Analysis
- user interaction
yes - max time kernel
109s - max time network
112s - platform
ubuntu-20.04_amd64 - resource
ubuntu2004-amd64-20260126-en - resource tags
- submitted
25/08/2026, 17:06
General
- Target https://nullforums.net/login/register
- Sample260825-vmfytaszax
Score
6/10
Malware Config
Signatures
- Checks hardware identifiers (DMI) 1 TTPs 1 IoCs
Checks DMI information which indicate if the system is a virtual machine.
- Reads hardware information 1 TTPs 1 IoCs
Accesses system info like serial numbers, manufacturer names etc.
- Changes its process name 64 IoCs
- Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
- Reads CPU attributes 1 TTPs 9 IoCs
- Enumerates kernel/hardware configuration 1 TTPs 64 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
- Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
- Writes file to tmp directory 4 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/usr/bin/xdg-openxdg-open https://nullforums.net/login/register1⤵
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager2⤵
- Reads runtime system information
-
/usr/bin/dbus-launchdbus-launch --autolaunch 4816dd152e8c48ff97e9117d197c13d8 --binary-syntax --close-stderr3⤵
-
/usr/bin/dbus-daemon/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session4⤵
- Reads runtime system information
-
/usr/libexec/xdg-desktop-portal/usr/libexec/xdg-desktop-portal5⤵
- Reads runtime system information
-
-
/usr/libexec/at-spi-bus-launcher/usr/libexec/at-spi-bus-launcher5⤵
- Reads runtime system information
-
-
/usr/libexec/xdg-document-portal/usr/libexec/xdg-document-portal5⤵
-
-
/usr/libexec/xdg-permission-store/usr/libexec/xdg-permission-store5⤵
-
-
/usr/libexec/xdg-desktop-portal-gtk/usr/libexec/xdg-desktop-portal-gtk5⤵
-
-
/usr/libexec/gvfsd/usr/libexec/gvfsd5⤵
- Reads runtime system information
-
/usr/libexec/gvfsd-trash/usr/libexec/gvfsd-trash --spawner :1.8 /org/gtk/gvfs/exec_spaw/06⤵
- Reads runtime system information
-
-
-
/usr/libexec/dconf-service/usr/libexec/dconf-service5⤵
- Reads runtime system information
-
-
/usr/bin/nautilus/usr/bin/nautilus --gapplication-service5⤵
- Reads CPU attributes
-
-
/usr/bin/gnome-keyring-daemon/usr/bin/gnome-keyring-daemon --start --foreground "--components=secrets"5⤵
- Reads runtime system information
-
-
/usr/libexec/gvfs-udisks2-volume-monitor/usr/libexec/gvfs-udisks2-volume-monitor5⤵
- Reads runtime system information
-
-
/usr/libexec/gvfs-afc-volume-monitor/usr/libexec/gvfs-afc-volume-monitor5⤵
-
-
/usr/libexec/gvfs-mtp-volume-monitor/usr/libexec/gvfs-mtp-volume-monitor5⤵
- Enumerates kernel/hardware configuration
-
-
/usr/libexec/gvfs-gphoto2-volume-monitor/usr/libexec/gvfs-gphoto2-volume-monitor5⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/usr/libexec/gvfs-goa-volume-monitor/usr/libexec/gvfs-goa-volume-monitor5⤵
- Reads runtime system information
-
-
/usr/libexec/goa-daemon/usr/libexec/goa-daemon5⤵
- Reads runtime system information
-
-
/usr/libexec/goa-identity-service/usr/libexec/goa-identity-service5⤵
- Reads runtime system information
-
-
-
-
-
/usr/bin/grepgrep " = \\\"xfce4\\\"\$"2⤵
-
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE2⤵
-
-
/usr/bin/grepgrep -i "^xfce_desktop_window"2⤵
-
-
/usr/bin/xpropxprop -root2⤵
-
-
/usr/bin/grepgrep -q "^Enlightenment"2⤵
-
-
/usr/bin/unameuname2⤵
-
-
/usr/bin/grepgrep -q "^file://"2⤵
-
-
/usr/bin/egrepegrep -q "^[[:alpha:]+\\.\\-]+:"2⤵
-
-
/usr/local/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
-
-
/usr/local/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
-
-
/usr/sbin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
-
-
/usr/bin/grepgrep -E -q "^[[:alpha:]+\\.\\-]+:"2⤵
-
-
/usr/bin/sedsed -n "s/\\(^[[:alnum:]+\\.-]*\\):.*\$/\\1/p"2⤵
-
-
/usr/bin/xdg-mimexdg-mime query default x-scheme-handler/https2⤵
-
/usr/bin/dbus-senddbus-send --print-reply "--dest=org.freedesktop.DBus" /org/freedesktop/DBus org.freedesktop.DBus.GetNameOwner string:org.gnome.SessionManager3⤵
-
/usr/bin/dbus-launchdbus-launch --autolaunch 4816dd152e8c48ff97e9117d197c13d8 --binary-syntax --close-stderr4⤵
-
-
-
/usr/bin/grepgrep " = \\\"xfce4\\\"\$"3⤵
-
-
/usr/bin/xpropxprop -root _DT_SAVE_MODE3⤵
-
-
/usr/bin/grepgrep -i "^xfce_desktop_window"3⤵
-
-
/usr/bin/xpropxprop -root3⤵
-
-
/usr/bin/grepgrep -q "^Enlightenment"3⤵
-
-
/usr/bin/unameuname3⤵
-
-
/usr/bin/sedsed "s/:/ /g"3⤵
-
-
/usr/bin/cutcut -d ";" -f 13⤵
-
-
/usr/bin/cutcut -d "=" -f 23⤵
-
-
/usr/bin/headhead -n 13⤵
-
-
/usr/bin/grepgrep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵
-
-
/usr/bin/cutcut -d ";" -f 13⤵
-
-
/usr/bin/cutcut -d "=" -f 23⤵
-
-
/usr/bin/headhead -n 13⤵
-
-
/usr/bin/grepgrep "x-scheme-handler/https=" /.local/share/applications/defaults.list /.local/share/applications/mimeinfo.cache3⤵
-
-
/usr/bin/cutcut -d ";" -f 13⤵
-
-
/usr/bin/cutcut -d "=" -f 23⤵
-
-
/usr/bin/headhead -n 13⤵
-
-
/usr/bin/grepgrep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵
-
-
/usr/bin/cutcut -d ";" -f 13⤵
-
-
/usr/bin/cutcut -d "=" -f 23⤵
-
-
/usr/bin/headhead -n 13⤵
-
-
/usr/bin/grepgrep "x-scheme-handler/https=" /usr/local/share//applications/defaults.list /usr/local/share//applications/mimeinfo.cache3⤵
-
-
/usr/bin/cutcut -d ";" -f 13⤵
-
-
/usr/bin/cutcut -d "=" -f 23⤵
-
-
/usr/bin/headhead -n 13⤵
-
-
/usr/bin/grepgrep "x-scheme-handler/https=" /usr/share//applications/defaults.list /usr/share//applications/mimeinfo.cache3⤵
-
-
-
/usr/bin/sedsed "s/:/ /g"2⤵
-
-
/usr/bin/sedsed -e "s|-|/|"2⤵
- Reads runtime system information
-
-
/usr/bin/sedsed -e "s|-|/|"2⤵
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵
-
-
/usr/bin/whichwhich firefox2⤵
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵
-
-
/usr/bin/cutcut "-d=" -f 2-2⤵
-
-
/usr/bin/firefox/usr/bin/firefox https://nullforums.net/login/register2⤵
-
-
/usr/lib/firefox/firefox-bin/usr/bin/firefox https://nullforums.net/login/register2⤵
- Checks hardware identifiers (DMI)
- Reads hardware information
- Changes its process name
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
-
/usr/lib/firefox/crashhelper/usr/lib/firefox/crashhelper 1498 9 /tmp/ 113⤵
-
-
/usr/local/sbin/dbus-launchdbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr3⤵
-
-
/usr/local/bin/dbus-launchdbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr3⤵
-
-
/usr/sbin/dbus-launchdbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr3⤵
-
-
/usr/bin/dbus-launchdbus-launch "--autolaunch=4816dd152e8c48ff97e9117d197c13d8" --binary-syntax --close-stderr3⤵
-
-
/usr/lib/firefox/glxtest/usr/lib/firefox/glxtest -f 183⤵
- Changes its process name
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/usr/lib/firefox/firefox-bin/usr/lib/firefox/firefox-bin -contentproc -ipcHandle 0 -signalPipe 1 -initialChannelId "{88b44dee-6716-4f43-9957-cbec43bbe691}" -parentPid 1498 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appDir /usr/lib/firefox/browser 1 forkserver3⤵
- Changes its process name
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/usr/bin/speech-dispatcher/usr/bin/speech-dispatcher --spawn --communication-method unix_socket --socket-path /root/.cache/speech-dispatcher/speechd.sock3⤵
-
/bin/shsh -c "type espeak > /dev/null 2>&1"4⤵
-
-
/bin/shsh -c "type mbrola > /dev/null 2>&1"4⤵
-
-
/bin/shsh -c "type espeak > /dev/null 2>&1"4⤵
-
-
/bin/shsh -c "type espeak-ng > /dev/null 2>&1"4⤵
-
-
/bin/shsh -c "type mbrola > /dev/null 2>&1"4⤵
-
-
/bin/shsh -c "type curl > /dev/null 2>&1"4⤵
-
-
/bin/shsh -c "type epos-say > /dev/null 2>&1"4⤵
-
-
/bin/shsh -c "type say > /dev/null 2>&1"4⤵
-
-
/bin/shsh -c "type pico2wave > /dev/null 2>&1"4⤵
-
-
/bin/shsh -c "type llia_phon > /dev/null 2>&1"4⤵
-
-
/bin/shsh -c "type mbrola > /dev/null 2>&1"4⤵
-
-
/bin/shsh -c "type /opt/swift/bin/swift > /dev/null 2>&1"4⤵
-
-
/usr/lib/speech-dispatcher-modules/sd_espeak-ng/usr/lib/speech-dispatcher-modules/sd_espeak-ng /etc/speech-dispatcher/modules/espeak-ng.conf4⤵
-
-
/usr/lib/speech-dispatcher-modules/sd_generic/usr/lib/speech-dispatcher-modules/sd_generic /etc/speech-dispatcher/modules/mary-generic.conf4⤵
-
-
/usr/lib/speech-dispatcher-modules/sd_dummy/usr/lib/speech-dispatcher-modules/sd_dummy /etc/speech-dispatcher/modules/dummy.conf4⤵
-
-
-
-
/usr/libexec/gvfsd-fuse/usr/libexec/gvfsd-fuse /root/.cache/gvfs -f -o big_writes1⤵
- Reads runtime system information
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
475e552a4753d65e732e8f7daf17479b2d1566.tmp
41c770424ab240146ac5fabc906be5045574d8.tmp
aef7f7dab66da1ac099e7bff6430e7415d7062.tmp
dummy.log
espeak-ng.log
mary-generic.log
speech-dispatcher.log
speech-dispatcher.pid
events
30e2096d-e956-4c45-a2eb-3077dc8268fa
32e4685b-35c5-4b88-8301-8d83886c63e3
33253ccd-77b3-4682-b23c-12182a69d3a0
3542e674-f831-49c4-8f72-deb13246156f
6fd3b178-5593-4cf9-b04f-47f32093f89f
95704187-7d05-4d0d-9776-431bfcd77446
9b3ba771-33a4-45ba-80cc-97c600327e51
b43e1f53-cc1c-4c6a-aa47-e6776142c3d0
b9bdae42-55e2-4210-8e35-a25d3941c699
dccb5511-ae41-4d4e-bbfe-69df1800660d
e4ccf345-6541-42ab-ae1a-2070e49c9710
data.safe.tmp
data.safe.tmp
prefs-1.js
prefs-1.js
prefs-1.js
prefs-1.js
prefs-1.js
protections.sqlite
data.safe.tmp
.metadata-v2-tmp
KWLGZEAFW56LN6W34L5KXQEBGRNC4ASLN3UZGZGD5V4RI3GT6LRQ
metadata.sqlite
metadata.sqlite
data.sqlite
usage
1
2
3
webappsstore.sqlite
tmpaddon
tmpaddon