Analysis
- max time kernel
0s - max time network
0s - platform
ubuntu-24.04_amd64 - resource
ubuntu2404-amd64-20250619-en - resource tags
arch:amd64arch:i386image:ubuntu2404-amd64-20250619-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system - submitted
05/06/2026, 11:48
Static task
static1
Behavioral task
behavioral1
Sample
my ransomware.py
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
my ransomware.py
Resource
ubuntu2204-amd64-20260513-en
ubuntu-22.04-amd64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
my ransomware.py
Resource
ubuntu2404-amd64-20250619-en
ubuntu-24.04-amd64
2 signatures
150 seconds
General
- Target my ransomware.py
- Size 3KB
- Sample260605-nywebafx7k
- SHA256 f5288be68479ee1217f32a70d854ab3a2b7943141418fa4f4c50fcac2038b032
- MD5 42d3b00912ac93b2c60a487eadd5c898
- SHA1 7ed684f8eeb73c49ccb37ec583990bef0d77b32d
- SHA512 5112215f113c572f581c866ff876a568a7ab0719cf739aa28e2174225c8b7a96ecaf864094aedea14732373e157f45959bba0f40f8e1e0d8cf1a19d76ab0cde5
- TLSH T14271A54ABE8538E087D3E2ECFA39C4C15215F82F970524347BDC6A448F8557115B53BD
- MD5 SHA1 SHA512 TLSH
Score
7/10
Malware Config
Signatures
- Reads user data of web browsers 3 TTPs 47 IoCs
Reads stored browser data which can include saved credentials.
description ioc Process File opened for reading /root/.mozilla/firefox/tuqnl13b.default-release/crashes python3 File opened for reading /root/.mozilla/firefox/tuqnl13b.default-release/security_state python3 File opened for reading /root/.mozilla/firefox/tuqnl13b.default-release/bookmarkbackups python3 File opened for reading /root/.mozilla/firefox/tuqnl13b.default-release/storage/permanent/chrome/idb/2823318777ntouromlalnodry--naod.files python3 File opened for reading /root/.mozilla/firefox/Pending Pings python3 File opened for reading /root/.mozilla/firefox/Crash Reports/events python3 File opened for reading /root/.mozilla/firefox/tuqnl13b.default-release/content-prefs.sqlite python3 File opened for reading /root/.mozilla/firefox/tuqnl13b.default-release/key4.db python3 File opened for reading /root/.mozilla/firefox/tuqnl13b.default-release/favicons.sqlite python3 File opened for reading /root/.mozilla/firefox/tuqnl13b.default-release/domain_to_categories.sqlite python3 File opened for reading /root/.mozilla/firefox/tuqnl13b.default-release/datareporting/glean/db python3 File opened for reading /root/.mozilla/firefox/tuqnl13b.default-release/storage/ls-archive.sqlite python3 File opened for reading /root/.mozilla/firefox/tuqnl13b.default-release/storage/permanent/chrome/idb python3 File opened for reading /root/.mozilla/firefox/Profile Groups python3 File opened for reading /root/.mozilla/firefox/tuqnl13b.default-release/datareporting/glean python3 File opened for reading /root/.mozilla/firefox/tuqnl13b.default-release/datareporting/glean/pending_pings python3 File opened for reading /root/.mozilla/firefox/tuqnl13b.default-release/storage/permanent python3 File opened for reading /root/.mozilla/firefox/tuqnl13b.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.files python3 File opened for reading /root/.mozilla/firefox/tuqnl13b.default-release/storage/permanent/chrome/idb/3561288849sdhlie.files python3 File opened for reading /root/.mozilla/firefox/tuqnl13b.default-release/datareporting/glean/events python3 File opened for reading /root/.mozilla/firefox/tuqnl13b.default-release/storage/permanent/chrome/idb/3561288849sdhlie.sqlite python3 File opened for reading /root/.mozilla/firefox/tuqnl13b.