Analysis
- max time kernel
149s - max time network
150s - platform
ubuntu-22.04_amd64 - resource
ubuntu2204-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20260513-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system - submitted
04/07/2026, 17:04
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://traerita.lat/gts
Resource
android-35-x64-arm64-20260325-en
android-15-x64
2 signatures
150 seconds
Malware Config
Signatures
- Checks hardware identifiers (DMI) 1 TTPs 1 IoCs
Checks DMI information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /sys/devices/virtual/dmi/id/product_name firefox-bin - Reads hardware information 1 TTPs 1 IoCs
Accesses system info like serial numbers, manufacturer names etc.
description ioc Process File opened for reading /sys/devices/virtual/dmi/id/product_sku firefox-bin - Changes its process name 64 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself AsyncSi~lThread 1706 firefox-bin Changes the process name, possibly in an attempt to hide itself gmain 1710 firefox-bin Changes the process name, possibly in an attempt to hide itself pool 1712 firefox-bin Changes the process name, possibly in an attempt to hide itself gdbus 1713 firefox-bin Changes the process name, possibly in an attempt to hide itself glean.dispatche 1714 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 1716 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 1716 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 1716 firefox-bin Changes the process name, possibly in an attempt to hide itself Backgro~Pool #1 1721 firefox-bin Changes the process name, possibly in an attempt to hide itself Backgro~Pool #1 1721 firefox-bin Changes the process name, possibly in an attempt to hide itself IPDL Background 1720 firefox-bin Changes the process name, possibly in an attempt to hide itself IPDL Background 1720 firefox-bin Changes the process name, possibly in an attempt to hide itself Socket Thread 1719 firefox-bin Changes the process name, possibly in an attempt to hide itself Socket Thread 1719 firefox-bin Changes the process name, possibly in an attempt to hide itself Netlink Monitor 1718 firefox-bin Changes the process name, possibly in an attempt to hide itself Netlink Monitor 1718 firefox-bin Changes the process name, possibly in an attempt to hide itself Timer 1717 firefox-bin Changes the process name, possibly in an attempt to hide itself Timer 1717 firefox-bin Changes the process name, possibly in an attempt to hide itself [pango] FcInit 1722 firefox-bin Changes the process name, possibly in an attempt to hide itself glxtest:disk$0 1728 glxtest Changes the process name, possibly in an attempt to hide itself HTML5 Parser 1730 firefox-bin Changes the process name, possibly in an attempt to hide itself HTML5 Parser 1730 firefox-bin Changes the process name, possibly in an attempt to hide itself JS Watchdog 1732 firefox-bin Changes the process name, possibly in an attempt to hide itself JS Watchdog 1732 firefox-bin Changes the process name, possibly in an attempt to hide itself dconf worker 1729 firefox-bin Changes the process name, possibly in an attempt to hide itself BGReadURLs 1733 firefox-bin Changes the process name, possibly in an attempt to hide itself BGReadURLs 1733 firefox-bin Changes the process name, possibly in an attempt to hide itself Cache2 I/O 1734 firefox-bin Changes the process name, possibly in an attempt to hide itself Cache2 I/O 1734 firefox-bin Changes the process name, possibly in an attempt to hide itself Cookie 1735 firefox-bin Changes the process name, possibly in an attempt to hide itself Cookie 1735 firefox-bin Changes the process name, possibly in an attempt to hide itself TaskCon~ller #1 1737 firefox-bin Changes the process name, possibly in an attempt to hide itself StreamTrans #1 1738 firefox-bin Changes the process name, possibly in an attempt to hide itself StreamTrans #1 1738 firefox-bin Changes the process