hxxps://tria[.]ge/submit

Analysis

user interaction
yes
max time kernel
153s
max time network
129s
platform
ubuntu-24.04_amd64
resource
ubuntu2404-amd64-20260127-en
resource tags

arch:amd64arch:i386image:ubuntu2404-amd64-20260127-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
submitted
04/08/2026, 00:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://tria.ge/submit
Sample260804-a2ap5aab95

Score

6^/10

antivm discovery

Malware Config

Signatures

Checks hardware identifiers (DMI) 1 TTPs 1 IoCs

Checks DMI information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/sys/devices/virtual/dmi/id/product_name	firefox-bin

Reads hardware information 1 TTPs 1 IoCs

Accesses system info like serial numbers, manufacturer names etc.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/virtual/dmi/id/product_sku	firefox-bin

Changes its process name 64 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	AsyncSi~lThread	2138	firefox-bin
Changes the process name, possibly in an attempt to hide itself	gmain	2143	firefox-bin
Changes the process name, possibly in an attempt to hide itself	pool-spawner	2142	firefox-bin
Changes the process name, possibly in an attempt to hide itself	pool	2145	firefox-bin
Changes the process name, possibly in an attempt to hide itself	gdbus	2146	firefox-bin
Changes the process name, possibly in an attempt to hide itself	glean.dispatche	2147	firefox-bin
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	2149	firefox-bin
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	2149	firefox-bin
Changes the process name, possibly in an attempt to hide itself	IPC I/O Parent	2149	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Timer	2150	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Timer	2150	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	2151	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Netlink Monitor	2151	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Socket Thread	2152	firefox-bin
Changes the process name, possibly in an attempt to hide itself	IPDL Background	2153	firefox-bin
Changes the process name, possibly in an attempt to hide itself	IPDL Background	2153	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Socket Thread	2152	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	2154	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Backgro~Pool #1	2154	firefox-bin
Changes the process name, possibly in an attempt to hide itself	pool	2157	firefox-bin
Changes the process name, possibly in an attempt to hide itself	pool-firefox	2158	firefox-bin
Changes the process name, possibly in an attempt to hide itself	glxtest:disk$0	2159	glxtest
Changes the process name, possibly in an attempt to hide itself	dconf worker	2160	firefox-bin
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	2161	firefox-bin
Changes the process name, possibly in an attempt to hide itself	HTML5 Parser	2161	firefox-bin
Changes the process name, possibly in an attempt to hide itself	pool-firefox	2162	firefox-bin
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	2164	firefox-bin
Changes the process name, possibly in an attempt to hide itself	JS Watchdog	2164	firefox-bin
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	2165	firefox-bin
Changes the process name, possibly in an attempt to hide itself	BGReadURLs	2165	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Cache2 I/O	2166	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Cache2 I/O	2166	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Cookie	2167	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Cookie	2167	firefox-bin
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #0	2168	firefox-bin
Changes the process name, possibly in an attempt to hide itself	TaskCon~ller #1	2169	firefox-bin
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	2170	firefox-bin
Changes the process name, possibly in an attempt to hide itself	StreamTrans #1	2170	firefox-bin
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	2172	firefox-bin
Changes the process name, possibly in an attempt to hide itself	StreamTrans #2	2172	firefox-bin
Changes the process name, possibly in an attempt to hide itself	StreamTrans #3	2173	firefox-bin
Changes the process name, possibly in an attempt to hide itself	StreamTrans #3	2173	firefox-bin
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	2171	firefox-bin
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #1	2171	firefox-bin
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #2	2174	firefox-bin
Changes the process name, possibly in an attempt to hide itself	BgIOThr~Pool #2	2174	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Worker Launcher	2175	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Worker Launcher	2175	firefox-bin
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	2176	firefox-bin
Changes the process name, possibly in an attempt to hide itself	QuotaManager IO	2176	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Softwar~cThread	2177	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Softwar~cThread	2177	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Softwar~cThread	2177	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Renderer	2178	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Renderer	2178	firefox-bin
Changes the process name, possibly in an attempt to hide itself	WRWorker#0	2179	firefox-bin
Changes the process name, possibly in an attempt to hide itself	WRWorkerLP#0	2180	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Glyph rasterize	2181	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Compositor	2182	firefox-bin
Changes the process name, possibly in an attempt to hide itself	WrGlyph~terizer	2181	firefox-bin
Changes the process name, possibly in an attempt to hide itself	Compositor	2182	firefox-bin
Changes the process name, possibly in an attempt to hide itself	CanvasRenderer	2183	firefox-bin
Changes the process name, possibly in an attempt to hide itself	CanvasRenderer	2183	firefox-bin
Changes the process name, possibly in an attempt to hide itself	WRWorkerLP#0	2180	firefox-bin

Reads CPU attributes 1 TTPs 6 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/present	firefox-bin
File opened for reading	/sys/devices/system/cpu/possible	firefox-bin
File opened for reading	/sys/devices/system/cpu/possible	firefox-bin
File opened for reading	/sys/devices/system/cpu/possible	glxtest
File opened for reading	/sys/devices/system/cpu/cpu0/cpu_capacity	glxtest
File opened for reading	/sys/devices/system/cpu/present	firefox-bin

Enumerates kernel/hardware configuration 1 TTPs 41 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/device	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/drm/card1	firefox-bin
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/vendor	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/device	glxtest
File opened for reading	/sys/devices/system/node	firefox-bin
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/device	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/uevent	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/subsystem_device	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0	firefox-bin
File opened for reading	/sys/bus/pci/devices/0000:00:04.0/vendor	glxtest
File opened for reading	/sys/kernel/security/apparmor/features/dbus/mask	dbus-daemon
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:06.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/class	glxtest
File opened for reading	/sys/fs/cgroup/system.slice/agent.service/cpu.max	firefox-bin
File opened for reading	/sys/fs/cgroup/system.slice/agent.service/cpu.max	firefox-bin
File opened for reading	/sys/module/apparmor/parameters/enabled	dbus-daemon
File opened for reading	/sys/bus/pci/devices/0000:00:05.0/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:03.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:00.0/vendor	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/vendor	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/device	glxtest
File opened for reading	/sys/devices/pci0000:00/0000:00:02.0/drm/renderD128	firefox-bin
File opened for reading	/sys/bus/pci/devices	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:02.0/class	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.1/vendor	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.3/device	glxtest
File opened for reading	/sys/bus/pci/devices/0000:00:01.0/class	glxtest

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/task/2136/stat	firefox-bin
File opened for reading	/proc/self/task/2193/stat	firefox-bin
File opened for reading	/proc/2192/cmdline	dbus-daemon
File opened for reading	/proc/2233/cmdline	dbus-daemon
File opened for reading	/proc/self/task/2258/comm	xdg-desktop-portal
File opened for reading	/proc/self/fd/58	firefox-bin
File opened for reading	/proc/2044/status	dbus-daemon
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd/57	firefox-bin
File opened for reading	/proc/self/mountinfo	firefox-bin
File opened for reading	/proc/2066/cmdline	dbus-daemon
File opened for reading	/proc/self/fd/17	firefox-bin
File opened for reading	/proc/filesystems	at-spi-bus-launcher
File opened for reading	/proc/self/fd/52	firefox-bin
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd/46	firefox-bin
File opened for reading	/proc/2198/cmdline	dbus-daemon
File opened for reading	/proc/filesystems	xdg-desktop-portal-gtk
File opened for reading	/proc/2244/cmdline	dbus-daemon
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/fd	dbus-send
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/task/2268/stat	firefox-bin
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/stat	firefox-bin
File opened for reading	/proc/filesystems	firefox-bin
File opened for reading	/proc/self/maps	firefox-bin
File opened for reading	/proc/self/status	firefox-bin
File opened for reading	/proc/mounts	dbus-daemon
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/pressure/memory	firefox-bin
File opened for reading	/proc/2135/cmdline	dbus-daemon
File opened for reading	/proc/self/maps	firefox-bin
File opened for reading	/proc/filesystems	xdg-permission-store
File opened for reading	/proc/self/fd/41	firefox-bin
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/sys/kernel/cap_last_cap	dbus-daemon
File opened for reading	/proc/self/fd	dbus-daemon
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/fd/37	firefox-bin
File opened for reading	/proc/2220/cmdline	dbus-daemon
File opened for reading	/proc/self/cgroup	firefox-bin
File opened for reading	/proc/self/fd	dbus-send
File opened for reading	/proc/2038/cmdline	dbus-daemon
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/mountinfo	firefox-bin
File opened for reading	/proc/filesystems	gvfsd-fuse
File opened for reading	/proc/self/fd/67	firefox-bin
File opened for reading	/proc/self/fd/97	firefox-bin
File opened for reading	/proc/filesystems	glxtest
File opened for reading	/proc/filesystems	firefox-bin
File opened for reading	/proc/filesystems	gvfsd
File opened for reading	/proc/self/task/2280/stat	firefox-bin
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/self/cgroup	firefox-bin
File opened for reading	/proc/self/stat	firefox-bin
File opened for reading	/proc/filesystems	xdg-desktop-portal
File opened for reading	/proc/2213/cmdline	dbus-daemon
File opened for reading	/proc/2238/cmdline	dbus-daemon
File opened for reading	/proc/self/fd/94	firefox-bin
File opened for reading	/proc/2044/attr/apparmor/current	dbus-daemon
File opened for reading	/proc/self/maps	grep

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/firefox/.parentlock	firefox-bin

/usr/bin/xdg-open
xdg-open https://tria.ge/submit
1⤵
PID:2037
- /usr/bin/dbus-send
  dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
  2⤵
  - Reads runtime system information
  PID:2038
- - /usr/bin/dbus-launch
    dbus-launch --autolaunch 36e6eb39a6fa405996e79cad2731865d --binary-syntax --close-stderr
    3⤵
    PID:2040
  - - /usr/bin/dbus-daemon
      /usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:2042
    - - /usr/libexec/xdg-desktop-portal
        
        /usr/libexec/xdg-desktop-portal
        5⤵
        Reads runtime system information
        
        PID:2192
    - - /usr/libexec/at-spi-bus-launcher
        
        /usr/libexec/at-spi-bus-launcher
        5⤵
        Reads runtime system information
        
        PID:2198
    - - /usr/libexec/xdg-document-portal
        
        /usr/libexec/xdg-document-portal
        5⤵
        
        PID:2213
      - /usr/bin/fusermount3
        
        fusermount3 -o "rw,nosuid,nodev,fsname=portal,auto_unmount,subtype=portal" -- /root/.cache/doc
        6⤵
        
        PID:2227
    - - /usr/libexec/xdg-permission-store
        
        /usr/libexec/xdg-permission-store
        5⤵
        Reads runtime system information
        
        PID:2220
    - - /usr/libexec/xdg-desktop-portal-gtk
        
        /usr/libexec/xdg-desktop-portal-gtk
        5⤵
        Reads runtime system information
        
        PID:2233
    - - /usr/libexec/gvfsd
        
        /usr/libexec/gvfsd
        5⤵
        Reads runtime system information
        
        PID:2238
      - /usr/libexec/gvfsd-fuse
        
        /usr/libexec/gvfsd-fuse /root/.gvfs -f
        6⤵
        Reads runtime system information
        
        PID:2244
- /usr/bin/grep
  grep " = \\\"xfce4\\\"\$"
  2⤵
  PID:2047
- /usr/bin/xprop
  xprop -root _DT_SAVE_MODE
  2⤵
  PID:2046
- /usr/bin/xprop
  xprop -root
  2⤵
  PID:2052
- /usr/bin/grep
  grep -i "^xfce_desktop_window"
  2⤵
  PID:2053
- /usr/bin/grep
  grep -q "^Enlightenment"
  2⤵
  - Reads runtime system information
  PID:2056
- /usr/bin/uname
  uname
  2⤵
  PID:2057
- /usr/bin/grep
  grep -q "^file://"
  2⤵
  - Reads runtime system information
  PID:2059
- /usr/bin/egrep
  egrep -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:2061
- /usr/local/sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:2061
- /usr/local/bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:2061
- /usr/sbin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  PID:2061
- /usr/bin/grep
  grep -E -q "^[[:alpha:]+\\.\\-]+:"
  2⤵
  - Reads runtime system information
  PID:2061
- /usr/bin/sed
  sed -n "s/\$^[[:alnum:]+\\.-]*\$:.*\$/\\1/p"
  2⤵
  - Reads runtime system information
  PID:2064
- /usr/bin/xdg-mime
  xdg-mime query default x-scheme-handler/https
  2⤵
  PID:2065
- - /usr/bin/dbus-send
    dbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager
    3⤵
    - Reads runtime system information
    PID:2066
  - - /usr/bin/dbus-launch
      dbus-launch --autolaunch 36e6eb39a6fa405996e79cad2731865d --binary-syntax --close-stderr
      4⤵
      PID:2067
- - /usr/bin/grep
    grep " = \\\"xfce4\\\"\$"
    3⤵
    - Reads runtime system information
    PID:2069
- - /usr/bin/xprop
    xprop -root _DT_SAVE_MODE
    3⤵
    PID:2068
- - /usr/bin/xprop
    xprop -root
    3⤵
    PID:2070
- - /usr/bin/grep
    grep -i "^xfce_desktop_window"
    3⤵
    PID:2071
- - /usr/bin/grep
    grep -q "^Enlightenment"
    3⤵
    - Reads runtime system information
    PID:2073
- - /usr/bin/uname
    uname
    3⤵
    PID:2074
- - /usr/bin/sed
    sed "s/:/ /g"
    3⤵
    - Reads runtime system information
    PID:2077
- - /usr/bin/grep
    grep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
    3⤵
    - Reads runtime system information
    PID:2079
- - /usr/bin/head
    head -n 1
    3⤵
    PID:2080
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:2081
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:2082
- - /usr/bin/grep
    grep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache
    3⤵
    - Reads runtime system information
    PID:2084
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:2086
- - /usr/bin/head
    head -n 1
    3⤵
    PID:2085
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:2087
- - /usr/bin/head
    head -n 1
    3⤵
    PID:2090
- - /usr/bin/grep
    grep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
    3⤵
    - Reads runtime system information
    PID:2089
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:2091
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:2092
- - /usr/bin/grep
    grep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache
    3⤵
    - Reads runtime system information
    PID:2095
- - /usr/bin/head
    head -n 1
    3⤵
    PID:2096
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:2097
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:2098
- - /usr/bin/head
    head -n 1
    3⤵
    PID:2103
- - /usr/bin/cut
    cut -d "=" -f 2
    3⤵
    PID:2104
- - /usr/bin/cut
    cut -d ";" -f 1
    3⤵
    PID:2105
- - /usr/bin/grep
    grep "x-scheme-handler/https=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache
    3⤵
    PID:2102
- /usr/bin/sed
  sed "s/:/ /g"
  2⤵
  - Reads runtime system information
  PID:2108
- /usr/bin/sed
  sed -e "s|-|/|"
  2⤵
  - Reads runtime system information
  PID:2111
- /usr/bin/sed
  sed -e "s|-|/|"
  2⤵
  PID:2114
- /usr/bin/cut
  cut "-d=" -f 2-
  2⤵
  PID:2119
- /usr/bin/which
  which firefox
  2⤵
  PID:2120
- /usr/bin/cut
  cut "-d=" -f 2-
  2⤵
  PID:2123
- /usr/bin/cut
  cut "-d=" -f 2-
  2⤵
  PID:2126
- /usr/bin/cut
  cut "-d=" -f 2-
  2⤵
  PID:2131
- /usr/bin/cut
  cut "-d=" -f 2-
  2⤵
  PID:2134
- /usr/bin/firefox
  /usr/bin/firefox https://tria.ge/submit
  2⤵
  PID:2135
- /usr/lib/firefox/firefox-bin
  /usr/bin/firefox https://tria.ge/submit
  2⤵
  - Checks hardware identifiers (DMI)
  - Reads hardware information
  - Changes its process name
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:2135
- - /usr/lib/firefox/crashhelper
    /usr/lib/firefox/crashhelper 2135 9 /tmp/ 11
    3⤵
    PID:2139
- - /usr/local/sbin/dbus-launch
    dbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr
    3⤵
    PID:2144
- - /usr/local/bin/dbus-launch
    dbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr
    3⤵
    PID:2144
- - /usr/sbin/dbus-launch
    dbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr
    3⤵
    PID:2144
- - /usr/bin/dbus-launch
    dbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr
    3⤵
    PID:2144
- - /usr/lib/firefox/glxtest
    /usr/lib/firefox/glxtest -f 18
    3⤵
    - Changes its process name
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:2148
- - /usr/lib/firefox/firefox-bin
    /usr/lib/firefox/firefox-bin -contentproc -ipcHandle 0 -signalPipe 1 -initialChannelId "{98855dfc-76e1-427e-be06-a2c5ade2936b}" -parentPid 2135 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser 1 forkserver
    3⤵
    - Reads CPU attributes
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:2187

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

events

Path /root/.config/mozilla/firefox/fq58mci9.default-release/datareporting/glean/events/events
Size 2KB
SHA256 6d63612975515371a67b8c548e68a79877b248a9dd23cf8fce66352b18922947
MD5 2c98014f32c108307adffb2b3bf88ede
SHA1 3529610cc0bfc42810e5ff15c3ef2adade2ca43c
SHA512 782f542b8261b0490c18db5f571f8ca91435c482b6429d4ad22552c7b087292afc8bf22f7e57f85a7939585de50533b5081077d6687d0396a5a31288ba0d57cb
TLSH
T1FE41675C3FA58D6ADDDBF3982480038EE7254A9B92122D436D62EBC9C9907DA311993C
MD5 SHA1 SHA512 TLSH

Submit Download

05b21b4d-767a-4e69-acf4-68aa44f874b7

Path /root/.config/mozilla/firefox/fq58mci9.default-release/datareporting/glean/tmp/05b21b4d-767a-4e69-acf4-68aa44f874b7
Size 1KB
SHA256 8cce8172587765e8a0560b416117d18bdc7591b00d2980a9221834add8b488e8
MD5 e06f484c7d555ad206f82b6c5a689936
SHA1 44df0b4577c826f801af794fcbcec21c5e5683a8
SHA512 b4b28779a6cf4ce90263c68891afe72b692ed5c1caa9d629de4e7ee3f92cf6f9cace74c116d10a115799b140adc91a566153f4d62d9b50fd72ecbd2256ed7f0f
TLSH
T11431ED442C6059A99D59D18A8840BD8F8BEC7237608FC9B03EE6DD0CD629D1F72DF917
MD5 SHA1 SHA512 TLSH

Submit Download

195d9ca6-ad40-4545-8a56-786b75654105

Path /root/.config/mozilla/firefox/fq58mci9.default-release/datareporting/glean/tmp/195d9ca6-ad40-4545-8a56-786b75654105
Size 1KB
SHA256 9ce99462bc46361bb1b32a46dffa81cbf1de29916d4d3c9e84516cecf78d1585
MD5 eaf0af05f5bc05d28113ab1b673473fe
SHA1 b7055193c190bc060b5415155ed239c3e516ba84
SHA512 60abd18d7a3127fa9d7f936993824b2283cc66eac2f5a7471446439dc38adbc7a823de26d0950f2b0696ba6d999226f6d8aa5c16f9df2328b5610a1a0dcab823
TLSH
T115113550C930A9728FD5E64795D476039BB4A53340C654187CE09A080DAF71F57B770B
MD5 SHA1 SHA512 TLSH

Submit Download

46471e38-2807-4749-84df-2bea04e4793f

Path /root/.config/mozilla/firefox/fq58mci9.default-release/datareporting/glean/tmp/46471e38-2807-4749-84df-2bea04e4793f
Size 368B
SHA256 95693dafc46a33c18f7e32a19a12688965ee5b219837102be6810395361909df
MD5 8c40cd3234c57f8ffaebf07e973b177a
SHA1 ee59d793522f5a0a3f021ab1ab7d24964e52220c
SHA512 30a132a4202ffbabf720aa34202e2e6dbce94edf0e7e9abfe31141f88a33114e548d77cd9c4cf6d44777bedb4e0fdbea46bb721140554f5aea8612641bac400d
TLSH
T1C2E0689A90A48611ED80D626D89819115BACEC43D4E690B579F021AD8AD64CC92F322E
MD5 SHA1 SHA512 TLSH

Submit Download

8743f6c2-10bd-4d57-b651-ac691aa3e910

Path /root/.config/mozilla/firefox/fq58mci9.default-release/datareporting/glean/tmp/8743f6c2-10bd-4d57-b651-ac691aa3e910
Size 4KB
SHA256 dae2402692b5c5d1d29bf93e12e5cdc0407ed41bbb88366e9dea6b50c9b33684
MD5 95654dc9766a6cab40818118ac1b169d
SHA1 2932ac65159abcc358021d416fce19b8573f51f2
SHA512 8edc9e7c3321d779214d7281d684ac29294a0be7c585290b832b8c95b5a0b1c438ad20889ea59aa490bbd1d07ad6eaa1ff18bc9b3e4165ed65e9330158e3ed8b
SSDEEP 96:rgMmeMWs3jh/AXJA0EAbAAUsLA6AUxAbu:UMuT620JRXsLFbu
TLSH
T1C681AB144429B87CD89AD7A2CBB37F8787785337F089B51CFDEE550622EB1A2123600B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c59c272a-f516-4f60-beb3-2b414cb73a01

Path /root/.config/mozilla/firefox/fq58mci9.default-release/datareporting/glean/tmp/c59c272a-f516-4f60-beb3-2b414cb73a01
Size 5KB
SHA256 56f91ca6c29a8266760b792f09c17814a7c00af164ed2ead93a67fe095a7aa33
MD5 91ad22be04102682c87cb71f4b52776c
SHA1 1d13c09eea96eec1e01440c72711de7f4d3ad4b9
SHA512 0d18b7b299b64e9c136450cd90711db27347806c7f3aa3bcf052d4bb1057d31e51ef4289cad88f028c18f0b1c96ed8f4a7e2b8056045dd7eacaa3bca077e8005
SSDEEP 48:k+U8utIWHWBXZ7poUCx1uPURWHAosjbZ3xZ2kepkeF3vgcpyEcahxPh74hVIPh1U:haHWxZ7XNPcWgoCJkJly0Hq01CP
TLSH
T106B12F5C36A48C6EADCBF31C5091274A93B28B4B54023D832E85DE8DDD9D789726E43A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa3352a2-1a61-419a-b19a-ae1fec1e5dca

Path /root/.config/mozilla/firefox/fq58mci9.default-release/datareporting/glean/tmp/fa3352a2-1a61-419a-b19a-ae1fec1e5dca
Size 871B
SHA256 437644278a68ca1174f0fe9240ba5f2c43cdbb0d858bef360f084609c448b2b6
MD5 28b8f1e5415eaf681351d2d616970b77
SHA1 f844a02d37fcdb0ee04f4b381ca00007dd73d2f6
SHA512 b6ab0e1c27688b77b34de6fc807aba28972eabb1d75efab9938cedb9a0c8fae40db55e581e5c5d3d03c2457646124270bc92643b2cdebd1ecec1bdb970882dc2
TLSH
T133112FC08421BA728E59D78BD6E07A02D3B4F51340C658683DE59A1809BF02E97B370B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path /root/.config/mozilla/firefox/fq58mci9.default-release/prefs-1.js
Size 6KB
SHA256 cdaf29aa9fe145554bc1b4851eb45ad1687dfa7d753fe7213cf8c17a13260bbd
MD5 afbe9a407bf40bb87b4519ab611949de
SHA1 5ef95ae36cde70d1fd413779d98fc35cc73bb0de
SHA512 f9aa6692c4ae11351554d575601c0aa470ec884afd18296a6b35b729b0fb8bad293a42966d1c9c90649dd867a76ec5eb95c19bd058cb1c3c3ea0179d29276c44
SSDEEP 96:oc3kF29yqjqGy7zKknkgzGPVz2jw6gb5bdprFj0dNN8cp8L8KsZj:puT7zlk/Vz2Ep5jOPvp8Yj
TLSH
T1A4E11E3894188F7FA5B2376CAC6889501A72C25FB3BF28C715B94208554CB7891FDAE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path /root/.config/mozilla/firefox/fq58mci9.default-release/prefs-1.js
Size 6KB
SHA256 6bff4aa661817e8417fe110f8e718bb92cc29ca2d9f9f600f2450d7aa5c03f74
MD5 4715884be7a889a136203cad277ccb54
SHA1 af971de64440fb21e704ea05b33f7baa230e97e8
SHA512 dd8738eba49dc84111e6a7f79744970294731158ca4a8b062266e3dccc3de6866ac2bfcf85ff4559246347edc12bf7d5c24d4626e8cae7dddbb4448a4dc41a17
SSDEEP 96:oc3kF2iqjqGy7zKknkgzGPHzMjw6gb5bdprFj0dNN8cp84Zj:juT7zlk/HzMEp5jOPvp86
TLSH
T1ABD10E3890188F6FA5B23B6CAC6888505972C25FB3BF28C718B54718454CB7891FDAE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path /root/.config/mozilla/firefox/fq58mci9.default-release/prefs-1.js
Size 6KB
SHA256 770ddaab48ea37d175281f2d961db946408987448249e958b26fdad040a775a7
MD5 1804b8fff9d9106d212ea890f066f9bc
SHA1 ec32f372e90e1ce7356dda3b76294f56eaf107c4
SHA512 8dfc7bbf066dd8fe3a99e0123a5fd9e15ffd53e6110357f7db9b0a8ece2501558824ae2b45410d81e904e4e773f8d5c6b1cbc26f93ee278a5af3c405b4e0306a
SSDEEP 96:oc3kF2iqjqGy7zKknkgzGPHz2jw6gb5bdprFj0dNN8cp86Zj:juT7zlk/Hz2Ep5jOPvp8U
TLSH
T132D10F3890188F7FA5B23B6C6C688C505A72C25FB3BF28C715B94618454CB7891FDAE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path /root/.config/mozilla/firefox/fq58mci9.default-release/prefs-1.js
Size 6KB
SHA256 14497eed7129b4d24521f905c6df2fd4bf5d33f5abdbecc0d5dd165d5982001c
MD5 11926a862b406f5397819d0021995826
SHA1 5064f0a1c0d39d48d4a4cf551f172e06f39a9f37
SHA512 b2388256e831aac50f95e94100a1204bb0bab3d0313c083ea1ae8c69db4c06e945504dc9c5051a68980bad5f2f681390e3bd3b630f3cc970290a7bd523467b5f
SSDEEP 96:oc3kF29yqjqGy7zKknkgzGPVz2jw6gb5bdprFj0dNN8cp86Zj:puT7zlk/Vz2Ep5jOPvp8U
TLSH
T12CD12F3894188F7FA5B2376C6C688C505A72C25FB3BF28C714B54608454CB7891FDAE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path /root/.config/mozilla/firefox/fq58mci9.default-release/prefs-1.js
Size 6KB
SHA256 082a305f30517a5d823dda31ad9f27156ea927a96b9158552dd11174d6c76b12
MD5 b39830723280b2f06f7c23694d7d4ac9
SHA1 81a4bdfdfae1ba7370646c67e8024ffeed690ccf
SHA512 fbd4f3a50dbb728f5176132bc898adb63c6a8561a3c347ba0dd654ecb9ca3da5d33f9f19a56f1102215be77ca234bc2badd13fde25855d9e0d574973a4270709
SSDEEP 96:oc3kF29yqjqGy7zKknkgzGPVz2jw6gb5bdprFj0dNN8cp8W8PZj:puT7zlk/Vz2Ep5jOPvp83h
TLSH
T17CD11F3894188F7FA5B6376C6C688C501A72C25FB3BF28C714B68608454CB7891FDAE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protections.sqlite

Path /root/.config/mozilla/firefox/fq58mci9.default-release/protections.sqlite
Size 64KB
SHA256 4409b4414acac238bafe1239a4e4b5eacc5da33f38abb9b1b8453d8c8e712fcf
MD5 3d859266a3787d2e39442ea74831dd0e
SHA1 de3a89d270eaca101c118253d179d00bc6dd24a1
SHA512 45a889d2a4eccb1c685dc83fca7a1499546926be261b6d0e64fb458f99018198a268876bfaf839f36e45e91d575fa226133d6c145f963a0b7e20be96ec713254
SSDEEP 6:ltBl/lYN14/kad4BEJYqWvLue3FMOrMZ0l:DBl/Wn4dfJiFxMZO
TLSH
T13453225E03383122C096137227C323923F3CD2BA93232D8339100D348C0A227B821AE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webappsstore.sqlite

Path /root/.config/mozilla/firefox/fq58mci9.default-release/webappsstore.sqlite
Size 96KB
SHA256 d884477ede4c58bb90cccb1552ba8a0eb784ec7e89614d7d37fbf274db078e16
MD5 28265a4276d6806d3b28cbcd8f3cc687
SHA1 a4e22988e4bf9bd4f5923cd3c9f21263850cdc98
SHA512 3f0b156743e8ab892823931a77e2d331436d5a19223993a5abcd8d37378df68ddebc315a74bd07dfbf37e039d49b153f08723026c2d3434ded87dfc15e75c346
SSDEEP 6:ltTo/e/E7R/Wwhm914iDKrvcwTlNCcVWDeNgLu5e3cwOJrheFDEf:D0OE7Rzhm9GiD0c4NCcVUo58cz16D
TLSH
T15AA3D88FCA4813A7DD0083789B461F80EE93585E45C343E238B423CC0AA37440B2F828
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads