Overview
overview
8Static
static
1URLScan
urlscan
1http://br-rio-anx-r0...
windows10-2004-x64
3http://br-rio-anx-r0...
windows10-ltsc_2021-x64
3http://br-rio-anx-r0...
windows11-21h2-x64
8http://br-rio-anx-r0...
windows11-ltsc_2024-x64
3http://br-rio-anx-r0...
android-10-x64
1http://br-rio-anx-r0...
android-11-x64
1http://br-rio-anx-r0...
android-13-x64
1http://br-rio-anx-r0...
android-14-x64
1http://br-rio-anx-r0...
android-15-x64
1http://br-rio-anx-r0...
android-9-x86
1http://br-rio-anx-r0...
macos-10.15-amd64
4http://br-rio-anx-r0...
debian-12-armhf
http://br-rio-anx-r0...
debian-12-mipsel
http://br-rio-anx-r0...
debian-9-armhf
http://br-rio-anx-r0...
debian-9-mips
http://br-rio-anx-r0...
debian-9-mipsel
http://br-rio-anx-r0...
ubuntu-18.04-amd64
6http://br-rio-anx-r0...
ubuntu-20.04-amd64
6http://br-rio-anx-r0...
ubuntu-22.04-amd64
6http://br-rio-anx-r0...
ubuntu-24.04-amd64
6Analysis
- max time kernel
898s - max time network
896s - platform
ubuntu-22.04_amd64 - resource
ubuntu2204-amd64-20260127-en - resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20260127-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system - submitted
09/08/2026, 03:19
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://br-rio-anx-r007.router.teamviewer.com
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
900 seconds
Behavioral task
behavioral2
Sample
http://br-rio-anx-r007.router.teamviewer.com
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
11 signatures
900 seconds
Behavioral task
behavioral3
Sample
http://br-rio-anx-r007.router.teamviewer.com
Resource
win11-20260513-en
windows11-21h2-x64
18 signatures
900 seconds
Behavioral task
behavioral4
Sample
http://br-rio-anx-r007.router.teamviewer.com
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
900 seconds
Behavioral task
behavioral5
Sample
http://br-rio-anx-r007.router.teamviewer.com
Resource
android-x64-20260325-en
android-10-x64
2 signatures
900 seconds
Behavioral task
behavioral6
Sample
http://br-rio-anx-r007.router.teamviewer.com
Resource
android-x64-arm64-20260325-en
android-11-x64
2 signatures
900 seconds
Behavioral task
behavioral7
Sample
http://br-rio-anx-r007.router.teamviewer.com
Resource
android-33-x64-arm64-20260708-en
android-13-x64
2 signatures
900 seconds
Behavioral task
behavioral8
Sample
http://br-rio-anx-r007.router.teamviewer.com
Resource
android-34-x64-arm64-20260325.1-en
android-14-x64
2 signatures
900 seconds
Behavioral task
behavioral9
Sample
http://br-rio-anx-r007.router.teamviewer.com
Resource
android-35-x64-arm64-20260325-en
android-15-x64
1 signatures
900 seconds
Behavioral task
behavioral10
Sample
http://br-rio-anx-r007.router.teamviewer.com
Resource
android-x86-arm-20260325-en
android-9-x86
2 signatures
900 seconds
Behavioral task
behavioral11
Sample
http://br-rio-anx-r007.router.teamviewer.com
Resource
macos-20250619-en
macos-10.15-amd64
1 signatures
900 seconds
Behavioral task
behavioral12
Sample
http://br-rio-anx-r007.router.teamviewer.com
Resource
debian12-armhf-20260127-en
debian-12-armhf
0 signatures
900 seconds
Behavioral task
behavioral13
Sample
http://br-rio-anx-r007.router.teamviewer.com
Resource
debian12-mipsel-20260513-en
debian-12-mipsel
0 signatures
900 seconds
Behavioral task
behavioral14
Sample
http://br-rio-anx-r007.router.teamviewer.com
Resource
debian9-armhf-20260513-en
debian-9-armhf
0 signatures
900 seconds
Behavioral task
behavioral15
Sample
http://br-rio-anx-r007.router.teamviewer.com
Resource
debian9-mipsbe-20260513-en
debian-9-mips
0 signatures
900 seconds
Behavioral task
behavioral16
Sample
http://br-rio-anx-r007.router.teamviewer.com
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
0 signatures
900 seconds
Behavioral task
behavioral17
Sample
http://br-rio-anx-r007.router.teamviewer.com
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
8 signatures
900 seconds
Behavioral task
behavioral18
Sample
http://br-rio-anx-r007.router.teamviewer.com
Resource
ubuntu2004-amd64-20260513-en
ubuntu-20.04-amd64
8 signatures
900 seconds
Behavioral task
behavioral19
Sample
http://br-rio-anx-r007.router.teamviewer.com
Resource
ubuntu2204-amd64-20260127-en
ubuntu-22.04-amd64
8 signatures
900 seconds
General
Malware Config
Signatures
- Checks hardware identifiers (DMI) 1 TTPs 1 IoCs
Checks DMI information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /sys/devices/virtual/dmi/id/product_name firefox-bin - Reads hardware information 1 TTPs 1 IoCs
Accesses system info like serial numbers, manufacturer names etc.