name, possibly in an attempt to hide itself TaskCon~ller #0 1736 firefox-bin Changes the process name, possibly in an attempt to hide itself BgIOThr~Pool #1 1739 firefox-bin Changes the process name, possibly in an attempt to hide itself BgIOThr~Pool #1 1739 firefox-bin Changes the process name, possibly in an attempt to hide itself Worker Launcher 1740 firefox-bin Changes the process name, possibly in an attempt to hide itself Worker Launcher 1740 firefox-bin Changes the process name, possibly in an attempt to hide itself QuotaManager IO 1741 firefox-bin Changes the process name, possibly in an attempt to hide itself QuotaManager IO 1741 firefox-bin Changes the process name, possibly in an attempt to hide itself Softwar~cThread 1742 firefox-bin Changes the process name, possibly in an attempt to hide itself Softwar~cThread 1742 firefox-bin Changes the process name, possibly in an attempt to hide itself Softwar~cThread 1742 firefox-bin Changes the process name, possibly in an attempt to hide itself CanvasRenderer 1748 firefox-bin Changes the process name, possibly in an attempt to hide itself CanvasRenderer 1748 firefox-bin Changes the process name, possibly in an attempt to hide itself Compositor 1747 firefox-bin Changes the process name, possibly in an attempt to hide itself Compositor 1747 firefox-bin Changes the process name, possibly in an attempt to hide itself Glyph rasterize 1746 firefox-bin Changes the process name, possibly in an attempt to hide itself WrGlyph~terizer 1746 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorkerLP#0 1745 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorker#0 1744 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorkerLP#0 1745 firefox-bin Changes the process name, possibly in an attempt to hide itself Renderer 1743 firefox-bin Changes the process name, possibly in an attempt to hide itself Renderer 1743 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorker#0 1744 firefox-bin Changes the process name, possibly in an attempt to hide itself ImageIO 1749 firefox-bin Changes the process name, possibly in an attempt to hide itself ImageIO 1749 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC Launch 1750 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC Launch 1750 firefox-bin Changes the process name, possibly in an attempt to hide itself Permission 1752 firefox-bin Changes the process name, possibly in an attempt to hide itself Permission 1752 firefox-bin Changes the process name, possibly in an attempt to hide itself forkserver 1751 firefox-bin Changes the process name, possibly in an attempt to hide itself SandboxReporter 1753 firefox-bin - Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo firefox-bin - Reads CPU attributes 1 TTPs 9 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/cpu0/cpu_capacity glxtest File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/size firefox-bin File opened for reading /sys/devices/system/cpu/present firefox-bin File opened for reading /sys/devices/system/cpu/present firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/cpu_capacity xdg-desktop-portal-gnome File opened for reading /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/size firefox-bin File opened for reading /sys/devices/system/cpu/possible firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/topology/core_cpus firefox-bin - Enumerates kernel/hardware configuration 1 TTPs 41 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/devices/system/cpu firefox-bin File opened for reading /sys/devices/pci0000:00/0000:00:02.0/virtio0/drm/renderD128 firefox-bin File opened for reading /sys/devices/system/node firefox-bin File opened for reading /sys/bus/pci/devices/0000:00:03.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:03.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:06.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:04.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:04.0/vendor glxtest File opened for reading /sys/module/apparmor/parameters/enabled dbus-daemon File opened for reading /sys/kernel/security/apparmor/features/dbus/mask dbus-daemon File opened for reading /sys/bus/pci/devices/0000:00:01.1/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.3/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:00.0/device glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0 firefox-bin File opened for reading /sys/devices/system/node/node0/meminfo firefox-bin File opened for reading /sys/bus/pci/devices/0000:00:05.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.3/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:05.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:02.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.3/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:04.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.0/class glxtest File opened for reading /sys/devices/system/cpu glxtest File opened for reading /sys/fs/cgroup/system.slice/agent.service/cpu.max firefox-bin File opened for reading /sys/fs/cgroup/system.slice/agent.service/cpu.max firefox-bin File opened for reading /sys/bus/pci/devices glxtest File opened for reading /sys/bus/pci/devices/0000:00:06.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.1/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:00.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:00.0/class glxtest File opened for reading /sys/devices/system/cpu xdg-desktop-portal-gnome File opened for reading /sys/devices/pci0000:00/0000:00:02.0/virtio0/drm/card0 firefox-bin File opened for reading /sys/bus/pci/devices/0000:00:05.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:02.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:02.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.0/device glxtest File opened for reading /sys/devices/system/cpu firefox-bin File opened for reading /sys/bus/pci/devices/0000:00:06.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.1/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:03.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.0/vendor glxtest -
description ioc Process File opened for reading /proc/self/maps grep File opened for reading /proc/filesystems sed File opened for reading /proc/self/stat firefox-bin File opened for reading /proc/self/fd/42 firefox-bin File opened for reading /proc/self/cmdline firefox-bin File opened for reading /proc/self/fd firefox-bin File opened for reading /proc/self/fd/70 firefox-bin File opened for reading /proc/1634/cmdline dbus-daemon File opened for reading /proc/filesystems xdg-desktop-portal-gnome File opened for reading /proc/1791/cmdline dbus-daemon File opened for reading /proc/self/maps grep File opened for reading /proc/filesystems sed File opened for reading /proc/filesystems firefox-bin File opened for reading /proc/1777/cmdline dbus-daemon File opened for reading /proc/self/task/1834/stat firefox-bin File opened for reading /proc/self/task/1939/stat firefox-bin File opened for reading /proc/filesystems sed File opened for reading /proc/self/cgroup firefox-bin File opened for reading /proc/self/task/1920/stat firefox-bin File opened for reading /proc/1613/cmdline dbus-daemon File opened for reading /proc/filesystems sed File opened for reading /proc/self/mountinfo firefox-bin File opened for reading /proc/filesystems gvfsd-fuse File opened for reading /proc/1618/status dbus-daemon File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/fd/39 firefox-bin File opened for reading /proc/self/fd/44 firefox-bin File opened for reading /proc/1759/cmdline dbus-daemon File opened for reading /proc/1799/cmdline dbus-daemon File opened for reading /proc/1804/cmdline dbus-daemon File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/task/1763/stat firefox-bin File opened for reading /proc/self/fd/43 firefox-bin File opened for reading /proc/filesystems gnome-keyring-daemon File opened for reading /proc/1824/cmdline dbus-daemon File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/task/1846/stat firefox-bin File opened for reading /proc/self/task/1922/stat firefox-bin File opened for reading /proc/self/fd/120 firefox-bin File opened for reading /proc/self/task/1704/stat firefox-bin File opened for reading /proc/1756/cmdline dbus-daemon File opened for reading /proc/filesystems xdg-desktop-portal-gtk File opened for reading /proc/self/cgroup firefox-bin File opened for reading /proc/1703/cgroup xdg-desktop-portal File opened for reading /proc/1/cgroup xdg-desktop-portal File opened for reading /proc/self/fd/103 firefox-bin File opened for reading /proc/self/maps grep File opened for reading /proc/mounts dbus-daemon File opened for reading /proc/filesystems gvfsd File opened for reading /proc/sys/kernel/cap_last_cap dbus-daemon File opened for reading /proc/filesystems sed File opened for reading /proc/self/fd dbus-send File opened for reading /proc/self/fd/17 firefox-bin File opened for reading /proc/filesystems firefox-bin File opened for reading /proc/filesystems xdg-document-portal File opened for reading /proc/1815/cmdline dbus-daemon File opened for reading /proc/self/mountinfo firefox-bin File opened for reading /proc/filesystems dbus-daemon File opened for reading /proc/filesystems xdg-desktop-portal File opened for reading /proc/self/maps firefox-bin File opened for reading /proc/1766/cmdline dbus-daemon - Writes file to tmp directory 3 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/firefox/.parentlock firefox-bin File opened for modification /tmp/tmp-uc6.xpi firefox-bin File opened for modification /tmp/tmpaddon firefox-bin
Processes
-
/usr/bin/xdg-openxdg-open https://traerita.lat/gts1⤵PID:1612
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager2⤵PID:1613
-
/usr/bin/dbus-launchdbus-launch --autolaunch f2de92a803c744e586bd87567a26b68a --binary-syntax --close-stderr3⤵PID:1614
-
/usr/bin/dbus-daemon/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session4⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1616 -
/usr/libexec/xdg-desktop-portal/usr/libexec/xdg-desktop-portal5⤵
- Reads runtime system information
PID:1756
-
-
/usr/libexec/at-spi-bus-launcher/usr/libexec/at-spi-bus-launcher5⤵PID:1759
-
-
/usr/libexec/xdg-document-portal/usr/libexec/xdg-document-portal5⤵
- Reads runtime system information
PID:1766 -
/usr/bin/fusermount3fusermount3 -o "rw,nosuid,nodev,fsname=portal,auto_unmount,subtype=portal" -- /root/.cache/doc6⤵PID:1785
-
-
-
/usr/libexec/xdg-permission-store/usr/libexec/xdg-permission-store5⤵PID:1777
-
-
/usr/libexec/xdg-desktop-portal-gnome/usr/libexec/xdg-desktop-portal-gnome5⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1791
-
-
/usr/libexec/gvfsd/usr/libexec/gvfsd5⤵
- Reads runtime system information
PID:1799
-
-
/usr/libexec/xdg-desktop-portal-gtk/usr/libexec/xdg-desktop-portal-gtk5⤵
- Reads runtime system information
PID:1815
-
-
/usr/bin/gnome-keyring-daemon/usr/bin/gnome-keyring-daemon --start --foreground "--components=secrets"5⤵
- Reads runtime system information
PID:1824
-
-
-
-
-
/usr/bin/grepgrep " = \\\"xfce4\\\"\$"2⤵
- Reads runtime system information
PID:1620
-
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE2⤵PID:1619
-
-
/usr/bin/grepgrep -i "^xfce_desktop_window"2⤵PID:1622
-
-
/usr/bin/xpropxprop -root2⤵PID:1621
-
-
/usr/bin/grepgrep -q "^Enlightenment"2⤵
- Reads runtime system information
PID:1624
-
-
/usr/bin/unameuname2⤵PID:1625
-
-
/usr/bin/grepgrep -q "^file://"2⤵
- Reads runtime system information
PID:1627
-
-
/usr/bin/egrepegrep -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1629
-
-
/usr/local/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1629
-
-
/usr/local/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1629
-
-
/usr/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:1629
-
-
/usr/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
- Reads runtime system information
PID:1629
-
-
/usr/bin/sedsed -n "s/\\(^[[:alnum:]+\\.-]*\\):.*\$/\\1/p"2⤵
- Reads runtime system information
PID:1632
-
-
/usr/bin/xdg-mimexdg-mime query default x-scheme-handler/https2⤵PID:1633
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager3⤵
- Reads runtime system information
PID:1634 -
/usr/bin/dbus-launchdbus-launch --autolaunch f2de92a803c744e586bd87567a26b68a --binary-syntax --close-stderr4⤵PID:1635
-
-
-
/usr/bin/grepgrep " = \\\"xfce4\\\"\$"3⤵
- Reads runtime system information
PID:1637
-
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE3⤵PID:1636
-
-
/usr/bin/grepgrep -i "^xfce_desktop_window"3⤵
- Reads runtime system information
PID:1639
-
-
/usr/bin/xpropxprop -root3⤵PID:1638
-
-
/usr/bin/grepgrep -q "^Enlightenment"3⤵PID:1641
-
-
/usr/bin/unameuname3⤵PID:1642
-
-
/usr/bin/sedsed "s/:/ /g"3⤵
- Reads runtime system information
PID:1645
-
-
/usr/bin/headhead -n 13⤵PID:1648
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:1650
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:1649
-
-
/usr/bin/grepgrep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵
- Reads runtime system information
PID:1647
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:1655
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:1654
-
-
/usr/bin/headhead -n 13⤵PID:1653
-
-
/usr/bin/grepgrep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵
- Reads runtime system information
PID:1652
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:1660
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:1659
-
-
/usr/bin/headhead -n 13⤵PID:1658
-
-
/usr/bin/grepgrep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵PID:1657
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:1665
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:1664
-
-
/usr/bin/headhead -n 13⤵PID:1663
-
-
/usr/bin/grepgrep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵
- Reads runtime system information
PID:1662
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:1670
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:1669
-
-
/usr/bin/headhead -n 13⤵PID:1668
-
-
/usr/bin/grepgrep "x-scheme-handler/https=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache3⤵PID:1667
-
-
-
/usr/bin/sedsed "s/:/ /g"2⤵
- Reads runtime system information
PID:1673
-
-
/usr/bin/sedsed -e "s|-|/|"2⤵
- Reads runtime system information
PID:1676
-
-
/usr/bin/sedsed -e "s|-|/|"2⤵
- Reads runtime system information
PID:1679
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:1684
-
-
/usr/bin/whichwhich firefox2⤵PID:1685
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:1688
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:1694
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:1699
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:1702
-
-
/usr/bin/firefox/usr/bin/firefox https://traerita.lat/gts2⤵PID:1703
-
-
/usr/lib/firefox/firefox-bin/usr/bin/firefox https://traerita.lat/gts2⤵
- Checks hardware identifiers (DMI)
- Reads hardware information
- Changes its process name
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
PID:1703 -
/usr/lib/firefox/crashhelper/usr/lib/firefox/crashhelper 1703 9 /tmp/ 113⤵PID:1707
-
-
/usr/local/sbin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr3⤵PID:1711
-
-
/usr/local/bin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr3⤵PID:1711
-
-
/usr/sbin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr3⤵PID:1711
-
-
/usr/bin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr3⤵PID:1711
-
-
/usr/lib/firefox/glxtest/usr/lib/firefox/glxtest -f 183⤵
- Changes its process name
- Reads CPU attributes
- Enumerates kernel/hardware configuration
PID:1715
-
-
/usr/lib/firefox/firefox-bin/usr/lib/firefox/firefox-bin -contentproc -ipcHandle 0 -signalPipe 1 -initialChannelId "{4a74784f-17fa-4297-bf9a-e5781bd8c157}" -parentPid 1703 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser 1 forkserver3⤵
- Changes its process name
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1751
-
-
-
/usr/libexec/gvfsd-fuse/usr/libexec/gvfsd-fuse /root/.cache/gvfs -f1⤵
- Reads runtime system information
PID:1804
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /root/.config/mozilla/firefox/3v0dnlub.default-release/datareporting/glean/events/events
- Size 5KB
- SHA256 c1e5e26ad20d3011c6b231c784b26306876539b1ad76889d6a5726aac4cb3f32
- MD5 2052453a382efac302487509fafe2144
- SHA1 7bbdce012a2f17258c6de0ccebed0491daebaccf
- SHA512 95ac4caf7eb5a344fe0342be4a960ae54a7ee7ddc3777314efef28d0ce46d5574d9623f6a176515bde67096adc8944d4323054e87e1cb184b98cd451562f2a76
- SSDEEP 96:K/2+VFwA5K/4uwMT/4Vs3AZVY7GI0MDnzI:Ke+Vmt/B/0cF0MDnzI
- TLSH T1FBB1AF4C67BD8CBEAC97F2DCB480038ED3494B4789571D431C52EE8ACE9968E311A57E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/3v0dnlub.default-release/datareporting/glean/events/nimbus-targeting-context
- Size 50KB
- SHA256 f5ec1dbfabd3a122e7027a3a96e701c11329fdcd5175e9df23493b58df4dec0b
- MD5 2b359636a2aaa0944e771f0b9c749421
- SHA1 8788a4def524fc63cfba31ff87f4e5bf4fcedfad
- SHA512 950e16997ac5f45e0394598aa445f8c95a37c7409271f2725e398626243a64269932fea713dfb8e81abb6625f3f239b92e6ebba3a5cf07191da2556761d09f26
- SSDEEP 1536:0HwGbMD7vc4kjLEbQn/L18GWUruh/EqywlMR+yCb3wWBTldvdxHmSsGrqgLY3B0A:gGC
- TLSH T1FA333FCC216418AE3E87C3AD95C403BAAFDA4F82155B18931D8AED6DCE5C968713D07F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/3v0dnlub.default-release/datareporting/glean/tmp/20ce0473-f623-4bdf-85c6-8b3f14c6c015
- Size 4KB
- SHA256 750f82656c1f819e18fbe7336ee0c6f2fceea0ed8e92ec6bd66a224f83caaf1d
- MD5 06af37e222977868f111c941cb7b44bc
- SHA1 f43074d266893a28ed6a0f58a00c9b47501b23c1
- SHA512 eb616aa82429fc6a68fef43f33b82899a68c5d7c56e293d48afe302fae696715db52def26d2e1ab40f333627a19a5ec19691556c285ed6dd9aa16970e561a508
- SSDEEP 96:fzSJ8ehWEPT4ivrfn5BKwv3CB1yYPNpD+1cJqrxJrUYlWaMO3FH9Tr:7YwP4D3J9Tr
- TLSH T117A1E1E4246008167EF3E6BED8C027B3C71F959580C504562E21DD6EE7EDA0C52A3F9B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/3v0dnlub.default-release/datareporting/glean/tmp/27883773-0495-427b-9906-6a59c027f756
- Size 4KB
- SHA256 ceb14983d1694b0f523da355a37ac1c61bfa89c8316ff03bdf12b446539b4dd7
- MD5 c52c5fe28c9d816c7f987a9de6df1538
- SHA1 ebf6ff0b5dfb52257b6933c65613dcca4c092de6
- SHA512 2475020cf033778504c86874e95a2d936f1a31207aefe3cec6f9f7eba6e68a81e96364a895a010feb433a55c229f14acdbf4f96d79b6de39f37547a9d4b03f15
- SSDEEP 96:YFJhqrTYPN1cDJnfKw4vHeCBvrB1i5WEU3y+xJrPG7DFWrP/FlnIq:YFBPf6UP/jIq
- TLSH T1F391B3E4246059163DE3D67EE9C027B2C61F85D6C0C114565D11CE6FABEE60C51B3F8B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/3v0dnlub.default-release/datareporting/glean/tmp/2e9d685c-5eb5-49d4-8e66-f86d12280427
- Size 21KB
- SHA256 06487451474503dc47adf865d2c0219288e7cfeaf603e7c16715ee87660fa651
- MD5 ed83389ec6a100a4adea23e86f766694
- SHA1 0c68861e76902c3b73d413b2ec7920a985a62cc2
- SHA512 08762f6d657183370d8ab7f218cf0ef2dabc604d43b9f85c282e064c6ee42da813478629476222736a594c207bd7808b991274f91037d620ea0f900e14fc869a
- SSDEEP 192:KrzZPAKUgheJ/DaZvPzh977sGOb9mh/ummSe6Au:QqKU+ee/xuJxu
- TLSH T17CA2EE9C2574481F7ED3D56D9DC103ED925B8A8184C618832E92EE8EDF9CF083356BB6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/3v0dnlub.default-release/datareporting/glean/tmp/33be560f-1890-4765-a054-00582810cf6b
- Size 61KB
- SHA256 3e60500d51f19f07af97b9a1966f2b2d04e60792f1328e30d8212c10aee93611
- MD5 eedbb89499167e4361e767122e89ac2f
- SHA1 ebeb6055da3530b6a66d5075c50a28ad2f09456e
- SHA512 b516d5b9b8c3f03698e8133dbba5a9ddaa0ef9a639b36a8d99b7c713d70e9743863c6ccbd2e036cdfee90ee46d003d0849304c5832ead146cbe555ed8e4edbcc
- SSDEEP 1536:XWP44qjPpFltIkakf4/WenV5wCBBcFC8aYMEZ/NgprpPStxuSBkviDRRH2f6Pvon:/pIN
- TLSH T1F253A0CC256418BE3EC3C6BD94C503BAAFDA8FC2155618931D4AED2ECE5C968713A077
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/3v0dnlub.default-release/datareporting/glean/tmp/39a33a1d-f19e-44f7-9b06-24702b66428c
- Size 637B
- SHA256 9e1f65cb69c43207d6d02ad3f2cfe102d8b18793013c04a665c820021948d7da
- MD5 818903da5358954a13cba6b3f9649c81
- SHA1 0062aa340d945b38f91c2f6c8a3f382633e2d5fb
- SHA512 e96b938359db9df91fa18b64f24c8dc093ed6246ac15ee18921c9a9a513b2fe7965c19e8261e283a3a1b196f7b3c04aa6c4fb4e7dc3dfdb2c5b3d8195876bdf3
- TLSH T1C9F0D8470588E56A88612B4BF2C03F0050790523906AF3ACE0C49A3C7DAF99B92B3B0A
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/3v0dnlub.default-release/datareporting/glean/tmp/3bd09cf6-0fa6-4d02-abc6-b3815c7573f6
- Size 368B
- SHA256 819385d459f83d1fc507f14e0093140f09fa095f634dcdc3a6c6be29d3b2375a
- MD5 54ea4133400c5ceac967d09cd63f0481
- SHA1 55677bf6e88c58dde5c0ec130253a317ba5c011e
- SHA512 94502d01bd7e3377f952cca36184168969a075f1061b57273387af007a9fe9f1733232b522c5398f13e47e099b20f2a29e03b16c49cdf7adacd736b5e385d738
- TLSH T14EE06849B068D212A980D215D8C01D06436CEC03E0AE80BA69F0B95EDBD54CCA1F331E
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/3v0dnlub.default-release/datareporting/glean/tmp/3c982128-c1eb-47b8-9175-cfe65b2360c8
- Size 7KB
- SHA256 b1578636c1fe9d5fabe6dda1a8f33bf97a07289d8aacae13a5e3b270c7c23823
- MD5 aefa98679f67a18cae10b7e1bae2f13c
- SHA1 c6028c4cff7d90c51f8df9967599f3e2efb7d471
- SHA512 46b0eb5f274e3935dcb2fcb6f12c0046f4207a3563217332dbbc9bc3e14e12b08c893372a4ec73ff70538ede6d4b029e67be9fc3f61edfeaa300d798a6e6151e
- SSDEEP 96:azx8fUqrYPNn+3epPDiWyKwJ4vr151chxJrCBTvBEC1WeFpAXJA0EAbGAUsLA6Al:2xLPMYM20J7XsLqWTQu
- TLSH T1AEE123E4042468397CE3D7B6DAE13F93C73F4666E0C52419AC5A8D1B67EF24C1172A4B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/3v0dnlub.default-release/datareporting/glean/tmp/47b82d51-c7db-4277-b156-863aae3d4140
- Size 13KB
- SHA256 7bbde8f1640934243371d7d415789b56a0e1bac2a44e6222c58aebc15f779ffa
- MD5 b575a0a1e85c71faa07a61b863c6ff44
- SHA1 84742e0982cfd305a3564ac633007a3fca64c647
- SHA512 3733715486f6bb17597d23b3326b4f43e98ce6f1cd23a41905fbff1d93f44b4a8f0d9cd3c71bd8c0e964d51091c19c0c98c1872c3e3fdc3c5e73b40063b44920
- SSDEEP 384:/YdBjgyWWeyem20J7XsLqB0MdOrCv8E/MOcot84C:/6JfeWL0OOrsHq
- TLSH T15D52D9B800244C7E6DD3E3B6D9903F53CB7F455290C62859AEDD8D2A73EFA4D026690B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/3v0dnlub.default-release/datareporting/glean/tmp/a25b2327-58e4-4d92-a9a6-ef52c9a2af55
- Size 4KB
- SHA256 0a3fb5d45bdcb3c42fd4356b22a98f803cb53712eefda1fa8472a596c4c3425d
- MD5 1589864430873079ea89d8969060108d
- SHA1 df7b574505a63ab77b637e13d5f1b3561eb5becb
- SHA512 c88d9e1f7c8671c375c2a3a91134ab60090fd54f7bd5bc9f63a24134e65221eb003bc12c8039ee66bb48f53be7df282d4f650bf43aaf9025e2f25faca7bff610
- SSDEEP 96:3+MzdKwD3qrTneECBUpyvrHPxJrJ+4fi1c5BvYPNWheZFWEeP3FInIq:jhCPoP3MIq
- TLSH T1EF91B1F8246009163DE3D67EE9C027B2DA1F89D6C4C114562D11CE6BABEE60C51B3F9B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/3v0dnlub.default-release/datareporting/glean/tmp/d5772982-b02f-4b80-ac66-11d7d88b5278
- Size 637B
- SHA256 280b8136e2160bcf4df23ef4dee673fe65802c922a8cde632d2965ada7c6213a
- MD5 af80f467a42906bd9fd542b6590d3b6d
- SHA1 a1d0739a652b336f015c6aafdd3389900aad2863
- SHA512 8afafdacef7a93005828df7e4f9fbaf7495d500cd13b5b9e6d404ff5caae32b08476ae8dc710dea5d43643796c6f049197f318088464b9fee0a46d464b7929b2
- TLSH T19FF0DD434598E52788506B47B1E43F0050350123506DF3D9E0D097387DAF95B1577B0B
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/3v0dnlub.default-release/prefs-1.js
- Size 7KB
- SHA256 150b1ebecd5b9113483ad347f5be07aace639a2e5f1213e4ed7fbf24552fdfb5
- MD5 73d3200962382c83075a06689b6b5a2a
- SHA1 2f7db6967d8ef8f3834a68a6f86ee70118e21b7b
- SHA512 a07bd14394fd8ceb28b760084cdfd842c30bd2e936abca10e3dd48d7beefecaef55b88674fc5636ef1c048a7c319d06635fb48cfec2d913aa573e983e51ffe98
- SSDEEP 96:oCq/F20qjqpZGL7j8WgzGNWzMj06NNI/AbABF2zm242aA8Yqp8TFiu:huOL7j8W9WzMH+PXUBLaA7qp8Td
- TLSH T128F1846992088FBFA57333BC6C2889510672C15FB7FF28D610BA8718521CB7491F96E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/3v0dnlub.default-release/prefs-1.js
- Size 7KB
- SHA256 d7ece2b7a4a0baa162ae8af35bcabf60a3b81d10eee454267b8fb9f409d9c677
- MD5 edadf3e771da7336c4c30f4491b7ac3b
- SHA1 777e6fe40636cc6d9de910a3af918d37315057ab
- SHA512 f396bdba9c469ef1685a843228839402b92846c4699b5f691d14d5e9ff63c8916d78e7aec69f8235089c05a129fa322b93db1c42a0cafdfa4a957520efdf0ef4
- SSDEEP 96:oCq/F20qjqpZGL7j8WgzGNWz2j06NNI/AbABF2zm242aA8Yqp8NFiu:huOL7j8W9Wz2H+PXUBLaA7qp8Nd
- TLSH T116F1732892088FBFA57337BC6C2889511672C15FB7FF28D610BA8708125CB7491F96E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/3v0dnlub.default-release/prefs-1.js
- Size 7KB
- SHA256 6f046bdcf4d6ccbff89d8c1ecae75bbe5961071c9a8e56c4a007716d354008da
- MD5 592c0fec785eee8bc9e7d2d7f457bf80
- SHA1 a5a570385761c0deb587943ab249d3a3d2beaccb
- SHA512 3918a8e27dfe9766093878bb99445391ef46c9cf69f429b7f0de931d1ad02e51d2fa6c922fe6bf5ee536f7c149d0476de7383b2272897a70e6e7d1cc58d40c09
- SSDEEP 96:oCq/F20qjqpZG17j8WgzGNWz2j06NNI/AbABF2zm242aA8Yqp8NFiu:huO17j8W9Wz2H+PXUBLaA7qp8Nd
- TLSH T131F1736892088FBFA57337BC6C6889501672C15FB7FF28D610BA8708125CB7491F96E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/3v0dnlub.default-release/prefs-1.js
- Size 7KB
- SHA256 c8d4a21ce76f3b4e4cf4b926df86665fe3d03b359a419a5014eba1bb26eea1ce
- MD5 e1a1a0bce793e9379d8f121d68c4408d
- SHA1 7228a7a519badf0bce1daea817b1072faa95d172
- SHA512 d79a90476b3d3b0c6094480552f932563d6e0e853372006b58cf6f77ac608bb008745f878dece352b9a6cf77fb67975b4a51a2fc9f3e2ae4803335c2779bd32c
- SSDEEP 96:oCq/F2EWmqjqpZG17j8WgzGNWz2j06NNI/AbABF2zm242aA8Yqp8NFiu:eSuO17j8W9Wz2H+PXUBLaA7qp8Nd
- TLSH T13AF1736892088FBFA57337BC6C6889501672C15FB7FF28D610BA8708124CB7491F96E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/3v0dnlub.default-release/prefs-1.js
- Size 21KB
- SHA256 57e7d6a114172aada8b74c237cf32c207095896901ba3e0a6269601c946234ea
- MD5 c4b59d79508e398aadafda258e61b6bc
- SHA1 3ecaecc6d760567190b45ef8a20c7ba393aa8063
- SHA512 d2375a5f51b91169b30d9b815a39c0a6f6a8453bed05ed460647f971cb811a2a4d18dd946ecc04189f9694535d0520717bfd20a8a3e0d4385f34be15ae5b3bcc
- SSDEEP 192:wSuQQhaKyoMwpwPoivhI4bH0x634Vrp49Qz8twhhi6WLfIjEpoc7jekEPVKakt9i:fvE18r5d1dxGLo7qpBjf
- TLSH T1C5A2997DC014CA6BE0B206BC6D7A8C726659C11B67BFBCA24DB8C721401D778A2F19D7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/3v0dnlub.default-release/webappsstore.sqlite
- Size 96KB
- SHA256 d2ad70f945aec5eccbf8800c6a183feab8f03f92e2a8eb47b694a3cc32854d17
- MD5 0464ffc40d8ba8081682ff17f5a2e46b
- SHA1 34ca81b39b4f3ab8fbec114eb0e5d39af8da3614
- SHA512 ec4db13962b31d21937d3bcf29fef64fdfe3640e378efacd27a08d3fe4ae7e69b99b88efe92baf49f01d9d5d0131443a0a6999246cd957a180874fd60a9e4d28
- SSDEEP 6:ltTP/E7R/Wwhm914iDKrvcwTlNCcVWDeNgLu5e3cwOJrheFDEf:DrE7Rzhm9GiD0c4NCcVUo58cz16D
- TLSH T1F4A3D88FCA4813A7DD0083789B461F80EE93585E45C343E238B423CC0AA37440B2F828
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /tmp/tmp-uc6.xpi
- Size 1.8MB
- SHA256 b41d68c300767d5bfdc8531a267f42a90193f14b1ec2da80458fa260b19f4aa7
- MD5 81e4bda61b54941a0670cd602f7a7d8f
- SHA1 dfb36a3627fd4ff6f529fc2a8ff7eba7a59581de
- SHA512 185df6c010814bff8102e15827ab31d415ee34b275f6557e1833d75a5b9775f6776fe91f45e35d29b67a997d6f35e00498f7beba5a0a57dfea1f0666e9dc8d23
- SSDEEP 49152:5gu+hmb89QO0Nx6gIWNeF6ccUnjCRM6fiRyHubI/0s:5t3KqxPIcnccucZ/Hu0/0s
- TLSH T1BB95231DD96A80E5CC6760F0994DE0D1E518A691C897BD6F4206B8D8ED908CC1BEFBCF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /tmp/tmpaddon
- Size 575KB
- SHA256 997b6e1c0e07307de3adf5d0d7a3ddc5d81cd522afe675dfdb43154f73f5b0d0
- MD5 2aa72a97657774b1eefabe0490b3c088
- SHA1 17f12db36fc49b9cf38d61ed2dbde55e71b81b85
- SHA512 f5246bf14d038adf4ce0c4360262ab722bc3de4220f047c3d542b4c564074b4877dc8659e3125c5171c749e7ce93f20cc63777eb5e1539e960670cbc5f30ac85
- SSDEEP 12288:UD7rHLJG5x5cHc7eoMyBEcGytXn8X+QmkZyhwQqvQv03IS2XuEKwFPPukAHCmhdt:Y0bc8KoMyBEzyt38X+QmkZUwjvCEgpYB
- TLSH T120C433D510B9A1A62B5FBC2CCD1C2AA38935DCFAF017265EF0BA051FD76267980C0D76
- MD5 SHA1 SHA512 SSDEEP TLSH