Overview
overview
8Static
static
1URLScan
urlscan
1http://br-rio-anx-r0...
windows10-2004-x64
3http://br-rio-anx-r0...
windows10-ltsc_2021-x64
3http://br-rio-anx-r0...
windows11-21h2-x64
8http://br-rio-anx-r0...
windows11-ltsc_2024-x64
3http://br-rio-anx-r0...
android-10-x64
1http://br-rio-anx-r0...
android-11-x64
1http://br-rio-anx-r0...
android-13-x64
1http://br-rio-anx-r0...
android-14-x64
1http://br-rio-anx-r0...
android-15-x64
1http://br-rio-anx-r0...
android-9-x86
1http://br-rio-anx-r0...
macos-10.15-amd64
4http://br-rio-anx-r0...
debian-12-armhf
http://br-rio-anx-r0...
debian-12-mipsel
http://br-rio-anx-r0...
debian-9-armhf
http://br-rio-anx-r0...
debian-9-mips
http://br-rio-anx-r0...
debian-9-mipsel
http://br-rio-anx-r0...
ubuntu-18.04-amd64
6http://br-rio-anx-r0...
ubuntu-20.04-amd64
6http://br-rio-anx-r0...
ubuntu-22.04-amd64
6http://br-rio-anx-r0...
ubuntu-24.04-amd64
6Analysis
- max time kernel
899s - max time network
897s - platform
ubuntu-24.04_amd64 - resource
ubuntu2404-amd64-20260126-en - resource tags
arch:amd64arch:i386image:ubuntu2404-amd64-20260126-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system - submitted
09/08/2026, 03:19
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://br-rio-anx-r007.router.teamviewer.com
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
900 seconds
Behavioral task
behavioral2
Sample
http://br-rio-anx-r007.router.teamviewer.com
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
11 signatures
900 seconds
Behavioral task
behavioral3
Sample
http://br-rio-anx-r007.router.teamviewer.com
Resource
win11-20260513-en
windows11-21h2-x64
18 signatures
900 seconds
Behavioral task
behavioral4
Sample
http://br-rio-anx-r007.router.teamviewer.com
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
900 seconds
Behavioral task
behavioral5
Sample
http://br-rio-anx-r007.router.teamviewer.com
Resource
android-x64-20260325-en
android-10-x64
2 signatures
900 seconds
Behavioral task
behavioral6
Sample
http://br-rio-anx-r007.router.teamviewer.com
Resource
android-x64-arm64-20260325-en
android-11-x64
2 signatures
900 seconds
Behavioral task
behavioral7
Sample
http://br-rio-anx-r007.router.teamviewer.com
Resource
android-33-x64-arm64-20260708-en
android-13-x64
2 signatures
900 seconds
Behavioral task
behavioral8
Sample
http://br-rio-anx-r007.router.teamviewer.com
Resource
android-34-x64-arm64-20260325.1-en
android-14-x64
2 signatures
900 seconds
Behavioral task
behavioral9
Sample
http://br-rio-anx-r007.router.teamviewer.com
Resource
android-35-x64-arm64-20260325-en
android-15-x64
1 signatures
900 seconds
Behavioral task
behavioral10
Sample
http://br-rio-anx-r007.router.teamviewer.com
Resource
android-x86-arm-20260325-en
android-9-x86
2 signatures
900 seconds
Behavioral task
behavioral11
Sample
http://br-rio-anx-r007.router.teamviewer.com
Resource
macos-20250619-en
macos-10.15-amd64
1 signatures
900 seconds
Behavioral task
behavioral12
Sample
http://br-rio-anx-r007.router.teamviewer.com
Resource
debian12-armhf-20260127-en
debian-12-armhf
0 signatures
900 seconds
Behavioral task
behavioral13
Sample
http://br-rio-anx-r007.router.teamviewer.com
Resource
debian12-mipsel-20260513-en
debian-12-mipsel
0 signatures
900 seconds
Behavioral task
behavioral14
Sample
http://br-rio-anx-r007.router.teamviewer.com
Resource
debian9-armhf-20260513-en
debian-9-armhf
0 signatures
900 seconds
Behavioral task
behavioral15
Sample
http://br-rio-anx-r007.router.teamviewer.com
Resource
debian9-mipsbe-20260513-en
debian-9-mips
0 signatures
900 seconds
Behavioral task
behavioral16
Sample
http://br-rio-anx-r007.router.teamviewer.com
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
0 signatures
900 seconds
Behavioral task
behavioral17
Sample
http://br-rio-anx-r007.router.teamviewer.com
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
8 signatures
900 seconds
Behavioral task
behavioral18
Sample
http://br-rio-anx-r007.router.teamviewer.com
Resource
ubuntu2004-amd64-20260513-en
ubuntu-20.04-amd64
8 signatures
900 seconds
Behavioral task
behavioral19
Sample
http://br-rio-anx-r007.router.teamviewer.com
Resource
ubuntu2204-amd64-20260127-en
ubuntu-22.04-amd64
8 signatures
900 seconds
General
Malware Config
Signatures
- Checks hardware identifiers (DMI) 1 TTPs 1 IoCs
Checks DMI information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /sys/devices/virtual/dmi/id/product_name firefox-bin - Reads hardware information 1 TTPs 1 IoCs
Accesses system info like serial numbers, manufacturer names etc.
description ioc Process File opened for reading /sys/devices/virtual/dmi/id/product_sku firefox-bin - Changes its process name 64 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself AsyncSi~lThread 3188 firefox-bin Changes the process name, possibly in an attempt to hide itself gmain 3193 firefox-bin Changes the process name, possibly in an attempt to hide itself pool-spawner 3192 firefox-bin Changes the process name, possibly in an attempt to hide itself pool 3195 firefox-bin Changes the process name, possibly in an attempt to hide itself gdbus 3196 firefox-bin Changes the process name, possibly in an attempt to hide itself glean.dispatche 3197 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 3199 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 3199 firefox-bin Changes the process name, possibly in an attempt to hide itself IPC I/O Parent 3199 firefox-bin Changes the process name, possibly in an attempt to hide itself Timer 3200 firefox-bin Changes the process name, possibly in an attempt to hide itself Timer 3200 firefox-bin Changes the process name, possibly in an attempt to hide itself Netlink Monitor 3201 firefox-bin Changes the process name, possibly in an attempt to hide itself Socket Thread 3202 firefox-bin Changes the process name, possibly in an attempt to hide itself Socket Thread 3202 firefox-bin Changes the process name, possibly in an attempt to hide itself IPDL Background 3203 firefox-bin Changes the process name, possibly in an attempt to hide itself Netlink Monitor 3201 firefox-bin Changes the process name, possibly in an attempt to hide itself IPDL Background 3203 firefox-bin Changes the process name, possibly in an attempt to hide itself Backgro~Pool #1 3204 firefox-bin Changes the process name, possibly in an attempt to hide itself Backgro~Pool #1 3204 firefox-bin Changes the process name, possibly in an attempt to hide itself pool 3207 firefox-bin Changes the process name, possibly in an attempt to hide itself glxtest:disk$0 3208 glxtest Changes the process name, possibly in an attempt to hide itself dconf worker 3209 firefox-bin Changes the process name, possibly in an attempt to hide itself HTML5 Parser 3210 firefox-bin Changes the process name, possibly in an attempt to hide itself HTML5 Parser 3210 firefox-bin Changes the process name, possibly in an attempt to hide itself pool-firefox 3211 firefox-bin Changes the process name, possibly in an attempt to hide itself pool-firefox 3212 firefox-bin Changes the process name, possibly in an attempt to hide itself JS Watchdog 3214 firefox-bin Changes the process name, possibly in an attempt to hide itself JS Watchdog 3214 firefox-bin Changes the process name, possibly in an attempt to hide itself BGReadURLs 3215 firefox-bin Changes the process name, possibly in an attempt to hide itself BGReadURLs 3215 firefox-bin Changes the process name, possibly in an attempt to hide itself Cache2 I/O 3216 firefox-bin Changes the process name, possibly in an attempt to hide itself Cache2 I/O 3216 firefox-bin Changes the process name, possibly in an attempt to hide itself Cookie 3217 firefox-bin Changes the process name, possibly in an attempt to hide itself Cookie 3217 firefox-bin Changes the process name, possibly in an attempt to hide itself TaskCon~ller #0 3218 firefox-bin Changes the process name, possibly in an attempt to hide itself TaskCon~ller #1 3219 firefox-bin Changes the process name, possibly in an attempt to hide itself StreamTrans #1 3220 firefox-bin Changes the process name, possibly in an attempt to hide itself StreamTrans #1 3220 firefox-bin Changes the process name, possibly in an attempt to hide itself BgIOThr~Pool #1 3221 firefox-bin Changes the process name, possibly in an attempt to hide itself BgIOThr~Pool #1 3221 firefox-bin Changes the process name, possibly in an attempt to hide itself StreamTrans #2 3222 firefox-bin Changes the process name, possibly in an attempt to hide itself StreamTrans #2 3222 firefox-bin Changes the process name, possibly in an attempt to hide itself BgIOThr~Pool #2 3223 firefox-bin Changes the process name, possibly in an attempt to hide itself BgIOThr~Pool #2 3223 firefox-bin Changes the process name, possibly in an attempt to hide itself Worker Launcher 3224 firefox-bin Changes the