description ioc Process File opened for reading /sys/devices/virtual/dmi/id/product_sku firefox-bin - Changes its process name 64 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself AsyncSi~lThread 2660 firefox-bin Changes the process name, possibly in an attempt to hide itself gmain 2664 firefox-bin Changes the process name, possibly in an attempt to hide itself pool 2666 firefox-bin Changes the process name, possibly in an attempt to hide itself gdbus 2667 firefox-bin Changes the process name, possibly in an attempt to hide itself glean.dispatche 2668 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 2670 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 2670 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 2670 firefox-bin Changes the process name, possibly in an attempt to hide itself Socket Thread 2673 firefox-bin Changes the process name, possibly in an attempt to hide itself IPDL Background 2674 firefox-bin Changes the process name, possibly in an attempt to hide itself Backgro~Pool #1 2675 firefox-bin Changes the process name, possibly in an attempt to hide itself Socket Thread 2673 firefox-bin Changes the process name, possibly in an attempt to hide itself IPDL Background 2674 firefox-bin Changes the process name, possibly in an attempt to hide itself Netlink Monitor 2672 firefox-bin Changes the process name, possibly in an attempt to hide itself Backgro~Pool #1 2675 firefox-bin Changes the process name, possibly in an attempt to hide itself Netlink Monitor 2672 firefox-bin Changes the process name, possibly in an attempt to hide itself Timer 2671 firefox-bin Changes the process name, possibly in an attempt to hide itself Timer 2671 firefox-bin Changes the process name, possibly in an attempt to hide itself [pango] FcInit 2676 firefox-bin Changes the process name, possibly in an attempt to hide itself glxtest:disk$0 2682 glxtest Changes the process name, possibly in an attempt to hide itself HTML5 Parser 2684 firefox-bin Changes the process name, possibly in an attempt to hide itself HTML5 Parser 2684 firefox-bin Changes the process name, possibly in an attempt to hide itself dconf worker 2683 firefox-bin Changes the process name, possibly in an attempt to hide itself JS Watchdog 2686 firefox-bin Changes the process name, possibly in an attempt to hide itself JS Watchdog 2686 firefox-bin Changes the process name, possibly in an attempt to hide itself BGReadURLs 2687 firefox-bin Changes the process name, possibly in an attempt to hide itself BGReadURLs 2687 firefox-bin Changes the process name, possibly in an attempt to hide itself Cache2 I/O 2688 firefox-bin Changes the process name, possibly in an attempt to hide itself Cache2 I/O 2688 firefox-bin Changes the process name, possibly in an attempt to hide itself Cookie 2689 firefox-bin Changes the process name, possibly in an attempt to hide itself Cookie 2689 firefox-bin Changes the process name, possibly in an attempt to hide itself TaskCon~ller #1 2691 firefox-bin Changes the process name, possibly in an attempt to hide itself StreamTrans #1 2692 firefox-bin Changes the process name, possibly in an attempt to hide itself StreamTrans #1 2692 firefox-bin Changes the process name, possibly in an attempt to hide itself TaskCon~ller #0 2690 firefox-bin Changes the process name, possibly in an attempt to hide itself BgIOThr~Pool #1 2693 firefox-bin Changes the process name, possibly in an attempt to hide itself BgIOThr~Pool #1 2693 firefox-bin Changes the process name, possibly in an attempt to hide itself Worker Launcher 2694 firefox-bin Changes the process name, possibly in an attempt to hide itself Worker Launcher 2694 firefox-bin Changes the process name, possibly in an attempt to hide itself QuotaManager IO 2695 firefox-bin Changes the process name, possibly in an attempt to hide itself QuotaManager IO 2695 firefox-bin Changes the process name, possibly in an attempt to hide itself Softwar~cThread 2696 firefox-bin Changes the process name, possibly in an attempt to hide itself Softwar~cThread 2696 firefox-bin Changes the process name, possibly in an attempt to hide itself Softwar~cThread 2696 firefox-bin Changes the process name, possibly in an attempt to hide itself CanvasRenderer 2702 firefox-bin Changes the process name, possibly in an attempt to hide itself CanvasRenderer 2702 firefox-bin Changes the process name, possibly in an attempt to hide itself Compositor 2701 firefox-bin Changes the process name, possibly in an attempt to hide itself Compositor 2701 firefox-bin Changes the process name, possibly in an attempt to hide itself Glyph rasterize 2700 firefox-bin Changes the process name, possibly in an attempt to hide itself WrGlyph~terizer 2700 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorkerLP#0 2699 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorker#0 2698 firefox-bin Changes the process name, possibly in an attempt to hide itself Renderer 2697 firefox-bin Changes the process name, possibly in an attempt to hide itself Renderer 2697 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorker#0 2698 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorkerLP#0 2699 firefox-bin Changes the process name, possibly in an attempt to hide itself ImageIO 2703 firefox-bin Changes the process name, possibly in an attempt to hide itself ImageIO 2703 firefox-bin Changes the process name, possibly in an attempt to hide itself Permission 2704 firefox-bin Changes the process name, possibly in an attempt to hide itself Permission 2704 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC Launch 2705 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC Launch 2705 firefox-bin Changes the process name, possibly in an attempt to hide itself forkserver 2706 firefox-bin Changes the process name, possibly in an attempt to hide itself Sandbox Forked 2708 firefox-bin - Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo firefox-bin - Reads CPU attributes 1 TTPs 9 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/size firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/topology/core_cpus firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/cpu_capacity glxtest File opened for reading /sys/devices/system/cpu/present firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/size firefox-bin File opened for reading /sys/devices/system/cpu/possible firefox-bin File opened for reading /sys/devices/system/cpu/present firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/cpu_capacity xdg-desktop-portal-gnome File opened for reading /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq firefox-bin - Enumerates kernel/hardware configuration 1 TTPs 41 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/kernel/security/apparmor/features/dbus/mask dbus-daemon File opened for reading /sys/devices/pci0000:00/0000:00:02.0 firefox-bin File opened for reading /sys/bus/pci/devices/0000:00:01.0/vendor glxtest File opened for reading /sys/module/apparmor/parameters/enabled dbus-daemon File opened for reading /sys/bus/pci/devices/0000:00:06.0/vendor glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0/virtio0/drm/card0 firefox-bin File opened for reading /sys/bus/pci/devices glxtest File opened for reading /sys/bus/pci/devices/0000:00:05.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:06.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.3/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:04.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:04.0/device glxtest File opened for reading /sys/devices/system/cpu firefox-bin File opened for reading /sys/fs/cgroup/system.slice/agent.service/cpu.max firefox-bin File opened for reading /sys/bus/pci/devices/0000:00:06.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:03.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:03.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:03.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.3/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:00.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.0/class glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0/virtio0/drm/renderD128 firefox-bin File opened for reading /sys/bus/pci/devices/0000:00:00.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.0/device glxtest File opened for reading /sys/fs/cgroup/system.slice/agent.service/cpu.max firefox-bin File opened for reading /sys/devices/system/cpu xdg-desktop-portal-gnome File opened for reading /sys/bus/pci/devices/0000:00:00.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:05.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:02.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:02.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.1/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.1/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.3/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:05.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:02.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.1/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:04.0/class glxtest File opened for reading /sys/devices/system/node firefox-bin File opened for reading /sys/devices/system/cpu firefox-bin File opened for reading /sys/devices/system/cpu glxtest File opened for reading /sys/devices/system/node/node0/meminfo firefox-bin -
description ioc Process File opened for reading /proc/2715/cmdline dbus-daemon File opened for reading /proc/self/fd/41 firefox-bin File opened for reading /proc/2657/root xdg-desktop-portal File opened for reading /proc/2657/cgroup xdg-desktop-portal File opened for reading /proc/filesystems sed File opened for reading /proc/self/mountinfo firefox-bin File opened for reading /proc/self/maps firefox-bin File opened for reading /proc/2733/cmdline dbus-daemon File opened for reading /proc/filesystems xdg-desktop-portal-gtk File opened for reading /proc/pressure/memory firefox-bin File opened for reading /proc/self/fd/102 firefox-bin File opened for reading /proc/meminfo firefox-bin File opened for reading /proc/mounts dbus-daemon File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/task/2658/stat firefox-bin File opened for reading /proc/filesystems firefox-bin File opened for reading /proc/self/task/2712/stat firefox-bin File opened for reading /proc/filesystems xdg-document-portal File opened for reading /proc/filesystems gnome-keyring-daemon File opened for reading /proc/filesystems sed File opened for reading /proc/self/fd/17 firefox-bin File opened for reading /proc/self/fd firefox-bin File opened for reading /proc/2769/cmdline dbus-daemon File opened for reading /proc/self/fd/72 firefox-bin File opened for reading /proc/self/task/2881/stat firefox-bin File opened for reading /proc/self/fd dbus-send File opened for reading /proc/filesystems sed File opened for reading /proc/self/fd/39 firefox-bin File opened for reading /proc/self/stat firefox-bin File opened for reading /proc/self/fd/89 firefox-bin File opened for reading /proc/2572/status dbus-daemon File opened for reading /proc/self/maps grep File opened for reading /proc/self/stat firefox-bin File opened for reading /proc/2710/cmdline dbus-daemon File opened for reading /proc/self/task/2791/stat firefox-bin File opened for reading /proc/self/fd/87 firefox-bin File opened for reading /proc/filesystems dbus-daemon File opened for reading /proc/2572/attr/apparmor/current dbus-daemon File opened for reading /proc/2722/cmdline dbus-daemon File opened for reading /proc/filesystems xdg-permission-store File opened for reading /proc/self/fd/57 firefox-bin File opened for reading /proc/2781/cmdline dbus-daemon File opened for reading /proc/self/task/2866/stat firefox-bin File opened for reading /proc/sys/kernel/cap_last_cap dbus-daemon File opened for reading /proc/2588/cmdline dbus-daemon File opened for reading /proc/self/maps grep File opened for reading /proc/self/fd firefox-bin File opened for reading /proc/filesystems xdg-desktop-portal File opened for reading /proc/self/task/2801/stat firefox-bin File opened for reading /proc/self/task/2872/stat firefox-bin File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps firefox-bin File opened for reading /proc/filesystems glxtest File opened for reading /proc/2758/cmdline dbus-daemon File opened for reading /proc/self/fd/69 firefox-bin File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/fd/58 firefox-bin File opened for reading /proc/self/cgroup firefox-bin File opened for reading /proc/self/fd/46 firefox-bin File opened for reading /proc/filesystems gvfsd File opened for reading /proc/self/maps grep File opened for reading /proc/filesystems firefox-bin - Writes file to tmp directory 2 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/remote-settings-startup-bundle- firefox-bin File opened for modification /tmp/firefox/.parentlock firefox-bin
Processes
-
/usr/bin/xdg-openxdg-open http://br-rio-anx-r007.router.teamviewer.com1⤵PID:2566
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager2⤵
- Reads runtime system information
PID:2567 -
/usr/bin/dbus-launchdbus-launch --autolaunch f2de92a803c744e586bd87567a26b68a --binary-syntax --close-stderr3⤵PID:2568
-
/usr/bin/dbus-daemon/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session4⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2570 -
/usr/libexec/xdg-desktop-portal/usr/libexec/xdg-desktop-portal5⤵
- Reads runtime system information
PID:2710
-
-
/usr/libexec/at-spi-bus-launcher/usr/libexec/at-spi-bus-launcher5⤵PID:2715
-
-
/usr/libexec/xdg-document-portal/usr/libexec/xdg-document-portal5⤵
- Reads runtime system information
PID:2722 -
/usr/bin/fusermount3fusermount3 -o "rw,nosuid,nodev,fsname=portal,auto_unmount,subtype=portal" -- /root/.cache/doc6⤵PID:2741
-
-
-
/usr/libexec/xdg-permission-store/usr/libexec/xdg-permission-store5⤵
- Reads runtime system information
PID:2733
-
-
/usr/libexec/xdg-desktop-portal-gnome/usr/libexec/xdg-desktop-portal-gnome5⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
PID:2746
-
-
/usr/libexec/gvfsd/usr/libexec/gvfsd5⤵
- Reads runtime system information
PID:2753
-
-
/usr/libexec/xdg-desktop-portal-gtk/usr/libexec/xdg-desktop-portal-gtk5⤵
- Reads runtime system information
PID:2769
-
-
/usr/bin/gnome-keyring-daemon/usr/bin/gnome-keyring-daemon --start --foreground "--components=secrets"5⤵
- Reads runtime system information
PID:2781
-
-
-
-
-
/usr/bin/grepgrep " = \\\"xfce4\\\"\$"2⤵PID:2574
-
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE2⤵PID:2573
-
-
/usr/bin/grepgrep -i "^xfce_desktop_window"2⤵
- Reads runtime system information
PID:2576
-
-
/usr/bin/xpropxprop -root2⤵PID:2575
-
-
/usr/bin/grepgrep -q "^Enlightenment"2⤵
- Reads runtime system information
PID:2578
-
-
/usr/bin/unameuname2⤵PID:2579
-
-
/usr/bin/grepgrep -q "^file://"2⤵
- Reads runtime system information
PID:2581
-
-
/usr/bin/egrepegrep -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:2583
-
-
/usr/local/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:2583
-
-
/usr/local/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:2583
-
-
/usr/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:2583
-
-
/usr/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
- Reads runtime system information
PID:2583
-
-
/usr/bin/sedsed -n "s/\\(^[[:alnum:]+\\.-]*\\):.*\$/\\1/p"2⤵PID:2586
-
-
/usr/bin/xdg-mimexdg-mime query default x-scheme-handler/http2⤵PID:2587
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager3⤵PID:2588
-
/usr/bin/dbus-launchdbus-launch --autolaunch f2de92a803c744e586bd87567a26b68a --binary-syntax --close-stderr4⤵PID:2589
-
-
-
/usr/bin/grepgrep " = \\\"xfce4\\\"\$"3⤵PID:2591
-
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE3⤵PID:2590
-
-
/usr/bin/grepgrep -i "^xfce_desktop_window"3⤵
- Reads runtime system information
PID:2593
-
-
/usr/bin/xpropxprop -root3⤵PID:2592
-
-
/usr/bin/grepgrep -q "^Enlightenment"3⤵
- Reads runtime system information
PID:2595
-
-
/usr/bin/unameuname3⤵PID:2596
-
-
/usr/bin/sedsed "s/:/ /g"3⤵
- Reads runtime system information
PID:2599
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:2603
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:2604
-
-
/usr/bin/headhead -n 13⤵PID:2602
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵PID:2601
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:2609
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:2608
-
-
/usr/bin/headhead -n 13⤵PID:2607
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵PID:2606
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:2614
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:2613
-
-
/usr/bin/headhead -n 13⤵PID:2612
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵
- Reads runtime system information
PID:2611
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:2619
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:2618
-
-
/usr/bin/headhead -n 13⤵PID:2617
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵PID:2616
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:2627
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:2626
-
-
/usr/bin/headhead -n 13⤵PID:2625
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache3⤵
- Reads runtime system information
PID:2624
-
-
-
/usr/bin/sedsed "s/:/ /g"2⤵
- Reads runtime system information
PID:2630
-
-
/usr/bin/sedsed -e "s|-|/|"2⤵
- Reads runtime system information
PID:2633
-
-
/usr/bin/sedsed -e "s|-|/|"2⤵PID:2636
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:2641
-
-
/usr/bin/whichwhich firefox2⤵PID:2642
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:2645
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:2648
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:2653
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:2656
-
-
/usr/bin/firefox/usr/bin/firefox http://br-rio-anx-r007.router.teamviewer.com2⤵PID:2657
-
-
/usr/lib/firefox/firefox-bin/usr/bin/firefox http://br-rio-anx-r007.router.teamviewer.com2⤵
- Checks hardware identifiers (DMI)
- Reads hardware information
- Changes its process name
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
PID:2657 -
/usr/lib/firefox/crashhelper/usr/lib/firefox/crashhelper 2657 9 /tmp/ 113⤵PID:2661
-
-
/usr/local/sbin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr3⤵PID:2665
-
-
/usr/local/bin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr3⤵PID:2665
-
-
/usr/sbin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr3⤵PID:2665
-
-
/usr/bin/dbus-launchdbus-launch "--autolaunch=f2de92a803c744e586bd87567a26b68a" --binary-syntax --close-stderr3⤵PID:2665
-
-
/usr/lib/firefox/glxtest/usr/lib/firefox/glxtest -f 183⤵
- Changes its process name
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2669
-
-
/usr/lib/firefox/firefox-bin/usr/lib/firefox/firefox-bin -contentproc -ipcHandle 0 -signalPipe 1 -initialChannelId "{b7a96fd9-b203-4c64-93d8-522b441e34fb}" -parentPid 2657 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser 1 forkserver3⤵
- Changes its process name
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2706
-
-
-
/usr/libexec/gvfsd-fuse/usr/libexec/gvfsd-fuse /root/.cache/gvfs -f1⤵PID:2758
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/datareporting/glean/events/events
- Size 2KB
- SHA256 ae4d8f90b8b96205fe1683941ceb9cbb38a044d2ee97fd5544c0745d3ee1c16e
- MD5 c016688fcc4e298ebe7cafd3da001d67
- SHA1 4a25c81f9597c0429cf02d2cdec9562a97e2c845
- SHA512 8603e24201dc45adc42838ce8669954d51ad14fcf0daaabb69e9a90bfc87929161b42f66ef9a45cd5a8d3f6edecaf469bb43ab8efca0e2ad009c76a23f380888
- TLSH T10651794C3AE48D7AAC8BF39C3490038E93A54A4B85522D475E15EFCACD806DA326D43C
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/datareporting/glean/events/pageload
- Size 280B
- SHA256 687fbcb66feb20c9d000eca4e61da6cdaf73a11d126432b307ccb8c87e3d197a
- MD5 7a04e0b5414f4fd97d04f21c6af0ec8e
- SHA1 190192f07083b73c718d75f1272d5e17ba80a10b
- SHA512 a96d5ef3758676478c971281ca6ef6f02ff9cdcc5a9ac69fdcd26808a09b4d8d0df161bb66c56fa14cf3d3358a8d6c547997fc627155f4c1eeece397a53925ab
- TLSH T1BBD0950F184A8DADC75BD17C30C503CD631CD34703D39D6399105F0CC4885455117479
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/datareporting/glean/tmp/3a945f3d-f390-4bd4-9a2a-042e9fa9948f
- Size 4KB
- SHA256 1909a93ebc4a53e9b005072da9f28887e31f17c5caa58493f7c4f94a0cdfe9cb
- MD5 ec4321a98d55e00bef2c2b35a4aa6776
- SHA1 2749cd19fdcd14c35608ea684fdf814f486a3692
- SHA512 d53adc52f7292ca528a63589fcd08519611f6a802c3ccd04889fdc84e67aa24b185b02e9bc9071a01e50169b278fffea6fa182b7299cdec9b125c6918204b6ad
- SSDEEP 96:a+9kmWs3jh/AXJA0EAbAAUsLA6AUMAb+6:a+bT620JRXsLSb+6
- TLSH T1A0919C244439787CE89AD7A2CB737F838B785736B089B51CEDEE450616AF1A2127610B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/datareporting/glean/tmp/49961ac8-4037-478e-87c6-3d1188ed8e8e
- Size 682B
- SHA256 9f0fbd41478bbaa763cd27997c91fec84f004b1af40834fb101eb061a1405819
- MD5 3059244f1309f76c9107a5749722c24c
- SHA1 6b574affb2a47e6e1dada770b5d9c514c2a5c606
- SHA512 0746446b8e7d8cfe1be5f713f4a840fd41a70be72f15661ca6cb9b07122ca4f76ffc3343eb649490c0b19ff7cee2a78867181e2e79aac645a9ec72513ab6c94e
- TLSH T17701FE52689845124CE45B8BF0E03A407175553250A2F748E0D4D6347C9F96742B3F1B
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/datareporting/glean/tmp/60be8fb3-4d4b-453d-aa76-1a933824bb2f
- Size 1KB
- SHA256 d1878211099526b37d3817c87c4fc60eae2b44574ef3b45b3fab00dad628608b
- MD5 1199a2813f5eb3ddd5cbb9fa38b40ab9
- SHA1 d99bfefa8ee1d114d27f176da86f473eb10945cb
- SHA512 01682c0ad251a63775a604c38f9ff8c38216538c2d9dfceb536c607f3c6088a2400e21cd629c3929b4a6d711213facb06b5c28d8914aef07c27c09948df7d707
- TLSH T1892163519D30B671DEA8978BA9A53702AEB0702350C228987CD05B0C09BF82D67B770B
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/datareporting/glean/tmp/6774a646-583c-407b-b50a-f0828990c49b
- Size 1KB
- SHA256 c4e08bfbb963160fd88b4dfe152619a77280b9931a4d6108efffa9bb9babf1b5
- MD5 f82301b0a490a6fb115063cf672020f7
- SHA1 c731c58f423d3ad56c0db17d4a6d38ca98e41b32
- SHA512 473ad96e8f51e072bbd76e8220928ea6e22b9cd600317dcf49751afd7d481074b148ed92716fd95768d4d8def1839babc390e2c2750d0a351e5e05081947bf98
- TLSH T14F111292DA31B971CE98968795543703DEB4712350C525A83DE09F0C0D7F52D67BB607
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/datareporting/glean/tmp/73a7f62a-7132-4141-aece-26d76a585d57
- Size 1KB
- SHA256 a131743d1a98d6299054ae91c91345d8517ac137e7bee12dc3f548262abd2c75
- MD5 65732944ce55e0fd2c9e3091ff513766
- SHA1 d9e6e44e9e4128baff89ddb3a152fc750af15b64
- SHA512 c871300542c7550bcf3deaf0fec3e5bc1e293450fba6fe3542d90f3ffd3542b4d1bb87f4661e388238ee1bfb3e792fa91cc679aedb959cb65f4a0b212d7aed9a
- TLSH T1B431E14128F05CEADE66E18A98183D4B8FEC352210DE45603ED5DD0CC639C1E23EB50B
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/datareporting/glean/tmp/8dbdce73-9c58-43cf-9ddd-5b8a162a6899
- Size 5KB
- SHA256 8cb51df29a91dda29fce7ab0b447b4eac019b47b22cce3121643bdd0c256d71d
- MD5 77908a133e3ba7fa16630d3ea49d5e70
- SHA1 f451c500b604edb7431e84464cd6b5b314ab6a72
- SHA512 1f92a1dd32aa4e0cdbf5016bef96c40e4e11900a0fd3813f634b2dcce6638fd3bbf481052e606456db8d87634ed36f25c5cfd0a2bae885d11f8d191ea17431ca
- SSDEEP 48:20nUqVtJKjVWH4xsYz0bXZPpM9A5l+XPZ0QAC7jPGebvwLtc9cauOVSTzR7Kq/cr:20ttJkWYfzOZPrwx0Vr0mU
- TLSH T15AB1215C35B48CAEDCCBF36DA051134A93B14F4B84522D832D85DE8CC99DA9932AE43E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/datareporting/glean/tmp/a0388a74-9046-4138-81d3-f2285e7c1fde
- Size 4KB
- SHA256 bc5804fcb058954f167f8a175a1d7b3ddb8d571c642bd43a2f3b90be7f556104
- MD5 afb0d316ccd0ca5b13a874ec9f17224e
- SHA1 f67f27428a251ae16308d7cc7ff5d12eeb26e11e
- SHA512 05812ad79dfed847c09f0b23759ab6506ee95698bdd2887bd68e61291c0161375453d6ee90fd5708d44620dece63043728f4d418fa01766dada53d6e052d7942
- SSDEEP 96:eJ7/mWA9np/6+HSQil+MzZYQrnPDaEEyqEUCeXj8PGvy:Yg/6+HSQil+Mz2WaEgzVy
- TLSH T1879150600A2D50FF770360F08A0E7F6E662A93F2B892E06B7D95570D17F915402E1BAB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/datareporting/glean/tmp/a1aa0997-f850-4571-a303-274c16990998
- Size 637B
- SHA256 9f4cafe2fef494254cbf702720f8cb4e814d02678a3f867f4ff077d411f59dbb
- MD5 d39d76d567ae37e4cd922a9405635ae2
- SHA1 66dfa3fe0befcf2dacad71462fc693bec7a19fef
- SHA512 4282b2bff36c504491e4009ec1ae2ff64425a8aaf24d01b9dbfbe8afcc3387d2004dfad9fa44877503d71f811917fbd823e968b567c8aafc1028aab12dbbcce7
- TLSH T163F0028378E485234C946B86F0D03A40627850335096F344E0D8CB747D5FA6742B3B1A
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/datareporting/glean/tmp/b8fa6fe3-d104-41d8-bda6-de4b057da638
- Size 368B
- SHA256 14b24d09e3ec8dcc51befe08acc9955607f4664ed2d60000df39bbb0de12ac8c
- MD5 0bc3dca961af07f57237e88c095573da
- SHA1 7780b19c7612f038c126502138bc8187077c2530
- SHA512 60fbad1cae0785311b22dfc67d852c8837f065ea4ba480a8ff660821a91aafa1cdb1cceffb92792811c868b65f7252b886b7853b38bb16493771329a42f3fab8
- TLSH T170E06898A0649111F980D62BA8D5080187A8E803C8EA80B6AAB0666D8BDB08C51E372E
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/datareporting/glean/tmp/c295784c-856b-4214-bbb0-c37cb474ecd1
- Size 4KB
- SHA256 d5f5797bbf7a758721faae4eaeb7dcd01d6c9838adc0a9d5c2c1a3d7c27f2e79
- MD5 c9d41752f7ba7ff73814677fb82bed58
- SHA1 f93522eadfa2bec6ecc66cf52034cfc1031a0c63
- SHA512 573ff22917df637aa58c7b3e8411ef3b0c45884e434d670ed805b6874ed11c693664fddd4f78002bd7e2a84572ef3c813f91046b4c75cbcf36f92b9683b73bb4
- SSDEEP 48:0Uaj9n9yWmM9A510zAXISA0RU4KAba9A9qs/TAgZhALwYhAbBUg3jAWkaXQ:m9yW1AXJA0EAbAAUsLA6AUMAbP3jhk
- TLSH T13291AD144439B87CE89AD7A2CB733F838B785336F489B51CECEE550657AF192127600B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/formhistory.sqlite
- Size 256KB
- SHA256 c1c00cdfb5662671e668b26ce7fa1119b8aa87251a1bfa9edffbcfc5d2d6b4a3
- MD5 d415fa19bb27bb3db612bae3e08afe7b
- SHA1 a5dd28ee2bb98550acc0e3a1575400150fb3b5eb
- SHA512 ac9c51242da35ede27df327e3bbe066276ac91bd25b06855fe1e1abe8c68e06d6a4bfef6adcb944579de52ea0985452d4c840cc5f4bcba145908f3a51d5d950c
- SSDEEP 24:DLYVxExBWrkier5NzW6LlmProNpNmVIpPuVM7rBmxF/EzgvA:DcHMArt0pmcNptpGVM7rBw/v
- TLSH T15B44994F59142432C9D78AB7FDD31E534ABD0056C6632B947EFC101D4FB1A0ADE58EA8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/prefs-1.js
- Size 7KB
- SHA256 b6d0ba5fab5001cf2d04989b4bcc808a6f531a5b89d850a85be5fc2aff497112
- MD5 f0f7c604d3d466aedf55aaf2b40a65b2
- SHA1 2d49ec54032125e53defba101f8effdac42bafff
- SHA512 ed0f69db77b33a4b13e4fc0498561a21622dda3de8d30cddf8276223a156421bfe1c0256d650654cc21aa54dfc047c913b33862d978b946b3cf825fc8ce08bf0
- SSDEEP 96:orTF2lqjq1C76xgzGQeFz2jSq68mGb2FDmPy1kjU8Pp8ikI08X++K:0u1C72AeFz2aDmPyTgp8ikI08q
- TLSH T116F10D789544CB7FB1B727AC6C6889500972C21FB2BF28CB01BA4709551CB7842FDAE7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/prefs-1.js
- Size 6KB
- SHA256 9dd8d37cfb866a71b3c0368015284c24c4b1ac114fc184bf7a9cd8399f83b28c
- MD5 bbdc6a0a93cae642275c000e0957ef20
- SHA1 dd78bf87436d38f8437bfaa287d38e2fcf4b3f84
- SHA512 4459713dbbbcbfad2aa3a58fe32320a5b71ded2a940ef4c7ff829cf33a3b5e1321ea055fb6a1c57fc6c32533adadadd28d5003ec185907e6d19e6e32efdf3977
- SSDEEP 96:oj7MuF2ppaqjq1476xgzGFhCzzMjSq68mGb2FDmPy1V8Pp81+K:Tu1472P+zMaDmPyXgp8R
- TLSH T12BD1307854088F7FB4B6376CAC6888505572C61FB3FF68CB10BA4609014CB7882F9AE7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/prefs-1.js
- Size 6KB
- SHA256 ca1f375483b975225ab22c7755e48be062f3dbde07b843d4131708ac59b0972e
- MD5 ee6bea073b851a36f67bd8c706b1fd39
- SHA1 c4d96dbdb82bfbb27128cf1880a0b67ce2f102ee
- SHA512 9338f41884dd7cabb150e95e977551bd3ff306cee94f18fd606e4b37198ab958de2646c852c9ad379143b623287078a6f4ed1eef5d3943d3f8d5c7648011e5c4
- SSDEEP 96:oj7MuF2ppaqjq1C76xgzGFhCzz2jSq68mGb2FDmPy1V8Pp8P+K:Tu1C72P+z2aDmPyXgp8T
- TLSH T105D1107855188F7FB4B6376C6C688C505572C61FB2FF68CB10BA8609014CB7842F9AE7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/prefs-1.js
- Size 6KB
- SHA256 6f9f680d7b8393fb51ceeb178bbc2b2ee9b122eb570443e4881685a13ae49c1c
- MD5 a55e32c4043fa2986cecc108e20abcd3
- SHA1 cf206c98e1257f8435df3d1975ebfeed72a90977
- SHA512 f3617886ac67bd24b9f011602d15b1b632b1f2d86bc805175c079d63ce89711f9bb409ced9e3c0e597bb8ae53aa382db6a71e32673f0010e6f67d54a8390e025
- SSDEEP 96:oj7MuF2lqjq1C76xgzGFheFz2jSq68mGb2FDmPy1V8Pp8P+K:Ku1C72PeFz2aDmPyXgp8T
- TLSH T1C9D1207895188F7FB5B6376C6C688C505572C21FB3BF68CB10BA8609015CB7842F9AE7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/prefs-1.js
- Size 6KB
- SHA256 37999e2b07d3a88018c276d753322f216c1f5071961170242cef08ee5f300621
- MD5 7b15bbbed6892f69f4f80606fd21dfba
- SHA1 a5bb9bd8d012378f3fadae13dd5c4be1194ec94b
- SHA512 4f76ba058074ca6d5a5e6d576254a751f8baac8b28429d5bd327bab99d6e2bb2fd6860f0ecd0dbbafd45f64f59fe9cbcdf7bab79196fb58d10e6dc8859eeba9b
- SSDEEP 96:ojUuF2lqjq1C76xgzGFheFz2jSq68mGb2FDmPy1V8Pp8P+K:iu1C72PeFz2aDmPyXgp8T
- TLSH T180D1207895188F7FB5B6376C6C688C505572C21FB2BF28CA10BA8609014CB7842F9AE7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/zvdm0pqy.default-release/webappsstore.sqlite
- Size 96KB
- SHA256 d884477ede4c58bb90cccb1552ba8a0eb784ec7e89614d7d37fbf274db078e16
- MD5 28265a4276d6806d3b28cbcd8f3cc687
- SHA1 a4e22988e4bf9bd4f5923cd3c9f21263850cdc98
- SHA512 3f0b156743e8ab892823931a77e2d331436d5a19223993a5abcd8d37378df68ddebc315a74bd07dfbf37e039d49b153f08723026c2d3434ded87dfc15e75c346
- SSDEEP 6:ltTo/e/E7R/Wwhm914iDKrvcwTlNCcVWDeNgLu5e3cwOJrheFDEf:D0OE7Rzhm9GiD0c4NCcVUo58cz16D
- TLSH T15AA3D88FCA4813A7DD0083789B461F80EE93585E45C343E238B423CC0AA37440B2F828
- MD5 SHA1 SHA512 SSDEEP TLSH