25d0cae0764d87a22179600a78a080c569e77404f2136f1ad71
MD5 8792f0b0b7dc69fa5516dcdd4ed852c8
SHA1 265302e16a2320ba6c24d3676f868cb73fb0bc47
SHA512 1bfbfda5877ed2fcf4f3f5f42f4dd6a294ae6ef5d619b024ed3ea73599c9d9d5817b7a1c527728fd7e21d5c1504858b1923dfa146101bc484d30a4e1ed80dc81
TLSH
T1AB51674D3BB58DBADED7F39C2490838AA3254A5799122D435D21EFCDCE806D6325943C
MD5 SHA1 SHA512 TLSH

Submit Download

199e50c1-1907-4374-82e2-d1622324d259

Path /root/.config/mozilla/firefox/fq58mci9.default-release/datareporting/glean/tmp/199e50c1-1907-4374-82e2-d1622324d259
Size 368B
SHA256 c87a34be01b55a54dae3e70a838dd96e06ecbd89fb47ee297062da2daea28ee0
MD5 5cd2516b985aa7d1c6f6eafcb3b26a50
SHA1 e9898c2d3e6978c81a80b6398c186d8273715f53
SHA512 72985c63330c085cb58ac27b4ef68fe3c35410648056fd8096b0c80a25d7d15cf05953a72dc04a854074e1d15b0e3b89e08aee4ff04436a727799c9dc61d1608
TLSH
T1C5E06899D0B09215AE90D61AE89419014BECF803E49640B1A9B062AD8AEA4CCC2F322F
MD5 SHA1 SHA512 TLSH

Submit Download

3b8e114c-7df6-4529-86a1-b03f989cc7d2

Path /root/.config/mozilla/firefox/fq58mci9.default-release/datareporting/glean/tmp/3b8e114c-7df6-4529-86a1-b03f989cc7d2
Size 4KB
SHA256 bcdadd7a3adffae183a033a784a959e78ffb3a7ee126917188459612980d5762
MD5 42dcd74b30420a2313a410a25de1c9c1
SHA1 e2ee8859eb76288a1493dfebc6699243358694e1
SHA512 f58f632e85d5d256437818c911029c59a3ea9ab2e6b818813bcfb8fce77f6615cfb837053ea52cbf4cb0886f3a5fd273cf168b1803798703142dd01912a8bad1
SSDEEP 48:nUCIbKN8WmoUCx1uJBUg3jAW60zAXISA0RU4KAba9A9qs/TAgZhALwY3MA7aXQ:oKmWcNJP3jh/AXJA0EAbAAUsLA6AUxAx
TLSH
T119918C144429B87CD89AD7A2CBB37F8387785736B089B51CFCEE450656EB192123600B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5323221a-1e81-4029-8839-44048c8dc137

Path /root/.config/mozilla/firefox/fq58mci9.default-release/datareporting/glean/tmp/5323221a-1e81-4029-8839-44048c8dc137
Size 1023B
SHA256 2dd0d7f06f2e2b68a886bc5582c1cf3148bb0c818a6c594e82b6702ea339f6f3
MD5 380cffbb6bce51ede4bc8ae6ec681e6c
SHA1 8e26003b9cd92af3f5c9316864069a8508930385
SHA512 2893a9f79443ec9d3860420f5dd56ebfcf8af47e05534b3f6f20f21351edacbd651031f475cb556d2a993e6f7c5d62c11f51c964f52a02f50b18896afdab0a87
TLSH
T199116591C530BAB38F94E24BC9D17A438BB4E12780C758783CD1960C4DAF61EA3B360B
MD5 SHA1 SHA512 TLSH

Submit Download

6962043e-f908-4891-9e73-fe81c3607a8a

Path /root/.config/mozilla/firefox/fq58mci9.default-release/datareporting/glean/tmp/6962043e-f908-4891-9e73-fe81c3607a8a
Size 9KB
SHA256 6d851ec936c4994c2fd2eeac1e7545b783d62c012d368cd4beb11f1ad4fdbb35
MD5 16b4ff218e24ecc41ce858798a0ea4d7
SHA1 3ae62a80323d3117bb417c85f58eee0e35f6d656
SHA512 d636b7bc1f033e6d4cdc4bb01cf4ed99924f7785c3a708b90b4e12bd3f99c79dc52c1b104f15b4ef159a4a1ec10b98084fc1ededb763170b01c61f87dbf37253
SSDEEP 192:MbvbMb6bgY1gboPbaR20JRXsLFyWUKdlihxgcvJdXqU4MX+JWer7r6WA2w17:MLoueUPeR20JRXsLFyW/dliPgcx1qU/L
TLSH
T16022CB2840149CBDC9D6E3A6D9323F438BB81623609F7D5CEDDD891923FF996036541B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7f2c5413-98eb-46a6-8d11-ba9bdbe848b8

Path /root/.config/mozilla/firefox/fq58mci9.default-release/datareporting/glean/tmp/7f2c5413-98eb-46a6-8d11-ba9bdbe848b8
Size 1KB
SHA256 13a275ef8690bdc425de6bb85811863e61c7734d93118cd2b95748af5345a8d4
MD5 a5ac2d322312a955480651af1cb34983
SHA1 625a70ba20e14ca7321a3e393c2c6224c7fe440d
SHA512 fc3bb1c508cda3507898ca72abf8d464655d5dd36d318a84eac0365af167c6f6e23b71822491251e108177f674f88f8f80504995db8b3ec27dd9e6f9f4c24d2d
TLSH
T13131EB012D7059A99E84D0868851BD8B8BEC6237608F8A703ED6DE0CC629E1F73DF903
MD5 SHA1 SHA512 TLSH

Submit Download

becc9fbf-a856-4bb9-a6cb-d1af3aaf8ff7

Path /root/.config/mozilla/firefox/fq58mci9.default-release/datareporting/glean/tmp/becc9fbf-a856-4bb9-a6cb-d1af3aaf8ff7
Size 1KB
SHA256 64fbf95f45fffe26a11946d1af615ab6f47458a30a5acd6d507513673f3c64f4
MD5 49934787ec570e41ae263101368882cd
SHA1 53de8394bd0e2a7a0bb6763670bc343f161ce671
SHA512 b695c00076fbe59986f3c5de6ce649305745f8b831b80b983c439a58460cc925b7b48ff07ecb5612ade9f2f09c2e5892a2668b62356878b36ad2ab0c95091d35
TLSH
T1201142909530E9B28ED8D28BC5C476039BB4E22780CA65283DE09E0849AF61E97B7607
MD5 SHA1 SHA512 TLSH

Submit Download

c57ff8ef-83bd-449a-8b8c-70529de2c05e

Path /root/.config/mozilla/firefox/fq58mci9.default-release/datareporting/glean/tmp/c57ff8ef-83bd-449a-8b8c-70529de2c05e
Size 5KB
SHA256 1087fbef40ec586ff53d3e1c1f12b7d0938457546fb862353e89c883ee3ef92d
MD5 6ce6e73c3ae166acad81c0b6aec0dd54
SHA1 6304819dd937de493107c59d7ba0af1abb89b0f6
SHA512 f4bb231b35d2e234d4da08f6acf2886cb5431b5118ac76d8a2d8841126e2e53015ad516ed5eea3318fdc6057aa3396bd9391affdbbec4c2c19b1319231fa9af7
SSDEEP 48:gZUcM/7CI3WEUx7mNAtOKQvxrp1yoUCXXZCTMrmh3yMZVHeOycuh1Iuh1I4hVIcn:gj25WE87meX8ZwAZNWlZjyRftAsF
TLSH
T14EB1215C36B48C7E9CC7F31C5491274A93B28B4B50023D832E85EE8DDD9D789725E43A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d2abafec-bb01-43d9-8287-5858a64fe5ad