process name, possibly in an attempt to hide itself Worker Launcher 3224 firefox-bin Changes the process name, possibly in an attempt to hide itself QuotaManager IO 3225 firefox-bin Changes the process name, possibly in an attempt to hide itself QuotaManager IO 3225 firefox-bin Changes the process name, possibly in an attempt to hide itself Softwar~cThread 3226 firefox-bin Changes the process name, possibly in an attempt to hide itself Softwar~cThread 3226 firefox-bin Changes the process name, possibly in an attempt to hide itself Softwar~cThread 3226 firefox-bin Changes the process name, possibly in an attempt to hide itself Renderer 3227 firefox-bin Changes the process name, possibly in an attempt to hide itself Renderer 3227 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorker#0 3228 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorkerLP#0 3229 firefox-bin Changes the process name, possibly in an attempt to hide itself CanvasRenderer 3232 firefox-bin Changes the process name, possibly in an attempt to hide itself CanvasRenderer 3232 firefox-bin Changes the process name, possibly in an attempt to hide itself Compositor 3231 firefox-bin Changes the process name, possibly in an attempt to hide itself Compositor 3231 firefox-bin Changes the process name, possibly in an attempt to hide itself Glyph rasterize 3230 firefox-bin Changes the process name, possibly in an attempt to hide itself WrGlyph~terizer 3230 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorkerLP#0 3229 firefox-bin Changes the process name, possibly in an attempt to hide itself WRWorker#0 3228 firefox-bin Changes the process name, possibly in an attempt to hide itself ImageIO 3233 firefox-bin - Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo firefox-bin - Reads CPU attributes 1 TTPs 10 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/possible firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/cpu_capacity glxtest File opened for reading /sys/devices/system/cpu/present firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/size firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/topology/core_cpus firefox-bin File opened for reading /sys/devices/system/cpu/possible glxtest File opened for reading /sys/devices/system/cpu/present firefox-bin File opened for reading /sys/devices/system/cpu/possible firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq firefox-bin File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/size firefox-bin - Enumerates kernel/hardware configuration 1 TTPs 41 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/bus/pci/devices/0000:00:04.0/vendor glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0/device glxtest File opened for reading /sys/fs/cgroup/system.slice/agent.service/cpu.max firefox-bin File opened for reading /sys/devices/system/node firefox-bin File opened for reading /sys/bus/pci/devices/0000:00:05.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:02.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:04.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.0/device glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0/subsystem_device glxtest File opened for reading /sys/kernel/security/apparmor/features/dbus/mask dbus-daemon File opened for reading /sys/bus/pci/devices/0000:00:04.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.0/vendor glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0 firefox-bin File opened for reading /sys/module/apparmor/parameters/enabled dbus-daemon File opened for reading /sys/bus/pci/devices/0000:00:01.1/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:00.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:05.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:06.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:03.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:00.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.0/class glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0/vendor glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0/drm/renderD128 firefox-bin File opened for reading /sys/devices/pci0000:00/0000:00:02.0/drm/card1 firefox-bin File opened for reading /sys/bus/pci/devices/0000:00:05.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:02.0/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.1/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.3/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.3/class glxtest File opened for reading /sys/fs/cgroup/system.slice/agent.service/cpu.max firefox-bin File opened for reading /sys/bus/pci/devices glxtest File opened for reading /sys/bus/pci/devices/0000:00:06.0/class glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0/subsystem_vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.1/class glxtest File opened for reading /sys/bus/pci/devices/0000:00:03.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:03.0/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:01.3/device glxtest File opened for reading /sys/bus/pci/devices/0000:00:00.0/vendor glxtest File opened for reading /sys/devices/pci0000:00/0000:00:02.0/uevent glxtest File opened for reading /sys/bus/pci/devices/0000:00:02.0/vendor glxtest File opened for reading /sys/bus/pci/devices/0000:00:06.0/device glxtest -
description ioc Process File opened for reading /proc/pressure/memory firefox-bin File opened for reading /proc/self/fd/110 firefox-bin File opened for reading /proc/self/fd/134 firefox-bin File opened for reading /proc/self/maps grep File opened for reading /proc/self/task/3242/stat firefox-bin File opened for reading /proc/3270/cmdline dbus-daemon File opened for reading /proc/3293/cmdline dbus-daemon File opened for reading /proc/self/fd/111 firefox-bin File opened for reading /proc/filesystems dbus-daemon File opened for reading /proc/mounts dbus-daemon File opened for reading /proc/self/task/3186/stat firefox-bin File opened for reading /proc/filesystems xdg-permission-store File opened for reading /proc/3185/cmdline dbus-daemon File opened for reading /proc/filesystems gvfsd File opened for reading /proc/3287/cmdline dbus-daemon File opened for reading /proc/self/fd/41 firefox-bin File opened for reading /proc/self/fd/105 firefox-bin File opened for reading /proc/filesystems sed File opened for reading /proc/filesystems sed File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/filesystems xdg-desktop-portal File opened for reading /proc/self/fd/89 firefox-bin File opened for reading /proc/self/task/3398/stat firefox-bin File opened for reading /proc/self/maps grep File opened for reading /proc/filesystems sed File opened for reading /proc/filesystems at-spi-bus-launcher File opened for reading /proc/filesystems gvfsd-fuse File opened for reading /proc/self/fd/124 firefox-bin File opened for reading /proc/3100/status dbus-daemon File opened for reading /proc/self/maps grep File opened for reading /proc/filesystems sed File opened for reading /proc/filesystems glxtest File opened for reading /proc/self/stat firefox-bin File opened for reading /proc/self/stat firefox-bin File opened for reading /proc/filesystems firefox-bin File opened for reading /proc/self/fd/72 firefox-bin File opened for reading /proc/self/fd/129 firefox-bin File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/self/fd dbus-send File opened for reading /proc/self/fd dbus-launch File opened for reading /proc/3116/cmdline dbus-daemon File opened for reading /proc/self/mountinfo firefox-bin File opened for reading /proc/filesystems xdg-desktop-portal-gtk File opened for reading /proc/self/task/3317/stat firefox-bin File opened for reading /proc/self/maps grep File opened for reading /proc/self/maps grep File opened for reading /proc/3282/cmdline dbus-daemon File opened for reading /proc/self/mountinfo firefox-bin File opened for reading /proc/self/status firefox-bin File opened for reading /proc/self/task/3409/stat firefox-bin File opened for reading /proc/self/task/3410/stat firefox-bin File opened for reading /proc/self/task/3432/stat firefox-bin File opened for reading /proc/sys/kernel/cap_last_cap dbus-daemon File opened for reading /proc/3100/attr/apparmor/current dbus-daemon File opened for reading /proc/filesystems firefox-bin File opened for reading /proc/3262/cmdline dbus-daemon File opened for reading /proc/self/fd/125 firefox-bin File opened for reading /proc/meminfo firefox-bin File opened for reading /proc/self/maps grep File opened for reading /proc/filesystems sed File opened for reading /proc/self/cgroup firefox-bin File opened for reading /proc/self/fd/37 firefox-bin - Writes file to tmp directory 2 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/firefox/.parentlock firefox-bin File opened for modification /tmp/remote-settings-startup-bundle- firefox-bin
Processes
-
/usr/bin/xdg-openxdg-open http://br-rio-anx-r007.router.teamviewer.com1⤵PID:3093
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager2⤵
- Reads runtime system information
PID:3094 -
/usr/bin/dbus-launchdbus-launch --autolaunch 36e6eb39a6fa405996e79cad2731865d --binary-syntax --close-stderr3⤵
- Reads runtime system information
PID:3096 -
/usr/bin/dbus-daemon/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session4⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:3098 -
/usr/libexec/xdg-desktop-portal/usr/libexec/xdg-desktop-portal5⤵
- Reads runtime system information
PID:3241
-
-
/usr/libexec/at-spi-bus-launcher/usr/libexec/at-spi-bus-launcher5⤵
- Reads runtime system information
PID:3246
-
-
/usr/libexec/xdg-document-portal/usr/libexec/xdg-document-portal5⤵PID:3262
-
/usr/bin/fusermount3fusermount3 -o "rw,nosuid,nodev,fsname=portal,auto_unmount,subtype=portal" -- /root/.cache/doc6⤵PID:3277
-
-
-
/usr/libexec/xdg-permission-store/usr/libexec/xdg-permission-store5⤵
- Reads runtime system information
PID:3270
-
-
/usr/libexec/xdg-desktop-portal-gtk/usr/libexec/xdg-desktop-portal-gtk5⤵
- Reads runtime system information
PID:3282
-
-
/usr/libexec/gvfsd/usr/libexec/gvfsd5⤵
- Reads runtime system information
PID:3287
-
-
-
-
-
/usr/bin/grepgrep " = \\\"xfce4\\\"\$"2⤵
- Reads runtime system information
PID:3102
-
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE2⤵PID:3101
-
-
/usr/bin/xpropxprop -root2⤵PID:3103
-
-
/usr/bin/grepgrep -i "^xfce_desktop_window"2⤵
- Reads runtime system information
PID:3104
-
-
/usr/bin/grepgrep -q "^Enlightenment"2⤵
- Reads runtime system information
PID:3106
-
-
/usr/bin/unameuname2⤵PID:3107
-
-
/usr/bin/grepgrep -q "^file://"2⤵
- Reads runtime system information
PID:3109
-
-
/usr/bin/egrepegrep -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:3111
-
-
/usr/local/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:3111
-
-
/usr/local/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:3111
-
-
/usr/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵PID:3111
-
-
/usr/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
- Reads runtime system information
PID:3111
-
-
/usr/bin/sedsed -n "s/\\(^[[:alnum:]+\\.-]*\\):.*\$/\\1/p"2⤵
- Reads runtime system information
PID:3114
-
-
/usr/bin/xdg-mimexdg-mime query default x-scheme-handler/http2⤵PID:3115
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager3⤵PID:3116
-
/usr/bin/dbus-launchdbus-launch --autolaunch 36e6eb39a6fa405996e79cad2731865d --binary-syntax --close-stderr4⤵PID:3117
-
-
-
/usr/bin/grepgrep " = \\\"xfce4\\\"\$"3⤵PID:3119
-
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE3⤵PID:3118
-
-
/usr/bin/xpropxprop -root3⤵PID:3120
-
-
/usr/bin/grepgrep -i "^xfce_desktop_window"3⤵PID:3121
-
-
/usr/bin/grepgrep -q "^Enlightenment"3⤵
- Reads runtime system information
PID:3123
-
-
/usr/bin/unameuname3⤵PID:3124
-
-
/usr/bin/sedsed "s/:/ /g"3⤵
- Reads runtime system information
PID:3127
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵PID:3129
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:3131
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:3132
-
-
/usr/bin/headhead -n 13⤵PID:3130
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵
- Reads runtime system information
PID:3134
-
-
/usr/bin/headhead -n 13⤵PID:3135
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:3136
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:3137
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵
- Reads runtime system information
PID:3139
-
-
/usr/bin/headhead -n 13⤵PID:3140
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:3142
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:3141
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵
- Reads runtime system information
PID:3144
-
-
/usr/bin/headhead -n 13⤵PID:3145
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:3146
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:3147
-
-
/usr/bin/grepgrep "x-scheme-handler/http=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache3⤵
- Reads runtime system information
PID:3149
-
-
/usr/bin/headhead -n 13⤵PID:3150
-
-
/usr/bin/cutcut -d "=" -f 23⤵PID:3151
-
-
/usr/bin/cutcut -d ";" -f 13⤵PID:3152
-
-
-
/usr/bin/sedsed "s/:/ /g"2⤵
- Reads runtime system information
PID:3156
-
-
/usr/bin/sedsed -e "s|-|/|"2⤵
- Reads runtime system information
PID:3159
-
-
/usr/bin/sedsed -e "s|-|/|"2⤵
- Reads runtime system information
PID:3164
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:3169
-
-
/usr/bin/whichwhich firefox2⤵PID:3170
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:3173
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:3176
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:3181
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵PID:3184
-
-
/usr/bin/firefox/usr/bin/firefox http://br-rio-anx-r007.router.teamviewer.com2⤵PID:3185
-
-
/usr/lib/firefox/firefox-bin/usr/bin/firefox http://br-rio-anx-r007.router.teamviewer.com2⤵
- Checks hardware identifiers (DMI)
- Reads hardware information
- Changes its process name
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
PID:3185 -
/usr/lib/firefox/crashhelper/usr/lib/firefox/crashhelper 3185 9 /tmp/ 113⤵PID:3189
-
-
/usr/local/sbin/dbus-launchdbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr3⤵PID:3194
-
-
/usr/local/bin/dbus-launchdbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr3⤵PID:3194
-
-
/usr/sbin/dbus-launchdbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr3⤵PID:3194
-
-
/usr/bin/dbus-launchdbus-launch "--autolaunch=36e6eb39a6fa405996e79cad2731865d" --binary-syntax --close-stderr3⤵PID:3194
-
-
/usr/lib/firefox/glxtest/usr/lib/firefox/glxtest -f 183⤵
- Changes its process name
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:3198
-
-
/usr/lib/firefox/firefox-bin/usr/lib/firefox/firefox-bin -contentproc -ipcHandle 0 -signalPipe 1 -initialChannelId "{cd96f4d4-b373-48ba-8c92-9d542d5427c5}" -parentPid 3185 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser 1 forkserver3⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:3236
-
-
-
/usr/libexec/gvfsd-fuse/usr/libexec/gvfsd-fuse /root/.gvfs -f1⤵
- Reads runtime system information
PID:3293
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /root/.config/mozilla/firefox/q9xs27wp.default-release/datareporting/glean/events/events
- Size 2KB
- SHA256 a4fce110b9184008c3bf789b76157829f0961ed4787eab8883d8fc776a1bf8b1
- MD5 7016f4312a879f9d7c1725ceeca33a55
- SHA1 dd960a54c615b13d71bad5f648744b6447f10f2b
- SHA512 4894c701ed35b022d5b8747060326ba36fe0e76215e5fc7c7ff1ab67d545798a3b900f4fe06b4d1ab83993f3e86389d7b3c21bf716ba2c0f81a88def26ebef16
- TLSH T1E4518A0C3AF48C7AACCBF39C2480038B93694A4B45522D475E15FFC9CD906DA325943C
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/q9xs27wp.default-release/datareporting/glean/tmp/06c13979-b5cd-40fb-b268-3f213bc64f36
- Size 635B
- SHA256 4c290e48dbce7e7abcb76de355ccd6cbc988101eab6ad624ee0a0d5d187cccf7
- MD5 35ddde879e9759265cf8b185a3c294c9
- SHA1 11c5637b6d37f042444f4d908bad37b16a7b9517
- SHA512 f09d3dac1b8d8df985eb2f63f16cf3295c9ae5b48edf8cb36a55ffaeec61026be7357165adcc13d2748219d2905cfa2d1796ebc7471754fd2cb7a76abe2bb5e9
- TLSH T16BF0D822A068CD268C284B4AB0D07E40217D603360A9F61EF0D4D63C7DEF5AB03B378A
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/q9xs27wp.default-release/datareporting/glean/tmp/45483f0d-1087-4b1f-9aed-bec5c99373c6
- Size 680B
- SHA256 ca58d97aac5c68454ef05c03e8f7468be83d261599ffc2afe07f296fcffe32a8
- MD5 56ca04d884df76aba612a970caa09222
- SHA1 2737940d35f1fb3e1e802246bda7e38a6164f615
- SHA512 66846749a03006b38a79bdf61c34ed24f37502fca03e8f25ef710037a9c9e2af2c2d172b9a06a25be3ca2e1c5a5da3f7552f026bfeb31c1dce9a590e52401454
- TLSH T1AA01FE12A4A889258CA84B4AB4E03A407178603320A9F619F0C496383CFF57B427378A
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/q9xs27wp.default-release/datareporting/glean/tmp/4fa4e069-87f2-4339-8081-254dd0f82b2f
- Size 4KB
- SHA256 6c535b8b6bbe0508460fea20f1aee898a0d66cc65ed3663a0965263fd9948012
- MD5 88cf37224ed7a35f02d280a294605f31
- SHA1 7b5373d0d65b77e0e445d8b7252aaecc87821c89
- SHA512 903da0c55c06611d3ec8a16e1d1150753b3377a70f8bf3bddb201d1e0ec4aa5eafe919bbdd01e68d453f78f3b0e363b21bc74a3ac079407060e4cf00bfbb8925
- SSDEEP 96:xCx3hcWiJAXJA0EAbAAUsLA6AUMAbP3jhU:+MG20JRXsLSbPTi
- TLSH T190919D140439B87CD89AD7A2CB737F878B785736F089B51CECAE450657EB1A2127600B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/q9xs27wp.default-release/datareporting/glean/tmp/627ea7ab-e882-41f8-9ae9-94e48b36e113
- Size 5KB
- SHA256 2c7e996e762297e7d8c202e2e421f7062871d26a296f5f80529ea338a9675e80
- MD5 7fbf35d4636f5c90a7e4006cf2a3a7d7
- SHA1 697afad8bcfd275d70ec12ec6212cb1c99827acb
- SHA512 9097e3356be3fbb38987cbc817860d14c348e5cdc5a47f931461ef3fed4bc190be0095b5f18b76cfedfd666b61ce31cd382258cf27d5cf933b439550c0ab0e68
- SSDEEP 48:lRdeZUk/goLA/ccWHCxdKE0hDx/7HAgQpffyXZeKzBxMdJZgUJ07Hru2x1wH6l/8:lRdet4ohcWiLJE57ggQFsZXkdUWe6skb
- TLSH T142B151EC3AB48C6A9DCBF35C5051135B93B14B87840028436E85DF4DDC9DBA9326A53A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/q9xs27wp.default-release/datareporting/glean/tmp/6bd95cb9-d249-4729-a0af-5897064c1500
- Size 4KB
- SHA256 69443ee17ef24c2df270885227e2ed17cc0797c79fadbb5975fac155f1b97aa7
- MD5 0096f66392308ffe734ac753989a99bc
- SHA1 ab36dd43bf78f6fd4a6ef32b919c63ede8128a9d
- SHA512 67e3b9b17f921600817285a550d83e0296264b89c9117e36e57033234d72a0253693f78b8312c2dbed3d8f1bec80fd2a4d12b75e7ab892d932015aa0349abb7c
- SSDEEP 96:e+vuhQyWwRwdaEEyqEUCeXZgQQrnPzB82/6l+QMSi+rPFny:eTqaEgmQ2/6l+QMSi+rPFny
- TLSH T16F914F700A2D40FF370361F08A0E7FAE662AA3F5B882E02B7C95430D17F525402E1BA7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/q9xs27wp.default-release/datareporting/glean/tmp/6e263cc6-9dd4-4c3a-ba5f-37eb1f2f34f6
- Size 1KB
- SHA256 e0ff0dd1a1b382bcf3adc6b8d556812f3c1649f9a6be072718799b0a744c77c6
- MD5 a108a1f68f01b5f14dac638ae04ece6f
- SHA1 aa6fdae1e0b235e07af3b6e3b4b2a86871147d40
- SHA512 8c60e6718c45af5b2f77d8bd1edb3b20aa9c253842bc3180b000eff20d2d2df6408cb27f00d2a7ac0ad57274a3f0af2e146b9e9456277926a8bb23cfcf6a59ae
- TLSH T13531F2A12DF448A5AE44D2C649547D0B8FEC3232808D89A47E96DE0C8529E3E26DB603
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/q9xs27wp.default-release/datareporting/glean/tmp/7eaa1f27-72b0-4871-ab18-1952d1d47b9a
- Size 1KB
- SHA256 85eb78b6b758bd113c6fb29fe82983e823b45990019bcf4ce6c1bb1ad6132f6a
- MD5 1429419c23b660eea17abaef902b6184
- SHA1 6a3c0292e24f6a3ec031aa96ca957e6fee7199c6
- SHA512 e5426888c5bb849e4765fcd0a10da44cf2bd4a0b8b2a4d1ef9c6b4ceed2307b5191aa94996dc987d09b0cc85849cac16cee5d3e12698c9600f9cc6603e23fb66
- TLSH T179216390ACB4A6718D98C38B95E53B025BB4712780CA681CBCD54B080DBF62ED3B7707
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/q9xs27wp.default-release/datareporting/glean/tmp/aa4e2cfb-0d67-4c02-b13c-51df163f3117
- Size 1KB
- SHA256 40ffac24f18506b1228e07471d48c5c35745226aeab95ebc57243fee1a29b55a
- MD5 fc4c8dc6de5c9eeb14f4f6eda42004e1
- SHA1 1db6bde34f1ecfec5e4de3fa1760e1576aeb446c
- SHA512 fb9180139a5a0112b874743728382f3b219cb3abcd0a070100b26544294ef55a3b6fb6552655b63666f7647eb009ae4ede42d40ed44e92df395fe739c14ce8bc
- TLSH T1CA11429099B4A6B1DD5497C785883B025BB4712780C9642C7CD48A1C09BF62E93B7247
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/q9xs27wp.default-release/datareporting/glean/tmp/bc75f5e9-f88f-4c3b-8211-cc1f550300ce
- Size 368B
- SHA256 1ecc504ae9f3dc1c373ee1f2e8fb06529ea7153f3530b4e0816c5af56a98afa2
- MD5 c629e19c2f1915b558c7688d0f95dde5
- SHA1 1c8612532fd9dd898c5dc5fcf1ace4e51c9a16a5
- SHA512 e611492c9515678995177266da89d54836a83baef7c9f7935d3f95026b9470336369f61c5b8c419f4381d1169e70f11b937bff0c80161c9864f003117aefcaaf
- TLSH T1CDE0689A90A9D120EE849229C8900801876CE90794E6C0B9A8F0A16ECBD54CC92F321E
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/q9xs27wp.default-release/datareporting/glean/tmp/de692149-d6c9-4987-b43f-f21c82f420d2
- Size 4KB
- SHA256 3f869eb0ede6b748368907d45cc4fe6124d74c00d0f80355f43fde80de9a572c
- MD5 b7fcff45420c1f38aeefa31009c1ae60
- SHA1 212b353d69f27780d3545aa22beb136d7089d1ad
- SHA512 4b3d5fc86d6ea6478b686fbaa922208d7dc897a505494693b1436db3e3b380fd41178afb6dec28c113beed9c74412b9420148c41cd043cdba6b8c1a4a410a01a
- SSDEEP 96:YCDFhcWEAXJA0EAbAAUsLA6AUMAbP3jhsVX:xj720JRXsLSbPTKVX
- TLSH T195918D244479787CD89AD7A2CB737F838B785736F08DB51CECEE450667AB1A21276007
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/q9xs27wp.default-release/formhistory.sqlite
- Size 256KB
- SHA256 c1c00cdfb5662671e668b26ce7fa1119b8aa87251a1bfa9edffbcfc5d2d6b4a3
- MD5 d415fa19bb27bb3db612bae3e08afe7b
- SHA1 a5dd28ee2bb98550acc0e3a1575400150fb3b5eb
- SHA512 ac9c51242da35ede27df327e3bbe066276ac91bd25b06855fe1e1abe8c68e06d6a4bfef6adcb944579de52ea0985452d4c840cc5f4bcba145908f3a51d5d950c
- SSDEEP 24:DLYVxExBWrkier5NzW6LlmProNpNmVIpPuVM7rBmxF/EzgvA:DcHMArt0pmcNptpGVM7rBw/v
- TLSH T15B44994F59142432C9D78AB7FDD31E534ABD0056C6632B947EFC101D4FB1A0ADE58EA8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/q9xs27wp.default-release/prefs-1.js
- Size 7KB
- SHA256 8ae25d76346fe2c2202e65c2d7fe8894c266df0d8bc2d3e55e3eed5701b8f874
- MD5 5e67c2a2ef831fc8c2d6acc3b690a020
- SHA1 deae5c0417fa1750aa2459a9b5a46484e3a17752
- SHA512 e56c9be323c722541aa7a29333bb881150a058e819f725d126a01044393437c693102cded3f0a0805a85eb78452f5ebb3d528d412d896bd8e03416be6ef06622
- SSDEEP 96:oz/IqF2YqjqbQ7sY8RgzGZAz2jJ6eYFdTGbFFuv/AOhjp8xp8ikX0NS/zX:A6ubQ7sY8RJAz26Kuv/Aeup8ikX0NMX
- TLSH T15CF10A7C94488F7FA1B727AC6C6889500972C21FB2BF18DB01BA4318555CB7842FDAE7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/q9xs27wp.default-release/prefs-1.js
- Size 6KB
- SHA256 0ea7c7438321f8d92abede853423727b7c726895237ede18b812e7d8634332be
- MD5 edc1a8ae7e088887545a6c0e7949c6a1
- SHA1 0bec65b39cdb88baf003349d479e19b623708482
- SHA512 636398e6b495d6a5f3581c61c1fe79f8f7d57266fe1a466974ae7f18d560d8c04d15ce3ac0af426fe283b8ee036b584c1e6f59e3c2d90abd2a1c8297304a31ba
- SSDEEP 96:oz/jHF2XhqjqbQ7sKYnRgzGUCzMjJ6eYFdTGbFFuv/AOT8xp8MzX:AY8ubQ7shRECzM6Kuv/Akup8eX
- TLSH T1B7D1317890188F7FB5B237AC6C6488605972C21FB3BF28D610BA4719415CB7841FDAE7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/q9xs27wp.default-release/prefs-1.js
- Size 6KB
- SHA256 303ca359cfc350b0ed6279c6c9aa860683c5d2c68e14a64225927bf8015bc66f
- MD5 197e807364b9115d7556c8a80e56eae8
- SHA1 8f8ef7d10e96b9872e6ea5999d9a76d4df4be0b5
- SHA512 57aa2c9c0334fe272cbe0156db6000ebad1b64dcb3ae5ca736f9b0fbe5c75c0bec54c6906fb58f4d2267a003469f483c01308c20fb46bcdbd06761ac81dbe3ae
- SSDEEP 96:oz/jHF2XhqjqbQ7sKYnRgzGUCz2jJ6eYFdTGbFFuv/AOT8xp86zX:AY8ubQ7shRECz26Kuv/Akup8EX
- TLSH T1C0D1207890188F7FA5B277AC6C6488505972C21F73BF18D710BA8319055CB7841FDAE7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/q9xs27wp.default-release/prefs-1.js
- Size 6KB
- SHA256 7a058a19db8bd1d78d4b30d63a6c92b973410d27a2740e3867d22baf8acd299b
- MD5 2ca9468b65badf840847c5f9bfd62aa9
- SHA1 c3948adf6b575fb19f2accd79025fb0956d64136
- SHA512 b018e9ecc4f2e78d1daabaa5e4468f901a2e2d4ec9caeffba11cbf838d4213f60129ebd0a90ad87058ee9b1031c62103a6718a256ab0b4f6d134f317e432ff54
- SSDEEP 96:oz/jHF2YqjqbQ7sKYnRgzGUAz2jJ6eYFdTGbFFuv/AOT8xp86zX:AoubQ7shREAz26Kuv/Akup8EX
- TLSH T15DD1217891188F7FA5B277AC6C6488505972C21F73BF18D610BA8319055CB7841FDAE7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/q9xs27wp.default-release/prefs-1.js
- Size 6KB
- SHA256 8ae086d773aeb6f0c1037dd7abf4f9625250a81d3b80f726a9899822839cd240
- MD5 3cf3477bc1d618e61189b3afb55303bf
- SHA1 be81bd870d30b20ca965bc4b24423b38e9fa1a1a
- SHA512 32934e3d6f0030fcb35e1e38617ae572f2efe6962c66cbb0da613a0b42188e6c8144ab11963313bf452310a957bd59f591fd2f0e802387f5872d1220ba2bdafe
- SSDEEP 96:oz/jSF2YqjqbQ7sY8RgzGUAz2jJ6eYFdTGbFFuv/AOT8xp86zX:AnubQ7sY8REAz26Kuv/Akup8EX
- TLSH T1ACD1317891188F7FA4B237AC6C6889505972C21FB3BF28D711BA8319055CB7841FDAE7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /root/.config/mozilla/firefox/q9xs27wp.default-release/sessionstore-backups/recovery.jsonlz4.tmp
- Size 941B
- SHA256 dcc0c8b78736b2484dde61f7d64c7f02714693877ae58f6748400c1576248401
- MD5 dea6db0a8ea806b906b4461d65e86f68
- SHA1 934299505ff92c9a482b62f4122bac6f291bf5bd
- SHA512 e6ca4be19794c32f974b99527cb40400a8ad9612cff16bee4f70db3743125c8965a3f2359422d81f90e90ed7f594dfc9e8de810cedb08531257a1da83e8cefab
- TLSH T19911C4813AA534612BA5922E905F4FEBCA0F2062032CB46CD64D2F40035898FFFAC54E
- MD5 SHA1 SHA512 TLSH
- Path /root/.config/mozilla/firefox/q9xs27wp.default-release/webappsstore.sqlite
- Size 96KB
- SHA256 d884477ede4c58bb90cccb1552ba8a0eb784ec7e89614d7d37fbf274db078e16
- MD5 28265a4276d6806d3b28cbcd8f3cc687
- SHA1 a4e22988e4bf9bd4f5923cd3c9f21263850cdc98
- SHA512 3f0b156743e8ab892823931a77e2d331436d5a19223993a5abcd8d37378df68ddebc315a74bd07dfbf37e039d49b153f08723026c2d3434ded87dfc15e75c346
- SSDEEP 6:ltTo/e/E7R/Wwhm914iDKrvcwTlNCcVWDeNgLu5e3cwOJrheFDEf:D0OE7Rzhm9GiD0c4NCcVUo58cz16D
- TLSH T15AA3D88FCA4813A7DD0083789B461F80EE93585E45C343E238B423CC0AA37440B2F828
- MD5 SHA1 SHA512 SSDEEP TLSH