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite python3 File opened for reading /root/.mozilla/firefox/tuqnl13b.default-release/places.sqlite python3 File opened for reading /root/.mozilla/firefox/tuqnl13b.default-release/storage.sqlite python3 File opened for reading /root/.mozilla/firefox/tuqnl13b.default-release/storage/permanent/chrome/idb/2918063365piupsah.sqlite python3 File opened for reading /root/.mozilla/firefox/tuqnl13b.default-release/bounce-tracking-protection.sqlite python3 File opened for reading /root/.mozilla/firefox/tuqnl13b.default-release/cookies.sqlite python3 File opened for reading /root/.mozilla/firefox/tuqnl13b.default-release/pkcs11.txt python3 File opened for reading /root/.mozilla/firefox/tuqnl13b.default-release/datareporting/glean/tmp python3 File opened for reading /root/.mozilla/firefox/tuqnl13b.default-release/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite python3 File opened for reading /root/.mozilla/firefox/tuqnl13b.default-release/extension-store python3 File opened for reading /root/.mozilla/firefox/tuqnl13b.default-release/crashes/events python3 File opened for reading /root/.mozilla/firefox/tuqnl13b.default-release/datareporting python3 File opened for reading /root/.mozilla/firefox/tuqnl13b.default-release/storage python3 File opened for reading /root/.mozilla/firefox/tuqnl13b.default-release/storage/permanent/chrome python3 File opened for reading /root/.mozilla/firefox/tuqnl13b.default-release/storage/permanent/chrome/idb/2823318777ntouromlalnodry--naod.sqlite python3 File opened for reading /root/.mozilla/firefox/tuqnl13b.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite python3 File opened for reading /root/.mozilla/firefox/tuqnl13b.default-release/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.files python3 File opened for reading /root/.mozilla/firefox/tuqnl13b.default-release python3 File opened for reading /root/.mozilla/firefox/tuqnl13b.default-release/minidumps python3 File opened for reading /root/.mozilla/firefox/tuqnl13b.default-release/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.files python3 File opened for reading /root/.mozilla/firefox/tuqnl13b.default-release/storage/permanent/chrome/idb/2918063365piupsah.files python3 File opened for reading /root/.mozilla/firefox/3hf2hc2w.default python3 File opened for reading /root/.mozilla/firefox/Crash Reports python3 File opened for reading /root/.mozilla/firefox/Profile Groups/d1ab27a9.sqlite python3 File opened for reading /root/.mozilla/firefox/tuqnl13b.default-release/cert9.db python3 File opened for reading /root/.mozilla/firefox/tuqnl13b.default-release/permissions.sqlite python3 - Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/master_key.bin python3
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /root/Desktop/SYSTEM_COMPROMISED.txt
- Size 143B
- SHA256 9e5d5719c6ada06d904f93f6e8f7a2de04009305761dfcd396548368f93a9344
- MD5 6db4ea45d0ca03a1f27cd756cd7a12df
- SHA1 97084976cced2cfc08f1471cf146b05c4564b69b
- SHA512 0e6191665c05d40a92adeb5549419d300c1afbd13b40a8919eab0a9ab15da6dc542cb9f6c9411bd7cdbaaba9aaf4981d1ed037124e65cb46e73cc10a26204094
- TLSH T1A3C02BC36FC838201D43B4CE3103F0D83020F00C45F2891F249CA09C54984F417C3934
- MD5 SHA1 SHA512 TLSH
- Path /tmp/master_key.bin
- Size 16B
- SHA256 11b245509404bf7ba24e7637bc4bdfa658792810d525ee862e440acd677ee81e
- MD5 8a37cb8bbac655353d2dd1f1b533d842
- SHA1 542aaaf0d8f6287d52f23f21a7c99cc9080ab7d9
- SHA512 5d171189968919459758c8a3e47a7c214d28f3370046abba8fb440ae0748e3dff10cbb5c0ef64407c6c7c2ea93202f1587435728fd356a893fbe9feabc39bb0e
- MD5 SHA1 SHA512