Path /root/.config/mozilla/firefox/fq58mci9.default-release/datareporting/glean/tmp/d2abafec-bb01-43d9-8287-5858a64fe5ad
Size 4KB
SHA256 05decda3412688656f89324cb9a51cfe0db83ccac42818f6c5f01c316fa7fc5b
MD5 edefd4753aded0092f4ea5dc8c4e4f31
SHA1 a8faa7a6cd155b64898c7cee980d35391c48ac07
SHA512 508ff891a94f66f4f09c439478242594d8c2ea96a6ab8e592e86329f74e2900b82eda48e96aca8898355f171868cd4d31313da1e74eb3a1d5d4ba587eda105e8
SSDEEP 96:hsEqHWVgqkQM+iA6Sr+Pwb6aEEyqEUCeXjZQrnPK6Qy:lkQM+iA6Sr+PDaEgzZPy
TLSH
T1A99133600A2D54FF370360F0450EBFAE662A93F1B892E47B7C95470D17E515502A1B97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path /root/.config/mozilla/firefox/fq58mci9.default-release/prefs-1.js
Size 6KB
SHA256 6bff4aa661817e8417fe110f8e718bb92cc29ca2d9f9f600f2450d7aa5c03f74
MD5 4715884be7a889a136203cad277ccb54
SHA1 af971de64440fb21e704ea05b33f7baa230e97e8
SHA512 dd8738eba49dc84111e6a7f79744970294731158ca4a8b062266e3dccc3de6866ac2bfcf85ff4559246347edc12bf7d5c24d4626e8cae7dddbb4448a4dc41a17
SSDEEP 96:oc3kF2iqjqGy7zKknkgzGPHzMjw6gb5bdprFj0dNN8cp84Zj:juT7zlk/HzMEp5jOPvp86
TLSH
T1ABD10E3890188F6FA5B23B6CAC6888505972C25FB3BF28C718B54718454CB7891FDAE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path /root/.config/mozilla/firefox/fq58mci9.default-release/prefs-1.js
Size 6KB
SHA256 770ddaab48ea37d175281f2d961db946408987448249e958b26fdad040a775a7
MD5 1804b8fff9d9106d212ea890f066f9bc
SHA1 ec32f372e90e1ce7356dda3b76294f56eaf107c4
SHA512 8dfc7bbf066dd8fe3a99e0123a5fd9e15ffd53e6110357f7db9b0a8ece2501558824ae2b45410d81e904e4e773f8d5c6b1cbc26f93ee278a5af3c405b4e0306a
SSDEEP 96:oc3kF2iqjqGy7zKknkgzGPHz2jw6gb5bdprFj0dNN8cp86Zj:juT7zlk/Hz2Ep5jOPvp8U
TLSH
T132D10F3890188F7FA5B23B6C6C688C505A72C25FB3BF28C715B94618454CB7891FDAE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path /root/.config/mozilla/firefox/fq58mci9.default-release/prefs-1.js
Size 6KB
SHA256 10fa7ff1062b01c28c48315d6bf58f0bd9fd7180fc24d8f98a7da9a2f3f0cbc8
MD5 ac590ba4116e7f76d71319a46d03c44c
SHA1 8b134a07e8d37e3aa62203a72cfe757f5ff0174f
SHA512 e69512757b860017aa3aa5cf5c80413067ecadb6efeaf73cde093174a34e09f5632f3b97df0adf5f52b24ce062b2431db0767db2d8eb5e043e164ca3fe15a587
SSDEEP 96:oc3kF2s9XqjqGy7zKknkgzGPHz2jw6gb5bdprFj0dNN8cp8W8PZj:y96uT7zlk/Hz2Ep5jOPvp83h
TLSH
T110D11F3890188F7FA5B2376C6C688C505A72C25FB3BF28D714B98618454CB7891FDAE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path /root/.config/mozilla/firefox/fq58mci9.default-release/prefs-1.js
Size 6KB
SHA256 6f24d33a3b6472ae9f60ef68433fbba09fba984ec127b91aec62e1c6c5505e42
MD5 91ce314ea0b714547be5a58ca151a971
SHA1 6017fbd4f40b1b23e2cf5b69e6bb428b57840490
SHA512 38a2d67be0e13d3cbea3ba0cde0f033b8a97459feac3911ba777c5b79097666c5ca9db57d07c9fff3a34416d5c1a44267d60aa43dd5d4ad8ed524accf692f55a
SSDEEP 96:oc3kF2s9XqjqGy7zKknkgzGP7tz2jw6gb5bdprFj0dNN8cp8W8KRVZj:y96uT7zlk/7tz2Ep5jOPvp836P
TLSH
T1EDD10F3890188F7FA5B2376C6C6889501A72C25FB3BF28CB14B94618454CB7891FDAE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path /root/.config/mozilla/firefox/fq58mci9.default-release/prefs-1.js
Size 6KB
SHA256 9a99127bf116c219466ac22a547693a2c6857cd3f41147ee7888049155102c14
MD5 236b5ff934824693b18c4eff59651afd
SHA1 48b048ae0605249925e48a8c978d8fc39ad2df99
SHA512 e7c7b86c9b8c8fc87e691fcdc9571e34cca5a9427141ea7353725ea1a5570b52b750ea3d2fae880fcf02047276b0cb0bcb32c577caf68daf176f22fd16763a6b
SSDEEP 96:oc36IF2s9XqjqGy7zKknkgzGP7tz2jw6gb5bdprFj0dNN8cp8L8KRVZj:6+96uT7zlk/7tz2Ep5jOPvp8Y6P
TLSH
T198E11E3890188F7FA5B2376CAC6889501972C25FB3BF28C714B94308554CB7891FDAE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webappsstore.sqlite

Path /root/.config/mozilla/firefox/fq58mci9.default-release/webappsstore.sqlite
Size 96KB
SHA256 d884477ede4c58bb90cccb1552ba8a0eb784ec7e89614d7d37fbf274db078e16
MD5 28265a4276d6806d3b28cbcd8f3cc687
SHA1 a4e22988e4bf9bd4f5923cd3c9f21263850cdc98
SHA512 3f0b156743e8ab892823931a77e2d331436d5a19223993a5abcd8d37378df68ddebc315a74bd07dfbf37e039d49b153f08723026c2d3434ded87dfc15e75c346
SSDEEP 6:ltTo/e/E7R/Wwhm914iDKrvcwTlNCcVWDeNgLu5e3cwOJrheFDEf:D0OE7Rzhm9GiD0c4NCcVUo58cz16D
TLSH
T15AA3D88FCA4813A7DD0083789B461F80EE93585E45C343E238B423CC0AA37440B2F828
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads