8ef9633fc6681313934a90728e2a9f22d28a9f2a533c115ecc424b3ec44f9f0d

Analysis

user interaction
yes
max time kernel
27s
max time network
12s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
12/08/2026, 04:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
xclicker_1.5.1_amd64.appimage
Size 213KB
Sample260812-e9199sv1cs
SHA256 8ef9633fc6681313934a90728e2a9f22d28a9f2a533c115ecc424b3ec44f9f0d
MD5 057a9f08e6b4a1658e46200edc0f23f4
SHA1 6836469a7d11c77016ced19ca0f637d71fa59d3a
SHA512 ad1578af7df1b3e75ce0b4a7b3dba33672efe3ee928bb7cf3a8761871fdacda7deb9276062ae4461507f10f266489bca68c441c8cffa1ca10b6463400d405ab7
SSDEEP 6144:H9Nl+lIuoy7hrzEu36sYOsnrCMLTbCsA:dmlIuo0zEu3ztsneJ
TLSH
T19924293773A2816AC08B51B43AC7C1D3A464B0F80731510F77966A1A7FB3A954F9EB93
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Changes its process name 29 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	gmain	1544	xclicker
Changes the process name, possibly in an attempt to hide itself	gdbus	1550	xclicker
Changes the process name, possibly in an attempt to hide itself	gmain	1558	xdg-desktop-portal
Changes the process name, possibly in an attempt to hide itself	gdbus	1559	xdg-desktop-portal
Changes the process name, possibly in an attempt to hide itself	pool	1560	xdg-desktop-portal
Changes the process name, possibly in an attempt to hide itself	gmain	1563	xdg-document-portal
Changes the process name, possibly in an attempt to hide itself	gdbus	1564	xdg-document-portal
Changes the process name, possibly in an attempt to hide itself	pool	1570	xdg-permission-store
Changes the process name, possibly in an attempt to hide itself	gmain	1569	xdg-permission-store
Changes the process name, possibly in an attempt to hide itself	gdbus	1571	xdg-permission-store
Changes the process name, possibly in an attempt to hide itself	pool	1572	xdg-document-portal
Changes the process name, possibly in an attempt to hide itself	fuse mainloop	1574	xdg-document-portal
Changes the process name, possibly in an attempt to hide itself	dconf worker	1578	xdg-desktop-portal
Changes the process name, possibly in an attempt to hide itself	gmain	1581	xdg-desktop-portal-gtk
Changes the process name, possibly in an attempt to hide itself	gdbus	1582	xdg-desktop-portal-gtk
Changes the process name, possibly in an attempt to hide itself	gmain	1585	gvfsd
Changes the process name, possibly in an attempt to hide itself	gdbus	1586	gvfsd
Changes the process name, possibly in an attempt to hide itself	pool	1587	gvfsd
Changes the process name, possibly in an attempt to hide itself	gmain	1593	gvfsd-fuse
Changes the process name, possibly in an attempt to hide itself	gdbus	1594	gvfsd-fuse
Changes the process name, possibly in an attempt to hide itself	gvfs-fuse-sub	1595	gvfsd-fuse
Changes the process name, possibly in an attempt to hide itself	pool	1596	xdg-desktop-portal-gtk
Changes the process name, possibly in an attempt to hide itself	pool	1598	xclicker
Changes the process name, possibly in an attempt to hide itself	pool	1597	xclicker
Changes the process name, possibly in an attempt to hide itself	click_handler	1602	xclicker
Changes the process name, possibly in an attempt to hide itself	click_handler	1603	xclicker
Changes the process name, possibly in an attempt to hide itself	click_handler	1604	xclicker
Changes the process name, possibly in an attempt to hide itself	click_handler	1605	xclicker
Changes the process name, possibly in an attempt to hide itself	click_handler	1606	xclicker

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/security/apparmor/features/dbus/mask	dbus-daemon

Reads runtime system information 21 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	xclicker
File opened for reading	/proc/1562/cmdline	dbus-daemon
File opened for reading	/proc/filesystems	xdg-permission-store
File opened for reading	/proc/1580/cmdline	dbus-daemon
File opened for reading	/proc/1584/cmdline	dbus-daemon
File opened for reading	/proc/1589/cmdline	dbus-daemon
File opened for reading	/proc/sys/kernel/cap_last_cap	dbus-daemon
File opened for reading	/proc/filesystems	xdg-desktop-portal
File opened for reading	/proc/filesystems	xdg-document-portal
File opened for reading	/proc/filesystems	gvfsd
File opened for reading	/proc/filesystems	dbus-daemon
File opened for reading	/proc/1539/cmdline	dbus-daemon
File opened for reading	/proc/1556/cmdline	dbus-daemon
File opened for reading	/proc/filesystems	gvfsd-fuse
File opened for reading	/proc/self/exe	xclicker_1.5.1_amd64.appimage
File opened for reading	/proc/self/fd	xclicker
File opened for reading	/proc/mounts	dbus-daemon
File opened for reading	/proc/1549/status	dbus-daemon
File opened for reading	/proc/1549/attr/current	dbus-daemon
File opened for reading	/proc/1566/cmdline	dbus-daemon
File opened for reading	/proc/filesystems	xdg-desktop-portal-gtk

/tmp/xclicker_1.5.1_amd64.appimage
/tmp/xclicker_1.5.1_amd64.appimage
1⤵
- Reads runtime system information
PID:1539

/tmp/.mount_xclickejsPpU/AppRun
/tmp/xclicker_1.5.1_amd64.appimage
1⤵
PID:1539

/tmp/.mount_xclickejsPpU/xclicker
/tmp/.mount_xclickejsPpU/xclicker
1⤵
- Changes its process name
- Reads runtime system information
PID:1539
- /usr/local/sbin/dbus-launch
  dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
  2⤵
  PID:1545
- /usr/local/bin/dbus-launch
  dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
  2⤵
  PID:1545
- /usr/sbin/dbus-launch
  dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
  2⤵
  PID:1545
- /usr/bin/dbus-launch
  dbus-launch "--autolaunch=11c67417355f45d397f6be11f62e85a6" --binary-syntax --close-stderr
  2⤵
  PID:1545
- - /usr/bin/dbus-daemon
    /usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:1547
  - - /usr/libexec/xdg-desktop-portal
      /usr/libexec/xdg-desktop-portal
      4⤵
      Changes its process name
      Reads runtime system information
      PID:1556
  - - /usr/libexec/xdg-document-portal
      /usr/libexec/xdg-document-portal
      4⤵
      Changes its process name
      Reads runtime system information
      PID:1562
  - - /usr/libexec/xdg-permission-store
      /usr/libexec/xdg-permission-store
      4⤵
      Changes its process name
      Reads runtime system information
      PID:1566
  - - /usr/libexec/xdg-desktop-portal-gtk
      /usr/libexec/xdg-desktop-portal-gtk
      4⤵
      Changes its process name
      Reads runtime system information
      PID:1580
  - - /usr/lib/gvfs/gvfsd
      /usr/lib/gvfs/gvfsd
      4⤵
      Changes its process name
      Reads runtime system information
      PID:1584

/usr/lib/gvfs/gvfsd-fuse
/usr/lib/gvfs/gvfsd-fuse /root/.gvfs -f -o big_writes
1⤵
- Changes its process name
- Reads runtime system information
PID:1589

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads